Terraform Rules
IaC rules for Terraform that identify insecure configurations in infrastructure and cloud resources.
Terraform Rule Catalog
| ID | Title | Severity |
|---|---|---|
IAC-0115 | AWS IAM policies that allow full "-" administrative privileges are created | CRITICAL |
IAC-0001 | Alibaba Cloud OSS bucket accessible to public | HIGH |
IAC-0067 | AWS IAM password policy does allow password reuse | HIGH |
IAC-0151 | AWS SageMaker endpoint data encryption at rest not configured | HIGH |
IAC-0155 | Neptune cluster instance is publicly available | HIGH |
IAC-0179 | Elastic load balancers do not use SSL Certificates provided by AWS Certificate Manager | HIGH |
IAC-0217 | SQS queue policy is public and access is not restricted to specific services or principals | HIGH |
IAC-0315 | Comprehend Entity Recognizer's model is not encrypted by KMS using a customer managed Key (CMK) | HIGH |
IAC-0316 | Comprehend Entity Recognizer's volume is not encrypted by KMS using a customer managed Key (CMK) | HIGH |
IAC-0318 | The Connect Instance S3 Storage Configuration utilizes Customer Managed Key. | HIGH |
IAC-0319 | DynamoDB table replica does not use CMK KMS encryption | HIGH |
IAC-0320 | AWS Lambda function is not configured to validate code-signing | HIGH |
IAC-0322 | AWS AdministratorAccess policy is used by IAM roles, users, or groups | HIGH |
IAC-0323 | IAM policy uses the AWS AdministratorAccess policy | HIGH |
IAC-0326 | MemoryDB snapshot is not encrypted by KMS using a customer managed Key (CMK) | HIGH |
IAC-0327 | Neptune snapshot is not securely encrypted | HIGH |
IAC-0328 | Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) | HIGH |
IAC-0329 | RedShift snapshot copy is not encrypted by KMS using a customer managed Key (CMK). | HIGH |
IAC-0330 | Redshift Serverless namespace is not encrypted by KMS using a customer managed key (CMK) | HIGH |
IAC-0331 | IAM Policy Document Allows All or Any AWS Principal Permissions to Resources | HIGH |
IAC-0335 | IAM policies allow exposure of credentials | HIGH |
IAC-0336 | IAM policies allow data exfiltration | HIGH |
IAC-0337 | IAM policies allow permissions management or resource exposure without constraints | HIGH |
IAC-0338 | IAM policies allow write access without constraints | HIGH |
IAC-0340 | DocDB Global Cluster is not encrypted at rest | HIGH |
IAC-0343 | DataSync Location Object Storage exposes secrets | HIGH |
IAC-0344 | DMS endpoint is not using a Customer Managed Key (CMK) | HIGH |
IAC-0345 | EventBridge Scheduler Schedule is not using a Customer Managed Key (CMK) | HIGH |
IAC-0346 | The DMS S3 does not use a Customer Managed Key (CMK) | HIGH |
IAC-0351 | Secrets Manager secrets are not rotated within 90 days | HIGH |
IAC-0355 | API Gateway method setting is not set to encrypted caching | HIGH |
IAC-0358 | CodeBuild S3 logs are not encrypted | HIGH |
IAC-0359 | Elastic Beanstalk environments do not have enhanced health reporting enabled | HIGH |
IAC-0375 | ALB is not configured with the defensive or strictest desync mitigation mode | HIGH |
IAC-0376 | EFS Access Points are not enforcing a root directory | HIGH |
IAC-0384 | SSM parameters are not utilizing KMS CMK. | HIGH |
IAC-0386 | EKS clusters are not running on a supported Kubernetes version | HIGH |
IAC-0390 | Amazon Redshift clusters do not have automatic snapshots enabled | HIGH |
IAC-0391 | Network firewalls do not have deletion protection enabled | HIGH |
IAC-0392 | Network firewall encryption does not use a CMK | HIGH |
IAC-0393 | Network Firewall Policy does not define an encryption configuration that uses a CMK | HIGH |
IAC-0394 | Neptune is not encrypted with KMS using a customer managed Key (CMK) | HIGH |
IAC-0395 | AWS Access key enabled on root account | HIGH |
IAC-0397 | Security configuration of the EMR Cluster does not ensure the encryption of EBS disks | HIGH |
IAC-0399 | NACL ingress allows all ports | HIGH |
IAC-0401 | RDS Performance Insights are not encrypted using KMS CMKs | HIGH |
IAC-0402 | IAM policy document allows all resources with restricted actions | HIGH |
IAC-0403 | Data source IAM policy document allows all resources with restricted actions | HIGH |
IAC-0404 | Transfer server does not force secure protocols. | HIGH |
IAC-0405 | AWS GitHub Actions OIDC authorization policies allow for unsafe claims or claim order | HIGH |
IAC-0411 | Permissions delegated to AWS services for AWS Lambda functions are not limited by SourceArn or SourceAccount | HIGH |
IAC-0431 | Ensure no hard-coded secrets exist in Parameter Store values | HIGH |
IAC-0434 | Ensure SQS policy does not allow public access through wildcards | HIGH |
IAC-0435 | Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability | HIGH |
IAC-0438 | Avoid AWS Redshift cluster with commonly used master username and public access setting enabled | HIGH |
IAC-0439 | Ensure AWS S3 access point block public access setting is enabled | HIGH |
IAC-0472 | Domain Name System Security Extensions (DNSSEC) signing is not enabled for Amazon Route 53 public hosted zones | HIGH |
IAC-0490 | The AWS Managed IAMFullAccess IAM policy should not be used | HIGH |
IAC-0500 | MWAA environment is publicly accessible | HIGH |
IAC-0507 | Ensure AWS Load Balancers use strong ciphers | HIGH |
IAC-0509 | Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | HIGH |
IAC-0510 | Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | HIGH |
IAC-0511 | Ensure AWS AppSync attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | HIGH |
IAC-0551 | Azure Key Vault Keys does not have expiration date | HIGH |
IAC-0556 | Secrets are exposed in Azure VM customData | HIGH |
IAC-0558 | MariaDB servers do not have public network access enabled set to False | HIGH |
IAC-0593 | Azure Security Center Defender set to Off for Kubernetes | HIGH |
IAC-0594 | Azure Microsoft Defender for Cloud is set to Off for Container Registries | HIGH |
IAC-0641 | Azure Cognitive Services account configured with public network access | HIGH |
IAC-0685 | Linux VM Without SSH Key | HIGH |
IAC-0692 | App Configuration Public Access Enabled | HIGH |
IAC-0696 | Azure Key Vault Public Network Access Control | HIGH |
IAC-0697 | Azure storage account has a blob container with public access | HIGH |
IAC-0722 | Backend of the API management system does not utilize HTTPS | HIGH |
IAC-0723 | DenyIntelMode for Azure Firewalls is not set to Deny | HIGH |
IAC-0727 | Firewall policy does not have IDPS mode set to deny | HIGH |
IAC-0730 | Event Hub Namespace not using TLS 1.2 or greater | HIGH |
IAC-0734 | AKS cluster not encrypting temp disks, caches, and data flows | HIGH |
IAC-0736 | Azure SQL Database Namespace is not zone redundant | HIGH |
IAC-0737 | Standard Replication is not enabled | HIGH |
IAC-0739 | Non-Critical System Pods Run on System Nodes | HIGH |
IAC-0756 | Azure GitHub Actions OIDC trust policy is insecurely configured | HIGH |
IAC-0759 | Storage for critical data are not encrypted with Customer Managed Key | HIGH |
IAC-0807 | Azure Storage Account storing Machine Learning workspace high business impact data is publicly accessible | HIGH |
IAC-0819 | Ensure no hard coded API token exist in the provider | HIGH |
IAC-0826 | Suspicious use of netcat with IP address | HIGH |
IAC-0827 | Ensure run commands are not vulnerable to shell injection | HIGH |
IAC-0833 | Ensure the firewall ingress is not wide open | HIGH |
IAC-0866 | GCP SQL Instances do not have SSL configured for incoming connections | HIGH |
IAC-0871 | GCP SQL database is publicly accessible | HIGH |
IAC-0874 | GCP SQL database instance does not have backup configuration enabled | HIGH |
IAC-0875 | GCP BigQuery dataset is publicly accessible | HIGH |
IAC-0887 | GCP Storage bucket is anonymously or publicly accessible | HIGH |
IAC-0891 | GCP VM instances do have block project-wide SSH keys feature disabled | HIGH |
IAC-0892 | GCP Projects do have OS Login disabled | HIGH |
IAC-0897 | Boot disks for instances do not use CSEKs | HIGH |
IAC-0900 | GCP IAM user are assigned Service Account User or Service Account Token creator roles at project level | HIGH |
IAC-0901 | GCP IAM Service account does have admin privileges | HIGH |
IAC-0903 | Roles impersonate or manage Service Accounts used at folder level | HIGH |
IAC-0904 | Roles impersonate or manage Service Accounts used at organizational level | HIGH |
IAC-0905 | Default Service Account is used at project level | HIGH |
IAC-0906 | Default Service Account is used at organization level | HIGH |
IAC-0907 | Default Service Account is used at folder level | HIGH |
IAC-0947 | GCP Vertex AI instances are not private | HIGH |
IAC-0952 | GCP Dataflow jobs are not private | HIGH |
IAC-0956 | GCP Dataproc clusters are anonymously or publicly accessible | HIGH |
IAC-0958 | GCP BigQuery Tables are anonymously or publicly accessible | HIGH |
IAC-0959 | GCP Artifact Registry repositories are anonymously or publicly accessible | HIGH |
IAC-0961 | GCP Dataproc Clusters have public IPs | HIGH |
IAC-0970 | KMS policy allows public access | HIGH |
IAC-0971 | IAM policy defines public access | HIGH |
IAC-0972 | GCP Storage buckets are publicly accessible to all users | HIGH |
IAC-0973 | Basic roles utilized at the organization level | HIGH |
IAC-0975 | Project level utilization of basic roles | HIGH |
IAC-0976 | IAM workload identity pool provider is not restricted | HIGH |
IAC-0978 | Spanner Database does not have drop protection enabled | HIGH |
IAC-0983 | GCP GitHub Actions OIDC trust policy is insecurely configured | HIGH |
IAC-0991 | GCP KMS crypto key is anonymously accessible | HIGH |
IAC-0993 | GCP Cloud KMS Key Rings are anonymously or publicly accessible | HIGH |
IAC-0994 | GCP Container Registry repositories are anonymously or publicly accessible | HIGH |
IAC-1025 | Ensure run commands are not vulnerable to shell injection | HIGH |
IAC-1027 | Suspicious use of netcat with IP address | HIGH |
IAC-1035 | GitHub Actions Environment Secrets defined in Terraform are not encrypted | HIGH |
IAC-1039 | Ensure GitHub organization security settings require 2FA | HIGH |
IAC-1044 | Ensure GitHub organization webhooks are using HTTPS | HIGH |
IAC-1045 | Ensure GitHub repository webhooks are using HTTPS | HIGH |
IAC-1070 | Gitlab branch protection rules defined in Terraform allow force push | HIGH |
IAC-1074 | IBM Cloud Virtual Private Cloud (VPC) classic access is enabled in Terraform | HIGH |
IAC-1191 | Limit the use of git-sync to prevent code injection | HIGH |
IAC-1198 | Ensure no hard coded Linode tokens exist in provider | HIGH |
IAC-1202 | Ensure Inbound Firewall Policy is not set to ACCEPT | HIGH |
IAC-1203 | Ensure Outbound Firewall Policy is not set to ACCEPT | HIGH |
IAC-1207 | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22 | HIGH |
IAC-1208 | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389 | HIGH |
IAC-1209 | Ensure Server instance is encrypted. | HIGH |
IAC-1210 | Ensure Basic Block storage is encrypted. | HIGH |
IAC-1213 | Ensure no NACL allow inbound from 0.0.0.0:0 to port 22 | HIGH |
IAC-1214 | Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389 | HIGH |
IAC-1217 | Ensure NAS is securely encrypted | HIGH |
IAC-1237 | OCI Object Storage bucket is publicly accessible | HIGH |
IAC-1257 | OpenAPI Security Definitions Object should be set and not empty | HIGH |
IAC-1258 | OpenAPI If the security scheme is not of type 'oauth2', the array value must be empty | HIGH |
IAC-1259 | Cleartext credentials over unencrypted channel should not be accepted for the operation | HIGH |
IAC-1260 | OpenAPI Security object needs to have defined rules in its array and rules should be defined in the securityScheme | HIGH |
IAC-1261 | OpenAPI Security object for operations, if defined, must define a security scheme, otherwise it should be considered an error | HIGH |
IAC-1262 | OpenAPI Security requirement not defined in the security definitions | HIGH |
IAC-1263 | The path scheme is supports unencrypted HTTP connections | HIGH |
IAC-1264 | API spec includes a 'password' flow in OAuth2 authentication | HIGH |
IAC-1266 | OAuth2 security definitions includes password flow in OpenAPI 2.0 file | HIGH |
IAC-1267 | OAuth2 password flow in security definitions for OpenAPI 2.0 file | HIGH |
IAC-1269 | Security definitions uses basic auth | HIGH |
IAC-1271 | Operation Objects Uses Basic Auth | HIGH |
IAC-1274 | Global schemes use 'http' protocol instead of 'https' | HIGH |
IAC-1276 | API keys transmitted over cleartext | HIGH |
IAC-1279 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | HIGH |
IAC-1283 | Ensure no hard coded PAN-OS credentials exist in provider | HIGH |
IAC-1293 | Ensure IPsec profiles do not specify use of insecure encryption algorithms | HIGH |
IAC-1301 | AWS Access Keys | HIGH |
IAC-1302 | Azure Storage Account Access Keys | HIGH |
IAC-1306 | IBM Cloud IAM Key | HIGH |
IAC-1318 | Ensure Tencent Cloud CBS is encrypted | HIGH |
IAC-1325 | Ensure Tencent Cloud VPC security group rules do not accept all traffic | HIGH |
IAC-1330 | Ensure Tencent Cloud CVM user data does not contain sensitive information | HIGH |
IAC-1333 | Terraform module sources do not use a git url with a tag or commit hash revision | HIGH |
IAC-1336 | Ensure storage bucket is encrypted. | HIGH |
IAC-1343 | Ensure etcd database is encrypted with KMS key. | HIGH |
IAC-1350 | Ensure storage bucket does not have public access permissions. | HIGH |
IAC-1352 | Ensure security group does not contain allow-all rules. | HIGH |
IAC-1353 | Ensure security group rule is not allow-all. | HIGH |
IAC-0000 | Ensure at least two approving reviews for PRs | MEDIUM |
IAC-0004 | Alibaba Cloud Action Trail Logging is not enabled for all regions | MEDIUM |
IAC-0005 | Alibaba Cloud Action Trail Logging is not enabled for all events | MEDIUM |
IAC-0006 | Alibaba Cloud OSS bucket is not encrypted with Customer Master Key | MEDIUM |
IAC-0014 | Alibaba Cloud RAM password policy does not have a number | MEDIUM |
IAC-0018 | Alibaba Cloud RAM password policy does not prevent password reuse | MEDIUM |
IAC-0019 | Alibaba Cloud RAM password policy does not have an uppercase character | MEDIUM |
IAC-0023 | Alibaba Cloud RAM password policy maximal login attempts is more than 4 | MEDIUM |
IAC-0042 | Disabled Ansible URI certificate validation | MEDIUM |
IAC-0043 | Certificate validation disabled with Ansible get_url module | MEDIUM |
IAC-0044 | SSL certificate validation disabled with Ansible Yum | MEDIUM |
IAC-0045 | SSL validation is disabled with yum | MEDIUM |
IAC-0048 | HTTPS url not used with Ansible uri | MEDIUM |
IAC-0049 | HTTPS url not used with Ansible get_url module | MEDIUM |
IAC-0051 | DNF usage of packages with untrusted or missing GPG signatures allowed | MEDIUM |
IAC-0052 | SSL validation disabled within Ansible DNF module | MEDIUM |
IAC-0053 | Certificate validation disabled within Ansible DNF module | MEDIUM |
IAC-0054 | Ensure Workflow pods are not using the default ServiceAccount | MEDIUM |
IAC-0055 | Ensure Workflow pods are running as non-root user | MEDIUM |
IAC-0102 | Amazon MQ Broker logging is not enabled | MEDIUM |
IAC-0123 | AWS S3 bucket policy overly permissive to any principal | MEDIUM |
IAC-0130 | Athena Database is not encrypted at rest | MEDIUM |
IAC-0133 | Amazon MSK cluster logging is not enabled | MEDIUM |
IAC-0134 | AWS MSK cluster encryption in transit is not enabled | MEDIUM |
IAC-0146 | S3 bucket policy allows lockout all but root user | MEDIUM |
IAC-0165 | Session Manager data is not encrypted in transit | MEDIUM |
IAC-0166 | Deletion protection disabled for load balancer | MEDIUM |
IAC-0174 | AWS config is not enabled in all regions | MEDIUM |
IAC-0178 | AWS EC2 instance detailed monitoring disabled | MEDIUM |
IAC-0197 | CodeBuild projects are not encrypted | MEDIUM |
IAC-0208 | Athena Workgroup is not encrypted | MEDIUM |
IAC-0216 | Glacier Vault access policy is public and not restricted to specific services or principals | MEDIUM |
IAC-0218 | SNS topic policy is public and access is not restricted to specific services or principals | MEDIUM |
IAC-0298 | AWS RDS PostgreSQL exposed to local file read vulnerability | MEDIUM |
IAC-0317 | Connect Instance Kinesis Video Stream Storage Config is not using CMK for encryption | MEDIUM |
IAC-0325 | AWS Security Group allows all traffic on all ports | MEDIUM |
IAC-0333 | Execution history logging is not enabled on the State Machine | MEDIUM |
IAC-0334 | AWS IAM Policy permission may cause privilege escalation | MEDIUM |
IAC-0341 | AWS database instances do not have deletion protection enabled | MEDIUM |
IAC-0347 | S3 lifecycle configuration does not set a period for aborting failed uploads | MEDIUM |
IAC-0349 | AWS RDS snapshots are accessible to public | MEDIUM |
IAC-0350 | AWS SSM documents are public | MEDIUM |
IAC-0352 | AWS CloudFront distributions does not have a default root object configured | MEDIUM |
IAC-0356 | Authorization type for API GatewayV2 routes is not specified | MEDIUM |
IAC-0357 | CloudFront distributions do not have origin failover configured | MEDIUM |
IAC-0362 | EC2 Auto Scaling groups are not utilizing EC2 launch templates | MEDIUM |
IAC-0363 | AWS CodeBuild project environment privileged mode is enabled | MEDIUM |
IAC-0364 | Elasticsearch Domain Audit Logging is disabled | MEDIUM |
IAC-0365 | Elasticsearch domains are not configured with a minimum of three dedicated master nodes | MEDIUM |
IAC-0366 | CloudWatch alarm actions are not enabled | MEDIUM |
IAC-0367 | Redshift clusters are not using the default database name. | MEDIUM |
IAC-0368 | Redshift clusters are not using enhanced VPC routing | MEDIUM |
IAC-0371 | RDS Cluster log capture is disabled | MEDIUM |
IAC-0373 | RDS Aurora Clusters do not have backtracking enabled | MEDIUM |
IAC-0377 | User identity should be enforced by EFS access points | MEDIUM |
IAC-0379 | ECS Fargate services are not ensured to run on the latest Fargate platform version | MEDIUM |
IAC-0381 | AWS ECS task definition elevated privileges enabled | MEDIUM |
IAC-0382 | ECS task definitions have their own unique process namespace or share the host's process namespace | MEDIUM |
IAC-0388 | AWS Auto Scaling group launch configuration configured with Instance Metadata Service hop count greater than 1 | MEDIUM |
IAC-0410 | Runtime of Lambda is deprecated | MEDIUM |
IAC-0412 | TLS not enforced in SES configuration set | MEDIUM |
IAC-0420 | Bedrock Agent not encrypted with Customer Master Key (CMK) | MEDIUM |
IAC-0425 | AWS Load Balancer uses HTTP protocol | MEDIUM |
IAC-0426 | AWS S3 bucket not configured with secure data transport policy | MEDIUM |
IAC-0432 | Ensure AWS SNS topic policies do not allow cross-account access | MEDIUM |
IAC-0433 | Reduce potential for WhoAMI cloud image name confusion attack | MEDIUM |
IAC-0436 | Ensure AWS Auto Scaling group launch configuration doesn’t have public IP address assignment enabled | MEDIUM |
IAC-0437 | Ensure AWS EMR block public access setting is enabled | MEDIUM |
IAC-0459 | IAM User has access to the console | MEDIUM |
IAC-0460 | Route53 A Record does not have Attached Resource | MEDIUM |
IAC-0463 | Public API gateway not configured with AWS Web Application Firewall v2 (AWS WAFv2) | MEDIUM |
IAC-0474 | AWS IAM policy allows full administrative privileges | MEDIUM |
IAC-0477 | AWS S3 buckets are accessible to any authenticated user | MEDIUM |
IAC-0481 | AWS CloudFront attached WAFv2 WebACL is not configured with AMR for Log4j Vulnerability | MEDIUM |
IAC-0488 | AWS CloudFront distribution is using insecure SSL protocols for HTTPS communication | MEDIUM |
IAC-0495 | An S3 bucket must have a lifecycle configuration | MEDIUM |
IAC-0498 | A Policy is not Defined for KMS Key | MEDIUM |
IAC-0502 | AWS RDS database instance not configured with encryption in transit | MEDIUM |
IAC-0503 | AWS API Gateway method lacking authorization or API keys | MEDIUM |
IAC-0505 | AWS CloudFront origin protocol policy does not enforce HTTPS-only | MEDIUM |
IAC-0508 | Ensure no open CORS policy | MEDIUM |
IAC-0560 | Virtual Machine extensions are installed | MEDIUM |
IAC-0561 | MSSQL is not using the latest version of TLS encryption | MEDIUM |
IAC-0562 | 'public network access enabled' is not set to 'False' for mySQL servers | MEDIUM |
IAC-0563 | MySQL is not using the latest version of TLS encryption | MEDIUM |
IAC-0578 | Azure Function App doesn't redirect HTTP to HTTPS | MEDIUM |
IAC-0580 | Azure App Services Remote debugging is enabled | MEDIUM |
IAC-0585 | Azure Network Security Group having Inbound rule overly permissive to all traffic on UDP protocol | MEDIUM |
IAC-0611 | Azure Data Factory (V2) configured with overly permissive network access | MEDIUM |
IAC-0612 | Unencrypted Data Lake Store accounts | MEDIUM |
IAC-0613 | Azure Event Grid domain public network access is enabled | MEDIUM |
IAC-0615 | Azure IoT Hub enables public network access | MEDIUM |
IAC-0616 | Key vault does not allow firewall rules settings | MEDIUM |
IAC-0646 | Azure Container registries Public access to All networks is enabled | MEDIUM |
IAC-0670 | Vulnerability Scanning not enabled for Azure Container Registry | MEDIUM |
IAC-0671 | Azure Container Registry (ACR) Isn't Configured to Use Signed/Trusted Images | MEDIUM |
IAC-0672 | Geo-Replicated Not Enabled for Azure Container Registry (ACR) | MEDIUM |
IAC-0673 | Azure Container Registry (ACR) Does Not Have a Quarantine Policy Enabled | MEDIUM |
IAC-0679 | AKS Secrets Store Without Auto-Rotation | MEDIUM |
IAC-0680 | API Management Without Minimum TLS 1.2 | MEDIUM |
IAC-0681 | API Management with Public Access | MEDIUM |
IAC-0683 | Web PubSub Without Managed Identities | MEDIUM |
IAC-0684 | Windows VM Without Automatic Updates | MEDIUM |
IAC-0688 | Data Explorer Not Using Managed Identities | MEDIUM |
IAC-0690 | VNET Using External DNS Addresses | MEDIUM |
IAC-0691 | Azure Event Grid Topic Managed Identity Provider | MEDIUM |
IAC-0693 | App Configuration Encryption Block Not Set | MEDIUM |
IAC-0694 | App Configuration Without Purge Protection Enabled | MEDIUM |
IAC-0698 | Azure Event Grid Topic Managed Identity Provider | MEDIUM |
IAC-0699 | Azure Event Grid Topic Local Authentication Enabled | MEDIUM |
IAC-0700 | Azure Event Grid Topic Public Network Access | MEDIUM |
IAC-0701 | Azure Event Grid Domain Managed Identity Provider is Disabled | MEDIUM |
IAC-0702 | Azure Event Grid Domain Local Authentication Enabled | MEDIUM |
IAC-0704 | Azure CDN Doesn't Disable HTTP Endpoint | MEDIUM |
IAC-0705 | Azure CDN Endpoint Custom domains is not configured with HTTPS | MEDIUM |
IAC-0706 | Azure Service Bus Doesn't Use Double Encryption | MEDIUM |
IAC-0707 | Azure CDN Using Outdated TLS Encryption | MEDIUM |
IAC-0708 | Azure Service Bus Doesn't Use Customer-Managed Key Encryption | MEDIUM |
IAC-0709 | Azure Service Bus Without Managed Identity Provider | MEDIUM |
IAC-0711 | Azure Service Bus with Public Network Access Enabled | MEDIUM |
IAC-0712 | Azure Service Bus Without Latest TLS Encryption | MEDIUM |
IAC-0714 | Azure Cognitive Search Without Managed Identities | MEDIUM |
IAC-0717 | Azure Cognitive Search With Global IP Allowance | MEDIUM |
IAC-0724 | Azure Application gateways listener that allow connection requests over HTTP | MEDIUM |
IAC-0726 | Azure Firewall does not define a firewall policy | MEDIUM |
IAC-0728 | Azure Function app configured with public network access | MEDIUM |
IAC-0729 | Azure App Service web apps with public network access | MEDIUM |
IAC-0731 | Ledger feature is disabled on the database | MEDIUM |
IAC-0732 | App Service Plan is not zone redundant | MEDIUM |
IAC-0733 | Operating system disks are not ephemeral disks | MEDIUM |
IAC-0735 | Azure Event Hub Namespace is not zone redundant | MEDIUM |
IAC-0738 | App Service Environment is not zone redundant | MEDIUM |
IAC-0741 | Azure Microsoft Defender for Cloud set to Off for Resource Manager | MEDIUM |
IAC-0750 | Ensure Azure Machine learning workspace is configured with private endpoint | MEDIUM |
IAC-0754 | Ensure that Azure Cognitive Services account hosted with OpenAI is configured with data loss prevention | MEDIUM |
IAC-0755 | Ensure that if Azure Batch account public network access in case ‘enabled’ then its account access must be ‘deny’ | MEDIUM |
IAC-0757 | Ensure Storage Sync Service is not configured with overly permissive network access | MEDIUM |
IAC-0758 | Ensure Azure Virtual Machine disks are configured without public network access | MEDIUM |
IAC-0780 | Azure Spring Cloud service is not configured with virtual network | MEDIUM |
IAC-0781 | Azure Automation account configured with overly permissive network access | MEDIUM |
IAC-0783 | Azure PostgreSQL database flexible server configured with overly permissive network access | MEDIUM |
IAC-0785 | Azure ACR HTTPS not enabled for webhook | MEDIUM |
IAC-0790 | Azure Storage account is not configured with private endpoint connection | MEDIUM |
IAC-0799 | Azure PostgreSQL servers not configured with private endpoint | MEDIUM |
IAC-0800 | Azure Database for MariaDB not configured with private endpoint | MEDIUM |
IAC-0801 | Azure Database for MySQL server not configured with private endpoint | MEDIUM |
IAC-0802 | Azure SQL Database server not configured with private endpoint | MEDIUM |
IAC-0803 | Azure Synapse Workspace vulnerability assessment is disabled | MEDIUM |
IAC-0804 | Anonymous blob access configured in Azure storage account | MEDIUM |
IAC-0813 | Ensure Azure MySQL Flexible Server is configured with private endpoint | MEDIUM |
IAC-0814 | Ensure PostgreSQL Flexible Server is configured with private endpoint | MEDIUM |
IAC-0815 | Ensure container job uses a non latest version tag | MEDIUM |
IAC-0816 | Ensure container job uses a version digest | MEDIUM |
IAC-0817 | Ensure set variable is not marked as a secret | MEDIUM |
IAC-0818 | Detecting image usages in azure pipelines workflows | MEDIUM |
IAC-0820 | Merge requests should require at least 2 approvals | MEDIUM |
IAC-0821 | Ensure the pipeline image uses a non latest version tag | MEDIUM |
IAC-0822 | Ensure the pipeline image uses a non latest version tag | MEDIUM |
IAC-0823 | Ensure the pipeline image version is referenced via hash not arbitrary tag. | MEDIUM |
IAC-0824 | Ensure mutable development orbs are not used. | MEDIUM |
IAC-0825 | Ensure unversioned volatile orbs are not used. | MEDIUM |
IAC-0828 | Suspicious use of curl in run task | MEDIUM |
IAC-0830 | Ensure the Spaces bucket has versioning enabled | MEDIUM |
IAC-0831 | Ensure the droplet specifies an SSH key | MEDIUM |
IAC-0832 | Ensure the Spaces bucket is private | MEDIUM |
IAC-0865 | GCP HTTPS Load balancer is set with SSL policy having TLS version 1.1 or lower | MEDIUM |
IAC-0876 | GCP Cloud DNS has DNSSEC disabled | MEDIUM |
IAC-0877 | RSASHA1 is used for Zone-Signing and Key-Signing Keys in Cloud DNS DNSSEC | MEDIUM |
IAC-0884 | GCP Kubernetes Engine private cluster has private endpoint disabled | MEDIUM |
IAC-0886 | GCP Kubernetes Engine Clusters using the default network | MEDIUM |
IAC-0890 | GCP VM instance using a default service account with Cloud Platform access scope | MEDIUM |
IAC-0931 | GCP Cloud Armor policy not configured with cve-canary rule | MEDIUM |
IAC-0953 | GCP Memorystore for Redis has AUTH disabled | MEDIUM |
IAC-0957 | GCP Pub/Sub Topics are anonymously or publicly accessible | MEDIUM |
IAC-0960 | GCP Cloud Run services are anonymously or publicly accessible | MEDIUM |
IAC-0965 | GCP Cloud Function is publicly accessible | MEDIUM |
IAC-0969 | SQL statements of GCP PostgreSQL are not logged | MEDIUM |
IAC-0974 | Basic roles used at the folder level | MEDIUM |
IAC-0977 | Deletion protection for Spanner Database is disabled | MEDIUM |
IAC-0979 | BigQuery tables do not have deletion protection enabled | MEDIUM |
IAC-0980 | Big Table Instances do not have deletion protection enabled | MEDIUM |
IAC-0984 | Ensure Vertex AI Notebook instances are launched with Shielded VM enabled | MEDIUM |
IAC-0985 | Ensure Integrity Monitoring for Shielded Vertex AI Notebook Instances is Enabled | MEDIUM |
IAC-0987 | GCP project is configured with legacy network | MEDIUM |
IAC-0995 | GCP Cloud Function HTTP trigger is not secured | MEDIUM |
IAC-1003 | Google Cloud Platform network is not ensured to define a firewall | MEDIUM |
IAC-1006 | Vertex AI instance disks not encrypted with a Customer Managed Key (CMK) | MEDIUM |
IAC-1007 | Document AI Processors not encrypted with a Customer Managed Key (CMK) | MEDIUM |
IAC-1008 | Document AI Warehouse Location is not configured to use a Customer Managed Key (CMK) | MEDIUM |
IAC-1009 | Vertex AI endpoint is not using a Customer Managed Key (CMK) | MEDIUM |
IAC-1010 | Vertex AI featurestore is not configured to use a Customer Managed Key (CMK) | MEDIUM |
IAC-1011 | Vertex AI tensorboard does not use a Customer Managed Key (CMK) | MEDIUM |
IAC-1012 | Vertex AI workbench instance disks not encrypted with a Customer Managed Key (CMK) | MEDIUM |
IAC-1013 | Vertex AI workbench instances are not private | MEDIUM |
IAC-1014 | Logging is disabled for Dialogflow agents | MEDIUM |
IAC-1015 | Logging for Dialogflow CX agents is disabled | MEDIUM |
IAC-1016 | Logging for Dialogflow CX webhooks is disabled | MEDIUM |
IAC-1017 | TPU v2 VM is public | MEDIUM |
IAC-1018 | Vertex AI endpoint is public | MEDIUM |
IAC-1019 | Vertex AI index endpoint is public | MEDIUM |
IAC-1020 | Vertex AI runtime is not encrypted with a Customer Managed Key (CMK) | MEDIUM |
IAC-1021 | Vertex AI runtime is public | MEDIUM |
IAC-1022 | Ensure GCP compute regional forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme | MEDIUM |
IAC-1023 | Ensure GCP compute global forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme | MEDIUM |
IAC-1024 | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn’t true on environment variables | MEDIUM |
IAC-1026 | Suspicious use of curl with secrets | MEDIUM |
IAC-1028 | Found artifact build without evidence of cosign sign execution in pipeline | MEDIUM |
IAC-1029 | Found artifact build without evidence of cosign sbom attestation in pipeline | MEDIUM |
IAC-1030 | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. | MEDIUM |
IAC-1031 | Ensure top-level permissions are not set to write-all | MEDIUM |
IAC-1033 | GitHub repository webhook defined in Terraform does not use a secure SSL | MEDIUM |
IAC-1036 | GitHub pull request configurations defined in Terraform have less than 2 approvals | MEDIUM |
IAC-1038 | Ensure each Repository has branch protection associated | MEDIUM |
IAC-1040 | Ensure GitHub organization security settings require SSO | MEDIUM |
IAC-1041 | Ensure GitHub organization security settings has IP allow list enabled | MEDIUM |
IAC-1042 | Ensure GitHub branch protection rules requires signed commits | MEDIUM |
IAC-1043 | GitHub merge requests should require at least 2 approvals | MEDIUM |
IAC-1046 | Ensure GitHub branch protection rules requires linear history | MEDIUM |
IAC-1047 | Ensure 2 admins are set for each repository | MEDIUM |
IAC-1048 | Ensure branch protection rules are enforced on administrators | MEDIUM |
IAC-1049 | Ensure GitHub branch protection dismisses stale review on new commit | MEDIUM |
IAC-1050 | Ensure GitHub branch protection restricts who can dismiss PR reviews | MEDIUM |
IAC-1051 | Ensure GitHub branch protection requires CODEOWNER reviews | MEDIUM |
IAC-1052 | Ensure all checks have passed before the merge of new code | MEDIUM |
IAC-1053 | Ensure inactive branches are reviewed and removed periodically | MEDIUM |
IAC-1054 | Ensure GitHub branch protection requires conversation resolution | MEDIUM |
IAC-1055 | Ensure GitHub branch protection requires push restrictions | MEDIUM |
IAC-1056 | Ensure GitHub branch protection rules does not allow deletions | MEDIUM |
IAC-1057 | Ensure any change to code receives approval of two strongly authenticated users | MEDIUM |
IAC-1058 | Ensure open git branches are up to date before they can be merged into codebase | MEDIUM |
IAC-1059 | Ensure public repository creation is limited to specific members | MEDIUM |
IAC-1060 | Ensure private repository creation is limited to specific members | MEDIUM |
IAC-1061 | Ensure internal repository creation is limited to specific members | MEDIUM |
IAC-1062 | Ensure minimum admins are set for the organization | MEDIUM |
IAC-1063 | Ensure strict base permissions are set for repositories | MEDIUM |
IAC-1064 | Ensure an organization’s identity is confirmed with a Verified badge Passed | MEDIUM |
IAC-1065 | Merge requests should require at least 2 approvals | MEDIUM |
IAC-1066 | Suspicious use of curl with CI environment variables in script | MEDIUM |
IAC-1067 | Avoid creating rules that generate double pipelines | MEDIUM |
IAC-1069 | Gitlab project defined in Terraform requires fewer than 2 approvals | MEDIUM |
IAC-1071 | Gitlab project defined in Terraform does not prevent secrets | MEDIUM |
IAC-1073 | IBM Cloud Application Load Balancer for VPC has public access enabled in Terraform | MEDIUM |
IAC-1075 | IBM Cloud API key creation is not restricted in account settings in Terraform | MEDIUM |
IAC-1076 | IBM Cloud Multi-Factor Authentication (MFA) not enabled at the account level in Terraform | MEDIUM |
IAC-1077 | IBM Cloud Service ID creation is not restricted in account settings in Terraform | MEDIUM |
IAC-1078 | IBM Cloud Kubernetes clusters are accessible by using public endpoint in Terraform | MEDIUM |
IAC-1197 | Minimize the admission of pods which lack an associated NetworkPolicy | MEDIUM |
IAC-1199 | Ensure SSH key set in authorized_keys | MEDIUM |
IAC-1200 | Ensure email is set | MEDIUM |
IAC-1201 | Ensure username is set | MEDIUM |
IAC-1204 | Ensure HTTP HTTPS Target group defines Healthcheck | MEDIUM |
IAC-1205 | Ensure every access control groups rule has a description | MEDIUM |
IAC-1206 | Ensure no security group rules allow outbound traffic to 0.0.0.0/0 | MEDIUM |
IAC-1211 | Ensure no NACL allow inbound from 0.0.0.0:0 to port 20 | MEDIUM |
IAC-1212 | Ensure no NACL allow inbound from 0.0.0.0:0 to port 21 | MEDIUM |
IAC-1215 | An inbound Network ACL rule should not allow ALL ports. | MEDIUM |
IAC-1216 | Ensure LB Listener uses only secure protocols | MEDIUM |
IAC-1218 | Ensure Load Balancer Target Group is not using HTTP | MEDIUM |
IAC-1219 | Ensure Load Balancer isn’t exposed to the internet | MEDIUM |
IAC-1220 | Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks. | MEDIUM |
IAC-1221 | Ensure Naver Kubernetes Service public endpoint disabled | MEDIUM |
IAC-1222 | Ensure Routing Table associated with Web tier subnet have the default route (0.0.0.0/0) defined to allow connectivity | MEDIUM |
IAC-1223 | Ensure NKS control plane logging enabled for all log types | MEDIUM |
IAC-1224 | Ensure Server instance should not have public IP. | MEDIUM |
IAC-1225 | Ensure Load Balancer Listener Using HTTPS | MEDIUM |
IAC-1226 | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80 | MEDIUM |
IAC-1227 | Ensure Access Control Group has Access Control Group Rule attached | MEDIUM |
IAC-1232 | OCI Compute Instance has Legacy MetaData service endpoint enabled | MEDIUM |
IAC-1238 | OCI IAM password policy for local (non-federated) users does not have a lowercase character | MEDIUM |
IAC-1239 | OCI IAM password policy for local (non-federated) users does not have a number | MEDIUM |
IAC-1240 | OCI IAM password policy for local (non-federated) users does not have a symbol | MEDIUM |
IAC-1241 | OCI IAM password policy for local (non-federated) users does not have an uppercase character | MEDIUM |
IAC-1244 | OCI VCN Security list has stateful security rules | MEDIUM |
IAC-1245 | OCI IAM password policy for local (non-federated) users does not have minimum 14 characters | MEDIUM |
IAC-1248 | OCI Network Security Groups (NSG) has stateful security rules | MEDIUM |
IAC-1250 | Ensure OCI Data Catalog is configured without overly permissive network access | MEDIUM |
IAC-1251 | OCI tenancy administrator users are associated with API keys | MEDIUM |
IAC-1254 | OCI File Storage File System access is not restricted to root users | MEDIUM |
IAC-1265 | Security scopes of operations are not defined in securityDefinition | MEDIUM |
IAC-1268 | Security definition uses the deprecated implicit flow on OAuth2 | MEDIUM |
IAC-1270 | Operation Objects Uses 'Implicit' Flow | MEDIUM |
IAC-1273 | Operation objects for PUT, POST, and PATCH operations do not have a 'consumes' field defined | MEDIUM |
IAC-1275 | The global security scope is not defined in the securityDefinitions | MEDIUM |
IAC-1277 | Array does not have a maximum number of items | MEDIUM |
IAC-1284 | Plain-text management HTTP enabled for Interface Management Profile in Palo Alto Networks devices | MEDIUM |
IAC-1285 | Plain-text management Telnet enabled for Interface Management Profile in Palo Alto Networks devices | MEDIUM |
IAC-1286 | Disable Server Response Inspection (DSRI) enabled in security policies for Palo Alto Networks devices | MEDIUM |
IAC-1287 | Security rule allows any application on Palo Alto Networks devices | MEDIUM |
IAC-1294 | IPsec profile uses insecure authentication algorithms on Palo Alto Networks devices | MEDIUM |
IAC-1295 | IPsec profile uses insecure authentication protocols on Palo Alto Networks devices | MEDIUM |
IAC-1299 | Security rules apply to all zones on Palo Alto Networks devices | MEDIUM |
IAC-1300 | Artifactory Credentials | MEDIUM |
IAC-1303 | Basic Auth Credentials | MEDIUM |
IAC-1311 | Private Key | MEDIUM |
IAC-1312 | Slack Token | MEDIUM |
IAC-1315 | Stripe Access Key | MEDIUM |
IAC-1319 | Ensure Tencent Cloud CVM instance does not allocate a public IP | MEDIUM |
IAC-1320 | Ensure Tencent Cloud CVM monitor service is enabled | MEDIUM |
IAC-1321 | Ensure Tencent Cloud CVM instances do not use the default security group | MEDIUM |
IAC-1322 | Ensure Tencent Cloud CVM instances do not use the default VPC | MEDIUM |
IAC-1323 | Ensure Tencent Cloud TKE clusters enable log agent | MEDIUM |
IAC-1324 | Ensure Tencent Cloud TKE cluster is not assigned a public IP address | MEDIUM |
IAC-1326 | Ensure Tencent Cloud mysql instances do not enable access from public networks | MEDIUM |
IAC-1327 | Ensure Tencent Cloud MySQL instances intranet ports are not set to the default 3306 | MEDIUM |
IAC-1328 | Ensure Tencent Cloud CLB has a logging ID and topic | MEDIUM |
IAC-1329 | Ensure Tencent Cloud CLBs use modern, encrypted protocols | MEDIUM |
IAC-1331 | Ensure Tencent Cloud VPC flow logs are enabled | MEDIUM |
IAC-1332 | Terraform module sources do not use a git url with a commit hash revision | MEDIUM |
IAC-1334 | Ensure security group is assigned to database cluster. | MEDIUM |
IAC-1335 | Ensure compute instance does not have public IP. | MEDIUM |
IAC-1337 | Ensure compute instance does not have serial console enabled. | MEDIUM |
IAC-1338 | Ensure Kubernetes cluster does not have public IP address. | MEDIUM |
IAC-1339 | Ensure Kubernetes cluster node group does not have public IP addresses. | MEDIUM |
IAC-1340 | Ensure Kubernetes cluster auto-upgrade is enabled. | MEDIUM |
IAC-1341 | Ensure Kubernetes node group auto-upgrade is enabled. | MEDIUM |
IAC-1342 | Ensure KMS symmetric key is rotated. | MEDIUM |
IAC-1344 | Ensure security group is assigned to network interface. | MEDIUM |
IAC-1345 | Ensure public IP is not assigned to database cluster. | MEDIUM |
IAC-1346 | Ensure cloud member does not have elevated access. | MEDIUM |
IAC-1347 | Ensure security group is assigned to Kubernetes cluster. | MEDIUM |
IAC-1348 | Ensure security group is assigned to Kubernetes node group. | MEDIUM |
IAC-1349 | Ensure network policy is assigned to Kubernetes cluster. | MEDIUM |
IAC-1351 | Ensure compute instance group does not have public IP. | MEDIUM |
IAC-1354 | Ensure organization member does not have elevated access. | MEDIUM |
IAC-1355 | Ensure compute instance group has security group assigned. | MEDIUM |
IAC-1356 | Ensure folder member does not have elevated access. | MEDIUM |
IAC-1357 | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | MEDIUM |
IAC-0007 | Alibaba Cloud disk encryption is disabled | LOW |
IAC-0008 | Alibaba Cloud Disk is not encrypted with Customer Master Key | LOW |
IAC-0009 | Alibaba Cloud database instance accessible to public | LOW |
IAC-0010 | Alibaba Cloud OSS bucket has versioning disabled | LOW |
IAC-0011 | Alibaba Cloud OSS bucket has transfer Acceleration disabled | LOW |
IAC-0012 | Alibaba Cloud OSS bucket has access logging enabled | LOW |
IAC-0020 | Alibaba Cloud RDS instance does not use SSL | LOW |
IAC-0021 | Alibaba Cloud API Gateway API Protocol does not use HTTPS | LOW |
IAC-0022 | Alibaba Cloud Transparent Data Encryption is disabled on instance | LOW |
IAC-0024 | Alibaba Cloud RAM does not enforce MFA | LOW |
IAC-0025 | Alibaba Cloud RDS Instance SQL Collector Retention Period is less than 180 | LOW |
IAC-0026 | Alibaba Cloud Kubernetes does not install plugin Terway or Flannel to support standard policies | LOW |
IAC-0027 | Alibaba Cloud KMS Key Rotation is disabled | LOW |
IAC-0028 | Alibaba Cloud KMS Key is disabled | LOW |
IAC-0029 | Alibaba cloud ALB ACL does not restrict public access | LOW |
IAC-0030 | Alibaba Cloud RDS instance is not set to perform auto upgrades for minor versions | LOW |
IAC-0031 | Alibaba Cloud Kubernetes node pools are not set to auto repair | LOW |
IAC-0032 | Alibaba Cloud launch template data disks are not encrypted | LOW |
IAC-0033 | Alibaba Cloud Cypher Policy is not secured | LOW |
IAC-0034 | Alibaba Cloud RDS instance does not have log_duration enabled | LOW |
IAC-0035 | Alibaba Cloud RDS instance has log_disconnections disabled | LOW |
IAC-0036 | Alibaba RDS instance has log_connections disabled | LOW |
IAC-0037 | Alibaba Cloud RDS log audit is disabled | LOW |
IAC-0038 | Alibaba Cloud MongoDB is not deployed inside a VPC | LOW |
IAC-0039 | Alibaba Cloud Mongodb instance does not use SSL | LOW |
IAC-0040 | Alibaba Cloud MongoDB instance is public | LOW |
IAC-0041 | Alibaba Cloud MongoDB does not have transparent data encryption enabled | LOW |
IAC-0046 | Usage of packages with unauthenticated or missing signatures allowed | LOW |
IAC-0047 | Usage of the force parameter disabling signature validation allowed | LOW |
IAC-0050 | Missing 'Rescue' section in Ansible block tasks | LOW |
IAC-0066 | AWS IAM password policy does not have a number | LOW |
IAC-0076 | AWS SageMaker notebook instance not configured with data encryption at rest using KMS key | LOW |
IAC-0092 | AWS EKS cluster security group overly permissive to all traffic | LOW |
IAC-0093 | AWS EKS cluster endpoint access publicly enabled | LOW |
IAC-0104 | AWS Lambda functions with tracing not enabled | LOW |
IAC-0128 | Global Accelerator does not have Flow logs enabled | LOW |
IAC-0140 | AWS Redshift cluster is publicly accessible | LOW |
IAC-0159 | AWS EBS volume region with encryption is disabled | LOW |
IAC-0167 | AWS EMR cluster is not configured with Kerberos Authentication | LOW |
IAC-0175 | AWS SageMaker notebook instance configured with direct internet access feature | LOW |
IAC-0177 | AWS CloudFormation stack configured without SNS topic | LOW |
IAC-0180 | Respective logs of Amazon RDS are disabled | LOW |
IAC-0181 | AWS VPC subnets should not allow automatic public IP assignment | LOW |
IAC-0183 | AWS RDS instance without Automatic Backup setting | LOW |
IAC-0185 | EC2 EBS is not optimized | LOW |
IAC-0187 | AWS Elasticsearch is not configured inside a VPC | LOW |
IAC-0188 | AWS Elastic Load Balancer (Classic) with cross-zone load balancing disabled | LOW |
IAC-0190 | Unencrypted RDS global clusters | LOW |
IAC-0191 | Redshift clusters version upgrade is not default | LOW |
IAC-0193 | S3 bucket lock configuration disabled | LOW |
IAC-0194 | S3 bucket cross-region replication disabled | LOW |
IAC-0195 | S3 buckets are not encrypted with KMS | LOW |
IAC-0196 | AWS RDS DB snapshot is not encrypted | LOW |
IAC-0198 | Default VPC is planned to be provisioned | LOW |
IAC-0200 | AWS Elastic Load Balancer v2 with deletion protection feature disabled | LOW |
IAC-0202 | Autoscaling groups did not supply tags to launch configurations | LOW |
IAC-0220 | AWS EMR cluster is not configured with SSE KMS for data at rest encryption (Amazon S3 with EMRFS) | LOW |
IAC-0224 | AWS WAF does not have associated rules | LOW |
IAC-0225 | AWS WAF Web Access Control Lists logging is disabled | LOW |
IAC-0226 | AWS Kinesis Video Stream not encrypted using Customer Managed Key | LOW |
IAC-0227 | AWS fx ontap file system not encrypted using Customer Managed Key | LOW |
IAC-0228 | AWS FSX Windows filesystem not encrypted using Customer Managed Key | LOW |
IAC-0229 | AWS Image Builder component not encrypted using Customer Managed Key | LOW |
IAC-0230 | AWS S3 Object Copy not encrypted using Customer Managed Key | LOW |
IAC-0231 | AWS Doc DB not encrypted using Customer Managed Key | LOW |
IAC-0232 | AWS EBS Snapshot Copy not encrypted using Customer Managed Key | LOW |
IAC-0233 | AWS Elastic File System (EFS) is not encrypted using Customer Managed Key | LOW |
IAC-0234 | AWS Kinesis streams encryption is using default KMS keys instead of Customer's Managed Master Keys | LOW |
IAC-0235 | AWS S3 bucket Object not encrypted using Customer Managed Key | LOW |
IAC-0236 | AWS Sagemaker domain not encrypted using Customer Managed Key | LOW |
IAC-0237 | AWS EBS Volume not encrypted using Customer Managed Key | LOW |
IAC-0238 | AWS lustre file system not configured with CMK key | LOW |
IAC-0239 | AWS Elasticache replication group not configured with CMK key | LOW |
IAC-0244 | AWS Elasticache security groups are not defined | LOW |
IAC-0245 | AWS MQBroker audit logging is disabled | LOW |
IAC-0246 | AWS RDS security groups are not defined | LOW |
IAC-0247 | AWS Image Builder Distribution Configuration is not encrypting AMI by Key Management Service (KMS) using a Customer Managed Key (CMK) | LOW |
IAC-0248 | AWS Image Recipe EBS Disk are not encrypted using a Customer Managed Key (CMK) | LOW |
IAC-0249 | AWS MemoryDB is not encrypted at rest by AWS' Key Management Service KMS using CMKs | LOW |
IAC-0250 | AWS MemoryDB data is not encrypted in transit | LOW |
IAC-0251 | AWS FSX openzfs is not encrypted by AWS' Key Management Service (KMS) using a Customer Managed Key (CMK) | LOW |
IAC-0252 | AWS AMIs are not encrypted by Key Management Service (KMS) using Customer Managed Keys (CMKs) | LOW |
IAC-0253 | AWS AMI launch permissions are not limited | LOW |
IAC-0254 | AWS API Gateway Domain does not use a modern security policy | LOW |
IAC-0255 | AWS MQBroker's minor version updates are disabled | LOW |
IAC-0256 | AWS MQBroker version is not up to date | LOW |
IAC-0257 | AWS MQ Broker is not encrypted by Customer Managed Key (CMK) | LOW |
IAC-0258 | AWS Batch Job is defined as a privileged container | LOW |
IAC-0259 | AWS RDS does not use a modern CaCert | LOW |
IAC-0260 | AWS EBS Volume is not encrypted by Key Management Service (KMS) using a Customer Managed Key (CMK) | LOW |
IAC-0261 | AWS ELB Policy uses some unsecure protocols | LOW |
IAC-0262 | AWS Appsync API Cache is not encrypted at rest | LOW |
IAC-0263 | AWS Appsync API Cache is not encrypted in transit | LOW |
IAC-0264 | AWS Cloudfront distribution is disabled | LOW |
IAC-0265 | AWS API deployments do not enable Create before Destroy | LOW |
IAC-0266 | AWS Cloudsearch does not use the latest (Transport Layer Security) TLS | LOW |
IAC-0267 | AWS CodePipeline artifactStore is not encrypted by Key Management Service (KMS) using a Customer Managed Key (CMK) | LOW |
IAC-0268 | AWS Cloudsearch does not use HTTPs | LOW |
IAC-0269 | AWS Code Artifact Domain is not encrypted by KMS using a Customer Managed Key (CMK) | LOW |
IAC-0270 | AWS DMS replication instance automatic version upgrade disabled | LOW |
IAC-0271 | AWS ECS Cluster does not enable logging of ECS Exec | LOW |
IAC-0272 | AWS cluster logging is not enabled or client to container communication not encrypted using a Customer Managed Key (CMK) | LOW |
IAC-0273 | AWS API Gateway method settings do not enable caching | LOW |
IAC-0274 | AWS DB instance does not get all minor upgrades automatically | LOW |
IAC-0275 | AWS Key Management Service (KMS) key is disabled | LOW |
IAC-0276 | AWS Elasticsearch domain does not use an updated TLS policy | LOW |
IAC-0277 | AWS NACL allows ingress from 0.0.0.0/0 to port 21 | LOW |
IAC-0278 | AWS NACL allows ingress from 0.0.0.0/0 to port 20 | LOW |
IAC-0279 | AWS NACL allows ingress from 0.0.0.0/0 to port 3389 | LOW |
IAC-0280 | AWS NACL allows ingress from 0.0.0.0/0 to port 22 | LOW |
IAC-0281 | AWS ACM certificate does not enable Create before Destroy | LOW |
IAC-0282 | AWS ACM certificates does not have logging preference | LOW |
IAC-0283 | AWS copied AMIs are not encrypted | LOW |
IAC-0284 | AWS AMI copying does not use a Customer Managed Key (CMK) | LOW |
IAC-0285 | Ensure AWS API gateway enables Create before Destroy | LOW |
IAC-0287 | AWS DAX cluster endpoint does not use TLS (Transport Layer Security) | LOW |
IAC-0288 | AWS Kinesis Firehose's delivery stream is not encrypted | LOW |
IAC-0289 | AWS Kinesis Firehose Delivery Streams are not encrypted with CMK | LOW |
IAC-0290 | AWS MWAA environment has scheduler logs disabled | LOW |
IAC-0291 | AWS MWAA environment has worker logs disabled | LOW |
IAC-0292 | AWS MWAA environment has webserver logs disabled | LOW |
IAC-0293 | AWS replicated backups are not encrypted at rest by Key Management Service (KMS) using a Customer Managed Key (CMK) | LOW |
IAC-0294 | AWS RDS Cluster activity streams are not encrypted by Key Management Service (KMS) using Customer Managed Keys (CMKs) | LOW |
IAC-0295 | AWS all data stored in the Elasticsearch domain is not encrypted using a Customer Managed Key (CMK) | LOW |
IAC-0296 | AWS Elasticsearch uses the default security group | LOW |
IAC-0297 | AWS Execution Role ARN and Task Role ARN are different in ECS Task definitions | LOW |
IAC-0300 | AWS CloudTrail does not define an SNS Topic | LOW |
IAC-0301 | AWS DLM cross-region events are not encrypted | LOW |
IAC-0302 | AWS DLM cross-region events are not encrypted with a Customer Managed Key (CMK) | LOW |
IAC-0303 | AWS DLM-cross region schedules are not encrypted | LOW |
IAC-0304 | AWS DLM cross-region schedules are not encrypted using a Customer Managed Key (CMK) | LOW |
IAC-0305 | AWS Codecommit branch changes has less than 2 approvals | LOW |
IAC-0307 | AWS CloudFront response header policy does not enforce Strict Transport Security | LOW |
IAC-0309 | AWS HTTP and HTTPS target groups do not define health check | LOW |
IAC-0310 | AWS Kendra index Server side encryption does not use Customer Managed Keys (CMKs) | LOW |
IAC-0311 | AWS App Flow flow does not use Customer Managed Keys (CMKs) | LOW |
IAC-0312 | AWS App Flow connector profile does not use Customer Managed Keys (CMKs) | LOW |
IAC-0313 | AWS Keyspace Table does not use Customer Managed Keys (CMKs) | LOW |
IAC-0314 | AWS RDS DB snapshot does not use Customer Managed Keys (CMKs) | LOW |
IAC-0321 | Access is not controlled through Single Sign-On (SSO) | LOW |
IAC-0324 | Data Trace is not enabled in the API Gateway Method Settings | LOW |
IAC-0332 | State machine does not have X-ray tracing enabled | LOW |
IAC-0348 | AWS Lambda Function resource-based policy is overly permissive | LOW |
IAC-0360 | RDS cluster is not configured to copy tags to snapshots | LOW |
IAC-0370 | ElastiCache cluster is using the default subnet group | LOW |
IAC-0372 | RDS Cluster audit logging for MySQL engine is disabled | LOW |
IAC-0378 | AWS Transit Gateway auto accept vpc attachment is enabled | LOW |
IAC-0380 | AWS ECS services have automatic public IP address assignment enabled | LOW |
IAC-0389 | WAF rule does not have any actions | LOW |
IAC-0396 | AWS EMR cluster is not enabled with local disk encryption | LOW |
IAC-0398 | AWS EMR cluster is not enabled with data encryption in transit | LOW |
IAC-0400 | RDS instances have performance insights disabled | LOW |
IAC-0406 | AWS Neptune Cluster not configured with IAM authentication | LOW |
IAC-0407 | AWS DocumentDB clusters have backup retention period less than 7 days | LOW |
IAC-0409 | Clusters of Neptune DB do not replicate tags to snapshots | LOW |
IAC-0421 | AWS CloudFront web distribution with geo restriction disabled | LOW |
IAC-0422 | AWS S3 bucket has global view ACL permissions enabled | LOW |
IAC-0423 | AWS Elastic Load Balancer with listener TLS/SSL is not configured | LOW |
IAC-0424 | Route 53 domains do not have transfer lock protection | LOW |
IAC-0427 | AWS Transfer Server not using latest Security Policy | LOW |
IAC-0428 | AWS CodeGuru Reviewer repository association does not use a Customer Managed Key (CMK) | LOW |
IAC-0429 | AWS Security Group allows unrestricted egress traffic | LOW |
IAC-0430 | AWS Bedrock agent is not associated with Bedrock guardrails | LOW |
IAC-0441 | Not only encrypted EBS volumes are attached to EC2 instances | LOW |
IAC-0442 | GuardDuty is not enabled to specific org/region | LOW |
IAC-0443 | API Gateway stage does not have logging level defined appropriately | LOW |
IAC-0444 | Security Groups are not attached to EC2 instances or ENIs | LOW |
IAC-0445 | S3 Bucket does not have public access blocks | LOW |
IAC-0446 | Amazon EMR clusters' security groups are open to the world | LOW |
IAC-0447 | RDS clusters do not have an AWS Backup backup plan | LOW |
IAC-0448 | EBS does not have an AWS Backup backup plan | LOW |
IAC-0451 | AWS Default Security Group does not restrict all traffic | LOW |
IAC-0453 | Auto scaling groups associated with a load balancer do not use elastic load balancing health checks | LOW |
IAC-0455 | Amazon EFS does not have an AWS Backup backup plan | LOW |
IAC-0456 | Not all EIP addresses allocated to a VPC are attached to EC2 instances | LOW |
IAC-0457 | ALB does not redirect HTTP requests into HTTPS ones | LOW |
IAC-0458 | Not all IAM users are members of at least one IAM group | LOW |
IAC-0462 | AWS Application Load Balancer (ALB) not configured with AWS Web Application Firewall v2 (AWS WAFv2) | LOW |
IAC-0464 | AWS Postgres RDS have Query Logging disabled | LOW |
IAC-0465 | AWS WAF2 does not have a Logging Configuration | LOW |
IAC-0466 | AWS CloudFront distribution does not have a strict security headers policy attached | LOW |
IAC-0467 | AWS AppSync is not protected by WAF | LOW |
IAC-0468 | AWS SSM Parameter is not encrypted | LOW |
IAC-0469 | AWS NAT Gateways are not utilized for the default route | LOW |
IAC-0470 | AWS Terraform sends SSM secrets to untrusted domains over HTTP | LOW |
IAC-0471 | AWS Codecommit is not associated with an approval rule | LOW |
IAC-0473 | Domain Name System (DNS) query logging is not enabled for Amazon Route 53 hosted zones | LOW |
IAC-0476 | AWS CloudFront web distribution with default SSL certificate | LOW |
IAC-0478 | AWS route table with VPC peering overly permissive to all traffic | LOW |
IAC-0480 | AWS Cloudfront Distribution with S3 have Origin Access set to disabled | LOW |
IAC-0483 | AWS Database Migration Service endpoint do not have SSL configured | LOW |
IAC-0485 | AWS API Gateway endpoints without client certificate authentication | LOW |
IAC-0486 | AWS OpenSearch Fine-grained access control is disabled | LOW |
IAC-0487 | AWS API gateway request parameter is not validated | LOW |
IAC-0491 | AWS Secret Manager Automatic Key Rotation is not enabled | LOW |
IAC-0493 | AWS Elasticsearch domain has Dedicated master set to disabled | LOW |
IAC-0496 | S3 buckets do not have event notifications enabled | LOW |
IAC-0499 | AWS S3 bucket access control lists (ACLs) in use | LOW |
IAC-0504 | AWS ACM Certificate with wildcard domain name | LOW |
IAC-0514 | Azure Storage Account without Secure transfer enabled | LOW |
IAC-0532 | Azure Microsoft Defender for Cloud security alert email notification is not set | LOW |
IAC-0554 | Storage Account name does not follow naming rules | LOW |
IAC-0555 | Azure Storage Account using insecure TLS version | LOW |
IAC-0565 | Azure Function App authentication is off | LOW |
IAC-0566 | CORS allows resource to access app services | LOW |
IAC-0567 | Azure Synapse Workspaces do not enable managed virtual networks | LOW |
IAC-0568 | Azure storage account does allow public access | LOW |
IAC-0570 | CORS allows resources to access function apps | LOW |
IAC-0571 | Azure App service HTTP logging is disabled | LOW |
IAC-0572 | Azure file sync enables public network access | LOW |
IAC-0573 | App service disables detailed error messages | LOW |
IAC-0574 | App service does not enable failed request tracing | LOW |
IAC-0576 | PostgreSQL server does not disable public network access | LOW |
IAC-0581 | Azure Automation account variables are not encrypted | LOW |
IAC-0584 | Azure Batch account does not use key vault to encrypt data | LOW |
IAC-0586 | Azure App Services FTP deployment is All allowed | LOW |
IAC-0588 | Azure App Service Web app doesn't use latest .Net framework version | LOW |
IAC-0589 | Azure App Service Web app does not use latest PHP version | LOW |
IAC-0590 | Azure App Service Web app does not use latest Python version | LOW |
IAC-0591 | Azure App Service Web app does not use latest Java version | LOW |
IAC-0596 | App services do not use Azure files | LOW |
IAC-0597 | Azure cache for Redis has public network access enabled | LOW |
IAC-0598 | Not only SSL are enabled for cache for Redis | LOW |
IAC-0599 | Azure Linux and Windows Virtual Machines does not utilize Managed Disks | LOW |
IAC-0600 | Managed disks do not use a specific set of disk encryption sets for customer-managed key encryption | LOW |
IAC-0601 | My SQL server disables geo-redundant backups | LOW |
IAC-0602 | Automatic OS image patching is disabled for Virtual Machine scale sets | LOW |
IAC-0603 | MySQL server disables infrastructure encryption | LOW |
IAC-0604 | Virtual machine scale sets do not have encryption at host enabled | LOW |
IAC-0605 | Azure container container group is not deployed into a virtual network | LOW |
IAC-0606 | Cosmos DB accounts do not have restricted access | LOW |
IAC-0607 | Cosmos DB Accounts do not have CMKs encrypting data at rest | LOW |
IAC-0608 | Azure Cosmos DB enables public network access | LOW |
IAC-0609 | PostgreSQL server enables geo-redundant backups | LOW |
IAC-0610 | Azure Data Factory does not use Git repository for source control | LOW |
IAC-0614 | API management services do not use virtual networks | LOW |
IAC-0618 | Key vault does not enable soft-delete | LOW |
IAC-0619 | Key vault key is not backed by HSM | LOW |
IAC-0620 | SQL Server is enabled for public network access | LOW |
IAC-0621 | Key vault secrets do not have content_type set | LOW |
IAC-0622 | AKS is not enabled for private clusters | LOW |
IAC-0623 | AKS does not use Azure policies add-on | LOW |
IAC-0624 | Azure AKS cluster is not configured with disk encryption set | LOW |
IAC-0626 | Network interfaces use public IPs | LOW |
IAC-0627 | Azure application gateway does not have WAF enabled | LOW |
IAC-0628 | Azure Front Door does not have the Azure Web application firewall (WAF) enabled | LOW |
IAC-0629 | Application gateway does not use WAF in Detection or Prevention modes | LOW |
IAC-0630 | Azure front door does not use WAF in Detection or Prevention modes | LOW |
IAC-0631 | Azure cognitive search does not disable public network access | LOW |
IAC-0632 | Active Directory is not used for authentication for Service Fabric | LOW |
IAC-0633 | Azure Service Fabric cluster not configured with cluster protection level security | LOW |
IAC-0634 | My SQL server does not enable Threat Detection policy | LOW |
IAC-0635 | PostgreSQL server does not enable Threat Detection policy | LOW |
IAC-0636 | MariaDB server does not enable geo-redundant backups | LOW |
IAC-0637 | PostgreSQL server does not enable infrastructure encryption | LOW |
IAC-0640 | Azure Front Door Web application firewall (WAF) policy rule for Remote Command Execution is disabled | LOW |
IAC-0642 | Azure Application Gateway Web application firewall (WAF) policy rule for Remote Command Execution is disabled | LOW |
IAC-0643 | Azure PostgreSQL Flexible Server does not enable geo-redundant backups | LOW |
IAC-0644 | Azure ACR admin account is enabled | LOW |
IAC-0645 | Azure ACR enables anonymous image pulling | LOW |
IAC-0647 | Azure CosmosDB does not have Local Authentication disabled | LOW |
IAC-0648 | Azure Kubernetes Service (AKS) local admin account is enabled | LOW |
IAC-0649 | Azure Machine Learning Compute Cluster Local Authentication is enabled | LOW |
IAC-0650 | Azure AKS cluster nodes have public IP addresses | LOW |
IAC-0651 | Azure Machine Learning Workspace is publicly accessible | LOW |
IAC-0652 | Azure Function App doesn't use latest TLS version | LOW |
IAC-0653 | Server Parameter 'log_retention' is Set to 'OFF' for PostgreSQL Database Server | LOW |
IAC-0654 | Azure PostgreSQL does not use the latest version of TLS encryption | LOW |
IAC-0655 | Azure Redis Cache does not use the latest version of TLS encryption | LOW |
IAC-0656 | Azure SQL on Virtual Machine (Linux) with basic authentication | LOW |
IAC-0657 | Azure Machine Learning Compute Cluster Minimum Nodes is not set to 0 | LOW |
IAC-0658 | Azure Windows VM does not enable encryption | LOW |
IAC-0659 | Azure Client Certificates are not enforced for API management | LOW |
IAC-0660 | Azure web app does not redirect all HTTP traffic to HTTPS in Azure App Service Slot | LOW |
IAC-0661 | Azure App's service slot does not use the latest version of TLS encryption | LOW |
IAC-0662 | Azure App service slot does not have debugging disabled | LOW |
IAC-0663 | Azure SQL Server does not have default auditing policy configured | LOW |
IAC-0664 | Azure Data exfiltration protection for Azure Synapse workspace is disabled | LOW |
IAC-0665 | Azure Databricks workspace is public | LOW |
IAC-0666 | Azure Built-in logging for Azure function app is disabled | LOW |
IAC-0667 | Azure HTTP (port 80) access from the internet is not restricted | LOW |
IAC-0668 | Azure Spring Cloud API Portal is not enabled for HTTPS | LOW |
IAC-0669 | Azure Spring Cloud API Portal Public Access Is Enabled | LOW |
IAC-0674 | Azure Container Registry (ACR) Doesn't Have a Retention Policy Set | LOW |
IAC-0675 | Azure Kubernetes Cluster (AKS) Nodes Don't Limit the Maximum Pods to Greater than 50 | LOW |
IAC-0676 | Azure Kubernetes Cluster (AKS) Nodes Do Not Use Scale Sets | LOW |
IAC-0677 | AKS Doesn't Use the Paid SKU for its SLA | LOW |
IAC-0678 | AKS Cluster Without Upgrade Channel | LOW |
IAC-0682 | Web PubSub Without SLA SKU | LOW |
IAC-0686 | VM Without Azure VM Agent Installed | LOW |
IAC-0687 | Azure Data Explorer without SLA | LOW |
IAC-0689 | VNET With Only One DNS Endpoint | LOW |
IAC-0695 | App Configuration Not Using Standard SKU | LOW |
IAC-0703 | Azure SignalR Service not Using Paid SKU for its SLA | LOW |
IAC-0710 | Azure Service Bus with Local Authentication Enabled | LOW |
IAC-0713 | Azure Storage Accounts Without Proper Replication | LOW |
IAC-0715 | Azure Cognitive Search Without SLA Index Updates | LOW |
IAC-0716 | Azure Cognitive Search Without SLA for Search Index Queries | LOW |
IAC-0718 | Azure App Service Plan is Not Suitable for Production | LOW |
IAC-0719 | Azure App Service Instance Lacks Redundancy | LOW |
IAC-0720 | Azure App Service Health Check Missing | LOW |
IAC-0721 | Azure App Service Not Always On | LOW |
IAC-0725 | Azure Application Gateway is configured with SSL policy having TLS version 1.1 or lower | LOW |
IAC-0740 | Azure Container Registry (ACR) not zone redundant | LOW |
IAC-0742 | Azure Container Instance environment variable with regular value type | LOW |
IAC-0743 | Azure Cognitive Services account configured with local authentication | LOW |
IAC-0744 | Azure Container Registry dedicated data endpoint is disabled | LOW |
IAC-0747 | Azure Synapse Workspace not encrypted with a Customer Managed Key (CMK) | LOW |
IAC-0748 | Azure Synapse SQL pool not encrypted | LOW |
IAC-0751 | Local users used for Azure Storage | LOW |
IAC-0752 | Azure Container Instance is not configured with virtual network | LOW |
IAC-0753 | Azure AKS cluster HTTP application routing enabled | LOW |
IAC-0761 | Azure SQL Server ADS Vulnerability Assessment (VA) Periodic recurring scans is disabled | LOW |
IAC-0762 | Azure SQL Server ADS Vulnerability Assessment (VA) 'Send scan reports to' is not configured | LOW |
IAC-0763 | Azure SQL Server ADS Vulnerability Assessment (VA) 'Also send email notifications to admins and subscription owners' is disabled | LOW |
IAC-0765 | Azure SQL servers which doesn't have Azure Active Directory admin configured | LOW |
IAC-0766 | Azure Storage account container storing activity logs is publicly accessible | LOW |
IAC-0767 | Azure Virtual Machines does not utilise Managed Disks | LOW |
IAC-0768 | Microsoft Antimalware is not configured to automatically update Virtual Machines | LOW |
IAC-0769 | Azure Data Explorer encryption at rest does not use a customer-managed key | LOW |
IAC-0770 | Virtual Machines are not backed up using Azure Backup | LOW |
IAC-0772 | Unattached disks are not encrypted | LOW |
IAC-0773 | Azure data factories are not encrypted with a customer-managed key | LOW |
IAC-0774 | MySQL server does not enable customer-managed key for encryption | LOW |
IAC-0775 | PostgreSQL server does not enable customer-managed key for encryption | LOW |
IAC-0776 | Azure Synapse workspaces have IP firewall rules attached | LOW |
IAC-0777 | Azure storage account logging setting for tables is disabled | LOW |
IAC-0778 | Azure storage account logging setting for blobs is disabled | LOW |
IAC-0779 | Azure Cognitive Services does not Customer Managed Keys (CMKs) for encryption | LOW |
IAC-0782 | Azure SQL database Transparent Data Encryption (TDE) encryption disabled | LOW |
IAC-0788 | Azure Virtual Network subnet is not configured with a Network Security Group | LOW |
IAC-0789 | Azure Key vault Private endpoint connection is not configured | LOW |
IAC-0794 | Azure MariaDB database server not using latest TLS version | LOW |
IAC-0795 | Azure Storage account soft delete is disabled | LOW |
IAC-0796 | Azure Virtual machine configured with public IP and serial console access | LOW |
IAC-0797 | Azure Storage account configured with Shared Key authorization | LOW |
IAC-0798 | Azure Storage account not configured with SAS expiration policy | LOW |
IAC-0812 | Azure Spring Cloud app end-to-end TLS is disabled | LOW |
IAC-0829 | Detecting image usages in circleci pipelines | LOW |
IAC-0872 | GCP Kubernetes Engine Clusters have Network policy disabled | LOW |
IAC-0873 | GCP Kubernetes engine clusters have client certificate disabled | LOW |
IAC-0878 | GKE control plane is public | LOW |
IAC-0879 | GCP Kubernetes Engine Clusters have Master authorized networks disabled | LOW |
IAC-0881 | GCP Kubernetes Engine Clusters not using Container-Optimized OS for Node image | LOW |
IAC-0882 | GCP Kubernetes Engine Clusters have Alias IP disabled | LOW |
IAC-0883 | GCP Kubernetes Engine Clusters have pod security policy disabled | LOW |
IAC-0888 | GCP cloud storage bucket with uniform bucket-level access disabled | LOW |
IAC-0893 | GCP Projects have OS Login disabled | LOW |
IAC-0894 | GCP VM instances have serial port access enabled | LOW |
IAC-0899 | GCP VM instance with the external IP address | LOW |
IAC-0908 | GCP IAM primitive roles are in use | LOW |
IAC-0910 | GCP PostgreSQL instance with log_checkpoints database flag is disabled | LOW |
IAC-0918 | GCP SQL Server instance database flag 'contained database authentication' is enabled | LOW |
IAC-0919 | GCP Cloud SQL database instances have public IPs | LOW |
IAC-0923 | GCP Kubernetes Engine Clusters not configured with private nodes feature | LOW |
IAC-0924 | Kubernetes RBAC users are not managed with Google Groups for GKE | LOW |
IAC-0925 | GCP Kubernetes Engine Clusters have binary authorization disabled | LOW |
IAC-0926 | GCP Kubernetes cluster shielded GKE node with Secure Boot disabled | LOW |
IAC-0927 | The GKE metadata server is disabled | LOW |
IAC-0930 | GCP Kubernetes cluster shielded GKE node with integrity monitoring disabled | LOW |
IAC-0932 | GCP VPC Network subnets have Private Google access disabled | LOW |
IAC-0934 | GCP VPC Network subnets have Private Google access for IPv6 disabled | LOW |
IAC-0935 | GCP Google compute firewall ingress allow FTP port (20) access | LOW |
IAC-0936 | GCP Cloud storage does not have versioning enabled | LOW |
IAC-0937 | GCP SQL database does not use the latest Major version | LOW |
IAC-0938 | GCP Big Query Tables are not encrypted with Customer Supplied Encryption Keys (CSEK) | LOW |
IAC-0939 | GCP Big Query Datasets are not encrypted with Customer Supplied Encryption Keys (CSEK) | LOW |
IAC-0940 | GCP KMS keys are not protected from deletion | LOW |
IAC-0941 | GCP Pub/Sub Topics are not encrypted with Customer Supplied Encryption Keys (CSEK) | LOW |
IAC-0942 | GCP Artifact Registry repositories are not encrypted with Customer Supplied Encryption Keys (CSEK) | LOW |
IAC-0943 | GCP Big Table Instances are not encrypted with Customer Supplied Encryption Keys (CSEKs) | LOW |
IAC-0944 | GCP cloud build workers are not private | LOW |
IAC-0945 | GCP data fusion instances are not private | LOW |
IAC-0946 | GCP Firewall rule allows all traffic on MySQL DB port (3306) | LOW |
IAC-0948 | GCP data flow jobs are not encrypted with Customer Supplied Encryption Keys (CSEK) | LOW |
IAC-0949 | GCP Dataproc Cluster not configured with Customer-Managed Encryption Key (CMEK) | LOW |
IAC-0950 | GCP Vertex AI datasets do not use a Customer Manager Key (CMK) | LOW |
IAC-0951 | GCP Spanner Database is not encrypted with Customer Supplied Encryption Keys (CSEKs) | LOW |
IAC-0954 | GCP Vertex AI Metadata Store does not use a Customer Manager Key (CMK) | LOW |
IAC-0955 | GCP Memorystore for Redis does not use intransit encryption | LOW |
IAC-0962 | GCP DataFusion does not have stack driver logging enabled | LOW |
IAC-0963 | GCP DataFusion does not have stack driver monitoring enabled | LOW |
IAC-0967 | Log levels of the GCP PostgreSQL database are not set to ERROR or lower | LOW |
IAC-0968 | pgAudit is disabled for your GCP PostgreSQL database | LOW |
IAC-0981 | GKE NodePool configuration managed at cluster level | LOW |
IAC-0982 | GCP Cloud Function configured with overly permissive Ingress setting | LOW |
IAC-0986 | GCP Kubernetes Engine Cluster Nodes have default Service account for Project access | LOW |
IAC-0988 | There are not only GCP-managed service account keys for each service account | LOW |
IAC-0989 | GCP Log bucket retention policy is not configured using bucket lock | LOW |
IAC-0992 | A MySQL database instance allows anyone to connect with administrative privileges | LOW |
IAC-0997 | GCP Firewall with Inbound rule overly permissive to All Traffic | LOW |
IAC-1005 | GCP SQL MySQL DB instance point-in-time recovery backup (Binary logs) is not enabled | LOW |
IAC-1032 | GitHub repository defined in Terraform is not Private | LOW |
IAC-1034 | GitHub Repository defined in Terraform doesn't have vulnerability alerts enabled | LOW |
IAC-1037 | GitHub repository defined in Terraform does not have GPG signatures for all commits | LOW |
IAC-1068 | Detecting image usages in gitlab workflows | LOW |
IAC-1072 | Gitlab project defined in Terraform does not require signed commits | LOW |
IAC-1228 | OCI private keys are hard coded in the provider | LOW |
IAC-1229 | OCI Block Storage Block Volume does not have backup enabled | LOW |
IAC-1231 | OCI Compute Instance boot volume has in-transit data encryption is disabled | LOW |
IAC-1234 | OCI Object Storage bucket does not emit object events | LOW |
IAC-1235 | OCI Object Storage Bucket has object Versioning disabled | LOW |
IAC-1255 | OCI Kubernetes Engine Cluster boot volume is not configured with in-transit data encryption | LOW |
IAC-1256 | OCI Kubernetes Engine Cluster pod security policy not enforced | LOW |
IAC-1272 | Operation objects do not have the 'produces' field defined for GET operations | LOW |
IAC-1278 | OpenStack hard coded password, token, or application_credential_secret exists in provider | LOW |
IAC-1280 | OpenStack Security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | LOW |
IAC-1281 | OpenStack instance use basic credentials | LOW |
IAC-1282 | OpenStack firewall rule does not have destination IP configured | LOW |
IAC-1288 | Security rule permits any service on Palo Alto Networks devices | LOW |
IAC-1289 | Security Rule in Palo Alto Networks devices with overly broad Source and Destination IPs | LOW |
IAC-1291 | Log Forwarding Profile not selected for a Palo Alto Networks device security policy rule | LOW |
IAC-1292 | End-of-session logging disabled on Palo Alto Networks security policies | LOW |
IAC-1296 | Security zone on Palo Alto Networks devices does not have an associated Zone Protection Profile | LOW |
IAC-1297 | Include ACL (Access Control List) not defined for a security zone in Palo Alto Networks devices with User-ID enabled | LOW |
IAC-1298 | Logging at session start enabled on Palo Alto Networks devices | LOW |
IAC-1304 | Cloudant Credentials | LOW |
IAC-1305 | Base64 High Entropy Strings | LOW |
IAC-1307 | IBM COS HMAC Credentials | LOW |
IAC-1308 | JSON Web Token | LOW |
IAC-1309 | Mailchimp Access Key | LOW |
IAC-1310 | NPM Token | LOW |
IAC-1313 | SoftLayer Credentials | LOW |
IAC-1314 | Square OAuth Secret | LOW |
IAC-1316 | Twilio Access Key | LOW |
IAC-1317 | Hex High Entropy String | LOW |
IAC-0002 | Alibaba Cloud Security group allow internet traffic to SSH port (22) | INFO |
IAC-0003 | Alibaba Cloud Security group allow internet traffic to RDP port (3389) | INFO |
IAC-0013 | Alibaba Cloud RAM password policy does not have a minimum of 14 characters | INFO |
IAC-0015 | Alibaba Cloud RAM password policy does not have a symbol | INFO |
IAC-0016 | Alibaba Cloud RAM password policy does not expire in 90 days | INFO |
IAC-0017 | Alibaba Cloud RAM password policy does not have a lowercase character | INFO |
IAC-0063 | AWS IAM password policy does not expire in 90 days | INFO |
IAC-0064 | AWS IAM password policy does not have a minimum of 14 characters | INFO |
IAC-0065 | AWS IAM password policy does not have a lowercase character | INFO |
IAC-0068 | AWS IAM password policy does not have a symbol | INFO |
IAC-0069 | AWS IAM password policy does not have an uppercase character | INFO |
IAC-0091 | AWS EKS control plane logging disabled | INFO |
IAC-0125 | AWS SQS queue access policy is overly permissive | INFO |
IAC-0172 | AWS DynamoDB encrypted using AWS owned CMK instead of AWS managed CMK | INFO |
IAC-0184 | AWS ElastiCache Redis cluster is not configured with automatic backup | INFO |
IAC-0189 | AWS RDS cluster delete protection is disabled | INFO |
IAC-0192 | AWS Redshift Cluster not encrypted using Customer Managed Key | INFO |
IAC-0201 | AWS Elastic Load Balancer v2 (ELBv2) with cross-zone load balancing disabled | INFO |
IAC-0286 | AWS GuardDuty detector is not enabled | INFO |
IAC-0299 | AWS CloudTrail logging is disabled | INFO |
IAC-0342 | CloudTrail Event Data Store does not use Customer Managed Keys (CMKs) | INFO |
IAC-0353 | AWS SageMaker notebook instance is not placed in VPC | INFO |
IAC-0354 | AWS SageMaker notebook instance with root access enabled | INFO |
IAC-0361 | AWS CodeBuild project not configured with logging configuration | INFO |
IAC-0369 | AWS ElastiCache Redis cluster automatic version upgrade disabled | INFO |
IAC-0374 | AWS RDS DB cluster is encrypted using default KMS key instead of CMK | INFO |
IAC-0383 | AWS ECS task definition is not configured with read-only access to container root filesystems | INFO |
IAC-0385 | AWS CloudWatch log groups retention set to less than 365 days | INFO |
IAC-0387 | AWS Elastic Beanstalk environment managed platform updates are not enabled | INFO |
IAC-0408 | AWS Neptune DB clusters have backup retention period less than 7 days | INFO |
IAC-0440 | AWS Network ACL is not in use | INFO |
IAC-0449 | AWS CloudTrail trail logs is not integrated with CloudWatch Log | INFO |
IAC-0450 | AWS VPC Flow Logs not enabled | INFO |
IAC-0452 | AWS IAM group not in use | INFO |
IAC-0454 | AWS DynamoDB table Auto Scaling not enabled | INFO |
IAC-0461 | AWS RDS Postgres Cluster does not have query logging enabled | INFO |
IAC-0475 | AWS EC2 Instance IAM Role not enabled | INFO |
IAC-0479 | AWS Config Recording is disabled | INFO |
IAC-0482 | AWS Config must record all possible resources | INFO |
IAC-0484 | AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to disabled | INFO |
IAC-0489 | AWS EMR cluster is not configured with security configuration | INFO |
IAC-0492 | AWS Neptune cluster deletion protection is disabled | INFO |
IAC-0494 | AWS RDS instance with copy tags to snapshots disabled | INFO |
IAC-0497 | AWS Network Firewall is not configured with logging configuration | INFO |
IAC-0506 | AWS SQS queue encryption using default KMS key instead of CMK | INFO |
IAC-0564 | Azure Microsoft Defender for Cloud is set to Off for Servers | INFO |
IAC-0569 | Azure Microsoft Defender for Cloud is set to Off for App Service | INFO |
IAC-0575 | Azure Function App doesn't use HTTP 2.0 | INFO |
IAC-0577 | Azure Microsoft Defender for Cloud is set to Off for Azure SQL Databases | INFO |
IAC-0579 | Azure App Service Web app doesn't have a Managed Service Identity | INFO |
IAC-0582 | Azure Data Explorer cluster disk encryption is disabled | INFO |
IAC-0583 | Azure Data Explorer cluster double encryption is disabled | INFO |
IAC-0587 | Azure Microsoft Defender for Cloud is set to Off for SQL servers on machines | INFO |
IAC-0592 | Azure Microsoft Defender for Cloud is set to Off for Storage | INFO |
IAC-0595 | Azure Microsoft Defender for Cloud is set to Off for Key Vault | INFO |
IAC-0617 | Azure Key Vault Purge protection is not enabled | INFO |
IAC-0625 | Azure Virtual machine NIC has IP forwarding enabled | INFO |
IAC-0749 | Azure Synapse Spark Pool not using isolated compute | INFO |
IAC-0760 | Azure SQL Server ADS Vulnerability Assessment is disabled | INFO |
IAC-0764 | Azure PostgreSQL Database Server 'Allow access to Azure services' enabled | INFO |
IAC-0771 | Azure SQL server Defender setting is set to Off | INFO |
IAC-0784 | Azure SQL server not configured with Active Directory admin authentication | INFO |
IAC-0786 | Azure AKS cluster Azure CNI networking not enabled | INFO |
IAC-0787 | Azure Container Instance not configured with the managed identity | INFO |
IAC-0791 | Azure SQL Server allow access to any Azure internal resources | INFO |
IAC-0792 | Azure Recovery Services vault is not configured with managed identity | INFO |
IAC-0793 | Azure Automation account is not configured with managed identity | INFO |
IAC-0808 | Azure Synapse SQL Pool does not have a security alert policy | INFO |
IAC-0809 | Azure Synapse SQL Pool vulnerability assessment disabled | INFO |
IAC-0810 | Azure Synapse Workspace missing extended audit logs | INFO |
IAC-0811 | Log monitoring disabled for Azure Synapse SQL Pool | INFO |
IAC-0862 | GCP Kubernetes Engine Clusters have Cloud Logging disabled | INFO |
IAC-0863 | GCP Firewall rule allows all traffic on SSH port (22) | INFO |
IAC-0864 | GCP Firewall rule allows all traffic on RDP port (3389) | INFO |
IAC-0867 | GCP Kubernetes Engine Clusters have Legacy Authorization enabled | INFO |
IAC-0868 | GCP Kubernetes Engine Clusters have Cloud Monitoring disabled | INFO |
IAC-0869 | GCP Kubernetes cluster node auto-repair configuration disabled | INFO |
IAC-0870 | GCP Kubernetes cluster node auto-upgrade configuration disabled | INFO |
IAC-0880 | GCP Kubernetes Engine Clusters without any label information | INFO |
IAC-0885 | GCP VPC Flow logs for the subnet is set to Off | INFO |
IAC-0889 | GCP VM instance configured with default service account | INFO |
IAC-0895 | GCP VM instances have IP Forwarding enabled | INFO |
IAC-0896 | GCP VM disks not encrypted with Customer-Supplied Encryption Keys (CSEK) | INFO |
IAC-0898 | GCP VM instance with Shielded VM features disabled | INFO |
IAC-0902 | GCP KMS Symmetric key not rotating in every 90 days | INFO |
IAC-0909 | GCP MySQL instance with local_infile database flag is not disabled | INFO |
IAC-0911 | GCP PostgreSQL instance database flag log_connections is disabled | INFO |
IAC-0912 | GCP PostgreSQL instance database flag log_disconnections is disabled | INFO |
IAC-0913 | GCP PostgreSQL instance database flag log_lock_waits is disabled | INFO |
IAC-0914 | GCP PostgreSQL instance database flag log_min_messages is not set | INFO |
IAC-0915 | GCP PostgreSQL instance database flag log_temp_files is not set to 0 | INFO |
IAC-0916 | GCP PostgreSQL instance database flag log_min_duration_statement is not set to -1 | INFO |
IAC-0917 | GCP SQL Server instance database flag 'cross db ownership chaining' is enabled | INFO |
IAC-0920 | GCP Kubernetes cluster intra-node visibility disabled | INFO |
IAC-0921 | GCP Storage Bucket does not have Access and Storage Logging enabled | INFO |
IAC-0922 | GCP storage bucket is logging to itself | INFO |
IAC-0928 | GCP Kubernetes Engine cluster not using Release Channel for version management | INFO |
IAC-0929 | GCP Kubernetes cluster Shielded GKE Nodes feature disabled | INFO |
IAC-0933 | GCP Firewall rule allows all traffic on FTP port (21) | INFO |
IAC-0964 | GCP Firewall rule allows all traffic on HTTP port (80) | INFO |
IAC-0966 | GCP PostgreSQL instance database flag log_hostname is not set to off | INFO |
IAC-0990 | GCP Project audit logging is not configured properly across all services and all users in a project | INFO |
IAC-0996 | GCP GCR Container Vulnerability Scanning is disabled | INFO |
IAC-0998 | GCP PostgreSQL instance database flag log_duration is not set to on | INFO |
IAC-0999 | GCP PostgreSQL instance database flag log_executor_stats is not set to off | INFO |
IAC-1000 | GCP PostgreSQL instance database flag log_parser_stats is not set to off | INFO |
IAC-1001 | GCP PostgreSQL instance database flag log_planner_stats is not set to off | INFO |
IAC-1002 | GCP PostgreSQL instance database flag log_statement_stats is not set to off | INFO |
IAC-1004 | GCP Kubernetes Engine Clusters have Alpha cluster feature enabled | INFO |
IAC-1230 | OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) | INFO |
IAC-1233 | OCI Compute Instance has monitoring disabled | INFO |
IAC-1236 | OCI Object Storage Bucket is not encrypted with a Customer Managed Key (CMK) | INFO |
IAC-1242 | OCI File Storage File Systems are not encrypted with a Customer Managed Key (CMK) | INFO |
IAC-1243 | OCI VCN has no inbound security list | INFO |
IAC-1246 | OCI Security List allows all traffic on SSH port (22) | INFO |
IAC-1247 | OCI security lists allows unrestricted ingress access to port 3389 | INFO |
IAC-1249 | OCI security group allows unrestricted ingress access to port 22 | INFO |
IAC-1252 | OCI Network Security Group allows all traffic on RDP port (3389) | INFO |
IAC-1253 | OCI Kubernetes Engine Cluster endpoint is not configured with Network Security Groups | INFO |
IAC-1290 | Security policies missing descriptions in Palo Alto Networks devices | INFO |
Total Rules: 1042
Click on any rule ID to view detailed information, examples, and remediation guidance.