Rules
301 checks for AWS Terraform and CloudFormation, read from the same catalog the engine runs. Each page says what the check looks at and how to fix it.
Severity:
all
criticalhighmediumlow
Format:
Terraform (all)
CloudFormation
125 shown.
ACM
| AWS_ACM_001 | ACM certificate should use DNS validation instead of email validation | MEDIUM |
APIGW
| AWS_APIGW_001 | API Gateway REST stage should have access logging enabled | MEDIUM |
| AWS_APIGW_005 | API Gateway stage has neither X-Ray nor access logs | MEDIUM |
| AWS_APIGW_006 | API Gateway custom domain should not use the legacy TLS 1.0 security policy | MEDIUM |
| AWS_APIGW_007 | API Gateway method cache should be encrypted when caching is enabled | MEDIUM |
ATHENA
| AWS_ATHENA_001 | Athena workgroup should enforce workgroup configuration and encrypt query results | MEDIUM |
BACKUP
| AWS_BACKUP_001 | AWS Backup vault should have Vault Lock enabled for immutable backups | MEDIUM |
BEDROCK
| AWS_BEDROCK_002 | Bedrock agent conversation data not encrypted with a customer-managed key | MEDIUM |
| AWS_BEDROCK_006 | Bedrock AgentCore memory not encrypted with a customer-managed key | MEDIUM |
| AWS_BEDROCK_007 | Bedrock AgentCore gateway not encrypted with a customer-managed key | MEDIUM |
CLOUDFRONT
| AWS_CLOUDFRONT_002 | CloudFront distribution should enforce a minimum TLS version of TLSv1.2 | MEDIUM |
| AWS_CLOUDFRONT_005 | CloudFront distribution should have a WAF web ACL associated | MEDIUM |
| AWS_CLOUDFRONT_006 | CloudFront distribution should have access logging enabled | MEDIUM |
| AWS_CLOUDFRONT_007 | CloudFront Field Level Encryption profile is configured but not assigned to cache behavior | MEDIUM |
CODEBUILD
| AWS_CODEBUILD_004 | CodeBuild project build artifact encryption should be enabled | MEDIUM |
COGNITO
| AWS_COGNITO_002 | Cognito user pool should enable MFA | MEDIUM |
CT
| AWS_CT_002 | CloudTrail trail should have log file validation enabled | MEDIUM |
| AWS_CT_003 | CloudTrail trail should integrate with CloudWatch Logs | MEDIUM |
| AWS_CT_005 | CloudTrail trail should encrypt logs with a KMS key (SSE-KMS) | MEDIUM |
DDB
| AWS_DDB_001 | DynamoDB table should have Point-in-Time Recovery (PITR) enabled | MEDIUM |
| AWS_DDB_003 | DynamoDB table should have deletion protection enabled | MEDIUM |
DOCDB
| AWS_DOCDB_002 | DocumentDB cluster should export audit logs to CloudWatch | MEDIUM |
EC2
| AWS_EC2_004 | EC2 instance uses a GPU or compute-intensive type without a shutdown schedule | MEDIUM |
| AWS_EC2_011 | IMDS hop limit above 1 exposes the instance role to containers on the host | MEDIUM |
| AWS_EC2_013 | EC2 root volume is unencrypted because EBS encryption by default is turned off | MEDIUM |
ECR
| AWS_ECR_001 | ECR repository should have scan-on-push enabled | MEDIUM |
| AWS_ECR_002 | ECR repository should have image tag immutability enabled | MEDIUM |
ECS
| AWS_ECS_002 | ECS task definition container should use a read-only root filesystem | MEDIUM |
| AWS_ECS_004 | ECS task definition should specify a task role for fine-grained IAM access | MEDIUM |
| AWS_ECS_005 | ECS task definition should configure log driver for audit containers | MEDIUM |
| AWS_ECS_006 | ECS Exec (SSM-based shell access) should log to CloudWatch or S3 | MEDIUM |
EFS
| AWS_EFS_002 | EFS file system should have a backup policy enabled | MEDIUM |
EKS
| AWS_EKS_002 | EKS cluster should have control-plane logging enabled | MEDIUM |
| AWS_EKS_005 | EKS node group with SSH access should restrict source security groups | MEDIUM |
ELASTICACHE
| AWS_ELASTICACHE_004 | ElastiCache replication group should have automatic failover enabled | MEDIUM |
| AWS_ELASTICACHE_005 | ElastiCache cluster (standalone) should be upgraded to a replication group | MEDIUM |
| AWS_ELASTICACHE_007 | ElastiCache Redis cluster should retain at least one automatic snapshot | MEDIUM |
ELB
| AWS_ELB_001 | Load balancer should have access logging enabled | MEDIUM |
| AWS_ELB_005 | ALB HTTP listener should redirect to HTTPS | MEDIUM |
EMR
| AWS_EMR_001 | EMR Serverless application should have auto-stop configured | MEDIUM |
| AWS_EMR_002 | EMR Serverless application should have maximum capacity limits set | MEDIUM |
EVENTBRIDGE
| AWS_EVENTBRIDGE_001 | EventBridge Lambda targets should have invocation authorization | MEDIUM |
FIREHOSE
| AWS_FIREHOSE_001 | Kinesis Firehose delivery stream should have server-side encryption enabled | MEDIUM |
FSX
| AWS_FSX_001 | FSx file system should use a customer-managed KMS key for encryption | MEDIUM |
GA
| AWS_GA_001 | Global Accelerator should enable flow logs | MEDIUM |
GDY
| AWS_GDY_002 | GuardDuty S3 protection should be enabled | MEDIUM |
| AWS_GDY_003 | GuardDuty EKS protection should be enabled | MEDIUM |
GLUE
| AWS_GLUE_002 | Glue catalog database table with JSON classifier should use SSE-KMS | MEDIUM |
IAM
| AWS_IAM_002 | IAM password policy maximum age should be positive and no more than 90 days | MEDIUM |
| AWS_IAM_003 | IAM users should not have inline policies attached | MEDIUM |
| AWS_IAM_011 | GitHub OIDC role leaves the branch or environment open with a wildcard | MEDIUM |
| AWS_IAM_012 | IAM password policy should prevent password reuse | MEDIUM |
KINESIS
| AWS_KINESIS_001 | Kinesis Data Stream should use KMS server-side encryption | MEDIUM |
KMS
| AWS_KMS_001 | KMS key should have automatic rotation enabled | MEDIUM |
| AWS_KMS_003 | KMS multi-region key should restrict replica regions via key policy | MEDIUM |
LAMBDA
| AWS_LAMBDA_004 | Lambda function should have a dead-letter queue configured | MEDIUM |
| AWS_LAMBDA_007 | Lambda function should have an explicitly declared CloudWatch log group | MEDIUM |
LOGS
| AWS_LOGS_001 | CloudWatch log group should have a retention period configured | MEDIUM |
MQ
| AWS_MQ_002 | Amazon MQ for ActiveMQ broker should enable audit logging to CloudWatch | MEDIUM |
MSK
| AWS_MSK_004 | MSK cluster should deliver broker logs to CloudWatch, S3, or Firehose | MEDIUM |
NEPTUNE
| AWS_NEPTUNE_002 | Neptune cluster should have audit logging enabled | MEDIUM |
| AWS_NEPTUNE_003 | Neptune cluster should have IAM database authentication enabled | MEDIUM |
OPENSEARCH
| AWS_OPENSEARCH_003 | OpenSearch domain should have node-to-node encryption enabled | MEDIUM |
| AWS_OPENSEARCH_004 | OpenSearch domain should have fine-grained access control enabled | MEDIUM |
| AWS_OPENSEARCH_005 | OpenSearch domain should have audit logging enabled | MEDIUM |
OPS
| AWS_OPS_001 | Long-running Lambda has no DLQ and no reserved concurrency | MEDIUM |
| AWS_OPS_006 | SQS visibility timeout under 60 seconds (including creation default) | MEDIUM |
| AWS_OPS_009 | RDS changes applied immediately instead of in the maintenance window | MEDIUM |
| AWS_OPS_011 | CloudWatch alarm uses Average statistic for a latency-shaped metric | MEDIUM |
| AWS_OPS_012 | CloudWatch alarm on a critical metric treats missing data as missing | MEDIUM |
| AWS_OPS_023 | RDS engine version pinned to the major version only, with automatic minor upgrades on | MEDIUM |
| AWS_OPS_025 | Internet-facing load balancer lacks proven health-aware DNS routing | MEDIUM |
| AWS_OPS_026 | Load balancer has deletion protection turned off | MEDIUM |
| AWS_OPS_027 | Lambda async invocation with no reserved concurrency (retry-storm risk) | MEDIUM |
| AWS_OPS_029 | ECS service runs a single task (no redundancy) | MEDIUM |
| AWS_OPS_034 | Aurora cluster keeps backups for one day or less | MEDIUM |
| AWS_OPS_035 | IAM role or user is missing a permissions boundary | MEDIUM |
| AWS_OPS_037 | IAM user credentials: prefer federation for people and roles for workloads | MEDIUM |
| AWS_OPS_038 | Declared IAM access key should have a documented rotation plan | MEDIUM |
| AWS_OPS_043 | IAM password policy has no minimum length of its own (the API default of 6 applies) | MEDIUM |
| AWS_OPS_056 | Lambda function is configured with 10,240 MB or more of memory | MEDIUM |
| AWS_OPS_060 | Step Functions Express state machine (5-minute limit) | MEDIUM |
| AWS_OPS_062 | Sharded ElastiCache replication group needs a cluster mode review | MEDIUM |
| AWS_OPS_064 | Aurora Serverless v1 cluster (end of life) | MEDIUM |
| AWS_OPS_067 | Stateful resource has no prevent-destroy guard | MEDIUM |
| AWS_OPS_074 | Terraform S3 backend without encryption or a state lock | MEDIUM |
| AWS_OPS_076 | Resource module sourced from raw GitHub URL (no version pin) | MEDIUM |
| AWS_OPS_077 | Secrets Manager access should use a VPC endpoint, not public internet | MEDIUM |
| AWS_OPS_078 | KMS access should use a VPC endpoint, not public internet | MEDIUM |
| AWS_OPS_079 | ECR access should use VPC endpoints to avoid public internet pull | MEDIUM |
| AWS_OPS_084 | AWS Backup vault should use a CMK for encryption | MEDIUM |
| AWS_OPS_086 | AWS Inspector v2 should be enabled for EC2 and ECR vulnerability scanning | MEDIUM |
RDS
| AWS_RDS_004 | RDS production instance should have Multi-AZ enabled | MEDIUM |
| AWS_RDS_007 | Aurora cluster has no explicit customer-managed key choice | MEDIUM |
| AWS_RDS_010 | Aurora cluster does not enable IAM database authentication | MEDIUM |
| AWS_RDS_011 | Aurora cluster has fewer than two instances — no Multi-AZ failover target | MEDIUM |
| AWS_RDS_013 | RDS Enhanced Monitoring is disabled or the monitoring role is invalid | MEDIUM |
| AWS_RDS_015 | Aurora global cluster has no demonstrated customer-managed key choice | MEDIUM |
| AWS_RDS_016 | RDS automatic minor version upgrades are disabled | MEDIUM |
| AWS_RDS_017 | RDS backup retention period is shorter than 7 days | MEDIUM |
REDSHIFT
| AWS_REDSHIFT_004 | Redshift cluster should have user activity logging enabled | MEDIUM |
ROUTE53
| AWS_ROUTE53_001 | Route53 hosted zone should have DNSSEC signing enabled | MEDIUM |
| AWS_ROUTE53_003 | Route53 failover record with PRIMARY role should have a health check | MEDIUM |
| AWS_ROUTE53_004 | Route53 public hosted zone should log DNS queries | MEDIUM |
S3
| AWS_S3_004 | S3 bucket should have access logging enabled | MEDIUM |
| AWS_S3_011 | S3 audit/compliance bucket has no object-lock configuration | MEDIUM |
| AWS_S3_017 | S3 bucket has no server access logging | MEDIUM |
SAGEMAKER
| AWS_SAGEMAKER_001 | SageMaker domain should be in a VPC with security groups configured | MEDIUM |
| AWS_SAGEMAKER_003 | SageMaker notebook instance should not enable root access | MEDIUM |
| AWS_SAGEMAKER_004 | SageMaker endpoint configuration should specify a KMS key for its storage volume | MEDIUM |
SFN
| AWS_SFN_001 | Step Functions state machine should have logging enabled | MEDIUM |
SM
| AWS_SM_001 | Secrets Manager secret should have automatic rotation configured | MEDIUM |
SNS
| AWS_SNS_001 | SNS topic should use a customer-managed KMS key for encryption | MEDIUM |
| AWS_SNS_002 | SNS topic access policy should enforce TLS-only access | MEDIUM |
SQS
| AWS_SQS_001 | SQS queue without inline redrive should specify a KMS encryption key | MEDIUM |
| AWS_SQS_002 | SQS queue should have a dead-letter queue configured | MEDIUM |
| AWS_SQS_003 | SQS queue has server-side encryption explicitly disabled | MEDIUM |
VPC
| AWS_VPC_001 | VPC has no associated flow logs | MEDIUM |
| AWS_VPC_002 | VPC peering connection has no route table entry on requester side | MEDIUM |
| AWS_VPC_003 | Default security group permits any rule (should be no-rules) | MEDIUM |
| AWS_VPC_005 | VPC subnet automatically assigns public IPs on launch | MEDIUM |
| AWS_VPC_012 | Route to a VPC peering connection should not use an unrestricted CIDR | MEDIUM |
WAF
| AWS_WAF_002 | WAFv2 web ACL rate limit rule threshold is too permissive | MEDIUM |
| AWS_WAF_003 | WAFv2 web ACL should include AWSManagedRulesCommonRuleSet | MEDIUM |
| AWS_WAF_004 | WAFv2 web ACL should have logging enabled | MEDIUM |
Engine-generated findings
These come from the engine's cross-resource analysis rather than the catalog, so their ids are families, not single checks.
ATTACK_PATH_*— Attack paths- Chains that cross resources: an internet-reachable entry point, an identity it can use, and the IAM permissions that lead from there to account-wide control.
AWS_XREF_*— Cross-resource correlations- Issues that are only visible when you look at how several resources interact, not at any one resource on its own.
AWS_FUSION_*— Cost and security together- Findings that need a cost signal and a security signal on different resources in the same code, such as accelerator compute next to an administrator-equivalent IAM policy.
AWS_CRED_*— Credentials written into code- Literal credentials of recognisable shapes (AWS access key ids, private keys, provider tokens) in resource attributes, variable defaults and variable files.
AWS_CFN_*— CloudFormation only- Findings with no Terraform twin, such as a NoEcho parameter whose value flows into Outputs, or a nested stack pulled from an unpinned template URL.