Rules
301 checks for AWS Terraform and CloudFormation, read from the same catalog the engine runs. Each page says what the check looks at and how to fix it.
92 shown.
BATCH
| AWS_BATCH_001 | AWS Batch job definition should not run privileged containers | HIGH |
BEDROCK
| AWS_BEDROCK_001 | Bedrock service role trust policy lacks aws:SourceArn scoping | HIGH |
| AWS_BEDROCK_004 | Bedrock AgentCore code interpreter has public internet access | HIGH |
| AWS_BEDROCK_005 | Bedrock AgentCore browser has public internet access | HIGH |
CODEBUILD
| AWS_CODEBUILD_001 | CodeBuild project should not run builds in privileged mode | HIGH |
| AWS_CODEBUILD_002 | CodeBuild project environment variables should not contain plaintext secrets | HIGH |
COGNITO
| AWS_COGNITO_001 | Cognito user pool should have advanced security mode set to ENFORCED | HIGH |
CT
| AWS_CT_001 | CloudTrail trail should be multi-region | HIGH |
| AWS_CT_006 | CloudTrail trail should have logging enabled | HIGH |
DAX
| AWS_DAX_001 | DynamoDB Accelerator (DAX) cluster should have encryption at rest enabled | HIGH |
DOCDB
| AWS_DOCDB_001 | DocumentDB cluster should have storage encryption enabled | HIGH |
| AWS_DOCDB_003 | DocumentDB global cluster does not encrypt storage | HIGH |
EBS
| AWS_EBS_001 | Account-level default EBS encryption should not be disabled | HIGH |
EC2
| AWS_EC2_001 | EC2 instance should require IMDSv2 (token-based metadata access) | HIGH |
| AWS_EC2_002 | EC2 instance should have EBS root volume encryption enabled | HIGH |
| AWS_EC2_006 | EC2 instance has no metadata options block — IMDSv2 not configured | HIGH |
| AWS_EC2_008 | EBS volume should have encryption enabled | HIGH |
| AWS_EC2_009 | EC2 instance has detailed monitoring explicitly disabled | HIGH |
| AWS_EC2_010 | Network ACL should not allow 0.0.0.0/0 ingress on SSH (22) or RDP (3389) | HIGH |
ECS
| AWS_ECS_001 | ECS task definition should not run containers in privileged mode | HIGH |
| AWS_ECS_008 | ECS task definition EFS volume has transit encryption disabled | HIGH |
EFS
| AWS_EFS_001 | EFS file system should have encryption at rest enabled | HIGH |
EKS
| AWS_EKS_001 | EKS cluster Secrets should have envelope encryption | HIGH |
| AWS_EKS_003 | EKS cluster API server endpoint should not be publicly accessible | HIGH |
| AWS_EKS_004 | EKS cluster should use a supported Kubernetes version | HIGH |
| AWS_EKS_006 | EKS cluster with a public endpoint should limit which addresses can reach it | HIGH |
ELB
| AWS_ELB_002 | Classic ELB listener should not use HTTP — require HTTPS | HIGH |
GLUE
| AWS_GLUE_004 | Glue connection password should not be a plaintext literal | HIGH |
| AWS_GLUE_005 | Glue Data Catalog and connection-password responses should be protected | HIGH |
| AWS_GLUE_006 | Glue security configuration should encrypt S3 data at rest | HIGH |
IAM
| AWS_IAM_001 | IAM password policy should require uppercase, lowercase, number, and symbol | HIGH |
| AWS_IAM_009 | GitHub OIDC federated role allows assumption from any repository in an org | HIGH |
| AWS_IAM_010 | EKS IRSA role trust allows any service account (overly broad subject claim) | HIGH |
LAMBDA
| AWS_LAMBDA_001 | Lambda function should not use an end-of-life runtime | HIGH |
MQ
| AWS_MQ_001 | Amazon MQ broker should not be publicly accessible | HIGH |
MSK
| AWS_MSK_001 | MSK cluster should not allow unauthenticated client access | HIGH |
| AWS_MSK_002 | MSK cluster should enforce TLS encryption for client-to-broker connections | HIGH |
| AWS_MSK_003 | MSK cluster should not have public access enabled | HIGH |
OPS
| AWS_OPS_004 | RDS instance with no Multi-AZ, no deletion protection and no final snapshot | HIGH |
| AWS_OPS_007 | ECS task definition with a container not marked essential | HIGH |
| AWS_OPS_010 | Lambda Function URL without direct-origin IAM authentication | HIGH |
| AWS_OPS_024 | ElastiCache cluster has multiple nodes but automatic failover is turned off | HIGH |
| AWS_OPS_030 | DynamoDB table has point-in-time recovery turned off | HIGH |
| AWS_OPS_032 | OpenSearch / Elasticsearch domain runs on a single instance | HIGH |
| AWS_OPS_073 | Terraform backend is local (state file on developer's laptop) | HIGH |
RDS
| AWS_RDS_003 | RDS instance should have automated backups enabled | HIGH |
| AWS_RDS_005 | RDS deletion protection should be enabled | HIGH |
| AWS_RDS_008 | RDS DB cluster has deletion protection disabled | HIGH |
| AWS_RDS_018 | RDS PostgreSQL should enforce TLS connections | HIGH |
| AWS_RDS_019 | RDS MySQL should enforce TLS connections | HIGH |
| AWS_RDS_020 | Aurora PostgreSQL cluster should enforce TLS connections | HIGH |
| AWS_RDS_021 | Aurora MySQL cluster should enforce TLS connections | HIGH |
ROLESANYWHERE
| AWS_ROLESANYWHERE_001 | Roles Anywhere trust policy lacks trust-anchor scoping (aws:SourceArn / aws:SourceAccount / sts:SourceIdentity) | HIGH |
S3
| AWS_S3_003 | S3 bucket should have versioning enabled | HIGH |
| AWS_S3_005 | S3 bucket policy should deny non-TLS (HTTP) access | HIGH |
| AWS_S3_010 | S3 bucket has no Block Public Access companion resource | HIGH |
| AWS_S3_013 | S3 bucket ACL should not grant WRITE_ACP to a predefined group | HIGH |
| AWS_S3_014 | S3 bucket should not grant read to any authenticated AWS user | HIGH |
| AWS_S3_015 | S3 access point disables a Block Public Access setting | HIGH |
SAGEMAKER
| AWS_SAGEMAKER_002 | SageMaker notebook instance should not allow direct internet access | HIGH |
SSM
| AWS_SSM_001 | SSM Parameter with secret-like name should use SecureString type | HIGH |
| AWS_SSM_002 | SSM Parameter should not store credential value as plaintext in Terraform | HIGH |
| AWS_SSM_004 | SSM document is shared publicly with every AWS account | HIGH |
SSO
| AWS_SSO_001 | SSO permission set inline policy should not grant full administrative privileges | HIGH |
VPC
| AWS_VPC_004 | Security group permits 0.0.0.0/0 on a known debug or management port | HIGH |
| AWS_VPC_007 | Modern security-group ingress rule opens a management port to 0.0.0.0/0 | HIGH |
| AWS_VPC_008 | Security-group ingress CIDRs are slices of the 0.0.0.0/0 supernet | HIGH |
| AWS_VPC_009 | Modern security-group ingress rule opens a management port to ::/0 | HIGH |
| AWS_VPC_010 | Security group inline ingress opens a management port to ::/0 | HIGH |
| AWS_VPC_011 | Security-group ingress CIDRs resolve to the entire address space | HIGH |
| AWS_VPC_014 | Modern security-group ingress rule opens every port to ::/0 | HIGH |
| AWS_VPC_015 | Network ACL allows all traffic inbound from the internet | HIGH |
| AWS_VPC_016 | Standalone network ACL rule allows all traffic inbound from the internet | HIGH |
| AWS_VPC_020 | Security group opens SQL Server Browser (UDP 1434) to the internet | HIGH |
| AWS_VPC_021 | Security group opens SQL Server Browser (UDP 1434) to the IPv6 internet | HIGH |
WAF
| AWS_WAF_001 | WAFv2 web ACL default action is ALLOW with no rules configured | HIGH |
Engine-generated findings
These come from the engine's cross-resource analysis rather than the catalog, so their ids are families, not single checks.
ATTACK_PATH_* — Attack paths- Chains that cross resources: an internet-reachable entry point, an identity it can use, and the IAM permissions that lead from there to account-wide control.
AWS_XREF_* — Cross-resource correlations- Issues that are only visible when you look at how several resources interact, not at any one resource on its own.
AWS_FUSION_* — Cost and security together- Findings that need a cost signal and a security signal on different resources in the same code, such as accelerator compute next to an administrator-equivalent IAM policy.
AWS_CRED_* — Credentials written into code- Literal credentials of recognisable shapes (AWS access key ids, private keys, provider tokens) in resource attributes, variable defaults and variable files.
AWS_CFN_* — CloudFormation only- Findings with no Terraform twin, such as a NoEcho parameter whose value flows into Outputs, or a nested stack pulled from an unpinned template URL.