CloudFormation
CloudFormation Queries List¶
This page contains all queries from CloudFormation.
AWS¶
Bellow are listed queries related with CloudFormation AWS:
| Query | Severity | Category | Description | Help |
|---|---|---|---|---|
| S3 Bucket Allows List Action From All Principals faa8fddf-c0aa-4b2d-84ff-e993e233ebe9 |
High | Access Control | S3 Buckets must not allow List Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is List, for all Principals. (read more) | Documentation |
| MSK Broker Is Publicly Accessible 0ce1ba20-8ba8-4364-836f-40c24b8cb0ab |
High | Access Control | Public AWS MSK allows anyone to interact with the Apache Kafka broker, therefore increasing the opportunity for malicious activity. To prevent such a scenario, it is recommended for AWS MSK to not be publicly accessible (read more) | Documentation |
| S3 Bucket Allows Get Action From All Principals f97b7d23-568f-4bcc-9ac9-02df0d57fbba |
High | Access Control | S3 Buckets must not allow Get Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Get, for all Principals. (read more) | Documentation |
| S3 Bucket Allows Restore Actions From All Principals 456b00a3-1072-4149-9740-6b8bb60251b0 |
High | Access Control | S3 Buckets must not allow Restore Actions From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Restore, for all Principals. (read more) | Documentation |
| S3 Bucket ACL Allows Read to All Users 219f4c95-aa50-44e0-97de-cf71f4641170 |
High | Access Control | S3 Buckets should not be readable to all users (read more) | Documentation |
| IAM Policy Grants Full Permissions f62aa827-4ade-4dc4-89e4-1433d384a368 |
High | Access Control | IAM policy should not grant full permissions to resources from the get-go, instead of granting permissions gradually as necessary. (read more) | Documentation |
| ECS Service Admin Role Is Present 01986452-bdd8-4aaa-b5df-d6bf61d616ff |
High | Access Control | ECS Services must not have Admin roles, which means the attribute 'role' must not be an admin role (read more) | Documentation |
| S3 Bucket ACL Allows Read to Any Authenticated User 835d5497-a526-4aea-a23f-98a9afd1635f |
High | Access Control | S3 Buckets should not be readable to any authenticated user (read more) | Documentation |
| S3 Bucket Allows Public Policy 860ba89b-b8de-4e72-af54-d6aee4138a69 |
High | Access Control | S3 bucket allows public policy (read more) | Documentation |
| IAM Policies With Full Privileges 953b3cdb-ce13-428a-aa12-318726506661 |
High | Access Control | IAM policies shouldn't allow full administrative privileges (for all resources) (read more) | Documentation |
| S3 Bucket Allows Delete Action From All Principals acc78859-765e-4011-a229-a65ea57db252 |
High | Access Control | S3 Buckets must not allow Delete Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Delete, for all Principals. (read more) | Documentation |
| S3 Bucket Access to Any Principal 7772bb8c-c0f3-42d4-8e4e-f1b8939ad085 |
High | Access Control | The S3 Bucket should not be associated with a policy statement that grants access to any principal (read more) | Documentation |
| S3 Bucket With All Permissions 4ae8af91-5108-42cb-9471-3bdbe596eac9 |
High | Access Control | S3 Buckets should not have all permissions, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is '*', for all Principals. (read more) | Documentation |
| Amazon DMS Replication Instance Is Publicly Accessible 5864fb39-d719-4182-80e2-89dbe627be63 |
High | Access Control | Amazon DMS is publicly accessible, therefore exposing possible sensitive information. To prevent such a scenario, update the attribute 'PubliclyAccessible' to false. (read more) | Documentation |
| SNS Topic is Publicly Accessible ae53ce91-42b5-46bf-a84f-9a13366a4f13 |
High | Access Control | SNS Topic Policy should not allow any principal to access (read more) | Documentation |
| S3 Bucket ACL Allows Read Or Write to All Users 07dda8de-d90d-469e-9b37-1aca53526ced |
High | Access Control | S3 Buckets should not be readable and writable to all users (read more) | Documentation |
| Lambda Functions With Full Privileges a0ae0a4e-712b-4115-8112-51b9eeed9d69 |
High | Access Control | AWS Lambda Functions should not have roles with policies granting full administrative privileges. (read more) | Documentation |
| S3 Bucket Allows Put Action From All Principals f6397a20-4cf1-4540-a997-1d363c25ef58 |
High | Access Control | S3 Buckets must not allow Put Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Put, for all Principals. (read more) | Documentation |
| User Data Shell Script Is Encoded 48c3bc58-6959-4f27-b647-4fedeace23be |
High | Encryption | User Data Shell Script must be encoded (read more) | Documentation |
| ECS Cluster Not Encrypted At Rest 6c131358-c54d-419b-9dd6-1f7dd41d180c |
High | Encryption | Ensure that AWS ECS clusters are encrypted. Data encryption at rest, prevents unauthorized users from accessing sensitive data on your AWS ECS clusters and associated cache storage systems. (read more) | Documentation |
| ELB Without Secure Protocol 80908a75-586b-4c61-ab04-490f4f4525b8 |
High | Encryption | Check if the ELB is setup with SSL or HTTPS for secure communication (read more) | Documentation |
| Redshift Cluster Without KMS CMK de76a0d6-66d5-45c9-9022-f05545b85c78 |
High | Encryption | AWS Redshift Cluster should have KMS CMK defined (read more) | Documentation |
| CloudFormation Specifying Credentials Not Safe 9ecb6b21-18bc-4aa7-bd07-db20f1c746db |
High | Encryption | Specifying credentials in the template itself is probably not safe to do. (read more) | Documentation |
| IAM Database Auth Not Enabled 9fcd0a0a-9b6f-4670-a215-d94e6bf3f184 |
High | Encryption | IAM Database Auth Enabled should be configured to true when using compatible engine and version (read more) | Documentation |
| S3 Bucket SSE Disabled 64ab651b-f5b2-4af0-8c89-ddd03c4d0e61 |
High | Encryption | If algorithm is AES256 then the master key is null, empty or undefined, otherwise the master key is required (read more) | Documentation |
| S3 Bucket Without SSL In Write Actions 38c64e76-c71e-4d92-a337-60174d1de1c9 |
High | Encryption | S3 Buckets should enforce encryption of data transfers using Secure Sockets Layer (SSL) (read more) | Documentation |
| EFS Without KMS 6d087495-2a42-4735-abf7-02ef5660a7e6 |
High | Encryption | Amazon Elastic Filesystem should have filesystem encryption enabled using KMS CMK customer-managed keys instead of AWS managed-keys (read more) | Documentation |
| ELB Using Insecure Protocols 61a94903-3cd3-4780-88ec-fc918819b9c8 |
High | Encryption | ELB Predefined or Custom Security Policies must not use insecure protocols, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the ELB Listeners must not have Policies that posses Protocols that coincide with any of a predefined list of insecure protocols. (read more) | Documentation |
| RDS Storage Not Encrypted 5beacce3-4020-4a3d-9e1d-a36f953df630 |
High | Encryption | RDS Storage should be encrypted, which means the attribute 'StorageEncrypted' should be set to 'true' (read more) | Documentation |
| S3 Bucket Without Server-side-encryption b2e8752c-3497-4255-98d2-e4ae5b46bbf5 |
High | Encryption | S3 Buckets should have server-side encryption at rest enabled to protect sensitive data (read more) | Documentation |
| Kinesis SSE Not Configured 7f65be75-90ab-4036-8c2a-410aef7bb650 |
High | Encryption | AWS Kinesis Stream should have SSE (Server Side Encryption) defined (read more) | Documentation |
| EFS Volume With Disabled Transit Encryption c1282e03-b285-4637-aee7-eefe3a7bb658 |
High | Encryption | Amazon EFS volume does not have encryption for data at transit enabled. To prevent such a scenario, enable the attribute 'TransitEncryption' (read more) | Documentation |
| ElastiCache With Disabled at Rest Encryption e4ee3903-9225-4b6a-bdfb-e62dbadef821 |
High | Encryption | Ensure AWS ElastiCache Redis clusters have encryption for data at rest enabled (read more) | Documentation |
| Secure Ciphers Disabled be96849c-3df6-49c2-bc16-778a7be2519c |
High | Encryption | Check if secure ciphers aren't used in CloudFront (read more) | Documentation |
| API Gateway Cache Encrypted Disabled 37cca703-b74c-48ba-ac81-595b53398e9b |
High | Encryption | 'API::Gateway::Deployment' should have 'CacheDataEncrypted' enabled when 'CachingEnabled' is set to true (read more) | Documentation |
| Connection Between CloudFront Origin Not Encrypted a5366a50-932f-4085-896b-41402714a388 |
High | Encryption | Checks if the connection between the CloudFront and the origin server is encrypted (read more) | Documentation |
| ECS Task Definition Container With Plaintext Password f9b10cdb-eaab-4e39-9793-e12b94a582ad |
High | Encryption | It's not recommended to use plaintext environment variables for sensitive information, such as credential data. (read more) | Documentation |
| User Data Contains Encoded Private Key 568cc372-ca64-420d-9015-ee347d00d288 |
High | Encryption | User Data should not contain a base64 encoded private key. If so, anyone can decode the private key easily (read more) | Documentation |
| DynamoDB With Aws Owned CMK c8dee387-a2e6-4a73-a942-183c975549ac |
High | Encryption | AWS DynamoDb should be encrypted using AWS Managed CMK, instead of AWS-owned CMK. To verify this, SSEEnabled must be verified if false for AWS-owned CMK or true for AWS-Managed CMK. Default value is false. (read more) | Documentation |
| ELB Using Weak Ciphers 809f77f8-d10e-4842-a84f-3be7b6ff1190 |
High | Encryption | ELB Predefined or Custom Security Policies must not use weak ciphers, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the ELB Listeners must not have Policies that posses Ciphers that coincide with any of a predefined list of weak ciphers. (read more) | Documentation |
| SageMaker Data Encryption Disabled 709e6da6-fa1f-44cc-8f17-7f25f96dadbe |
High | Encryption | Amazon SageMaker's Notebook Instance must have its Data Encryption enabled, which means the attribute 'KmsKeyId' must be defined not empty or null. (read more) | Documentation |
| ElastiCache With Disabled Transit Encryption 3b02569b-fc6f-4153-b3a3-ba91022fed68 |
High | Encryption | Ensure AWS ElastiCache Redis clusters have encryption for data at transit enabled (read more) | Documentation |
| MSK Cluster Encryption Disabled a976d63f-af0e-46e8-b714-8c1a9c4bf768 |
High | Encryption | Ensure MSK Cluster encryption in rest and transit is enabled (read more) | Documentation |
| Redshift Not Encrypted 3b316b05-564c-44a7-9c3f-405bb95e211e |
High | Encryption | AWS Redshift Cluster should be encrypted. Check if 'Encrypted' field is false or undefined (default is false) (read more) | Documentation |
| Cloudfront Viewer Protocol Policy Allows HTTP 31733ee2-fef0-4e87-9778-65da22a8ecf1 |
High | Encryption | Checks if the connection between CloudFront and the viewer is encrypted (read more) | Documentation |
| EFS Not Encrypted 2ff8e83c-90e1-4d68-a300-6d652112e622 |
High | Encryption | Elastic File System (EFS) must be encrypted (read more) | Documentation |
| CMK Unencrypted Storage ffee2785-c347-451e-89f3-11aeb08e5c84 |
High | Encryption | Ensure that storage is encrypted. (read more) | Documentation |
| API Gateway Without Security Policy 8275fab0-68ec-4705-bbf4-86975edb170e |
High | Insecure Configurations | API Gateway should have a Security Policy defined and use TLS 1.2. (read more) | Documentation |
| Redshift Publicly Accessible bdf8dcb4-75df-4370-92c4-606e4ae6c4d3 |
High | Insecure Configurations | AWS Redshift Clusters must not be publicly accessible, which means the attribute 'PubliclyAccessible' must be set to false (read more) | Documentation |
| KMS Key With Full Permissions da905474-7454-43c0-b8d2-5756ab951aba |
High | Insecure Configurations | The KMS key has a policy that is too permissive, as it provides the AWS account owner with access to all AWS KMS operations, therefore violating the principle of least privilege. (read more) | Documentation |
| S3 Bucket With Unsecured CORS Rule 3609d27c-3698-483a-9402-13af6ae80583 |
High | Insecure Configurations | If the CORS (Cross-Origin Resource Sharing) rule is defined in an S3 bucket, it should be secure (read more) | Documentation |
| RDS DB Instance Publicly Accessible de38e1d5-54cb-4111-a868-6f7722695007 |
High | Insecure Configurations | RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false. (read more) | Documentation |
| ECS Task Definition Network Mode Not Recommended 027a4b7a-8a59-4938-a04f-ed532512cf45 |
High | Insecure Configurations | Network_Mode should be 'awsvpc' in ecs_task_definition. AWS VPCs provides the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurations (read more) | Documentation |
| Batch Job Definition With Privileged Container Properties 76ddf32c-85b1-4808-8935-7eef8030ab36 |
High | Insecure Configurations | Batch Job Definition should not have Privileged Container Properties (read more) | Documentation |
| S3 Static Website Host Enabled 90501b1b-cded-4cc1-9e8b-206b85cda317 |
High | Insecure Configurations | Checks if any static websites are hosted on buckets. Even static websites can be a liability when poorly configured. (read more) | Documentation |
| S3 Bucket Without Restriction Of Public Bucket 350cd468-0e2c-44ef-9d22-cfb73a62523c |
High | Insecure Configurations | S3 bucket without restriction of public bucket (read more) | Documentation |
| Root Account Has Active Access Keys 4c137350-7307-4803-8c04-17c09a7a9fcf |
High | Insecure Configurations | The AWS Root Account must not have active access keys associated, which means if there are access keys associated to the Root Account, they must be inactive. (read more) | Documentation |
| CloudFront Without Minimum Protocol TLS 1.2 dc17ee4b-ddf2-4e23-96e8-7a36abad1303 |
High | Insecure Configurations | CloudFront Minimum Protocol version should be at least TLS 1.2 (read more) | Documentation |
| Permissive Web ACL Default Action 6d64f311-3da6-45f3-80f1-14db9771ea40 |
High | Insecure Defaults | WebAcl DefaultAction should not be ALLOW (read more) | Documentation |
| Vulnerable Default SSL Certificate b4d9c12b-bfba-4aeb-9cb8-2358546d8041 |
High | Insecure Defaults | CloudFront web distributions should use custom (and not default) SSL certificates. Custom SSL certificates allow only defined users to access content by using an alternate domain name instead of the default one. (read more) | Documentation |
| EC2 Instance Subnet Has Public IP Mapping On Launch b3de4e4c-14be-4159-b99d-9ad194365e4c |
High | Networking and Firewall | EC2 Instance Subnet should not have MapPublicIpOnLaunch set to true (read more) | Documentation |
| Remote Desktop Port Open To Internet c9846969-d066-431f-9b34-8c4abafe422a |
High | Networking and Firewall | The Remote Desktop port is open to the internet in a Security Group (read more) | Documentation |
| Security Group Unrestricted Access To RDP 3ae83918-7ec7-4cb8-80db-b91ef0f94002 |
High | Networking and Firewall | Security Groups does not allow 0.0.0.0/0 for rdp (port:3389) (read more) | Documentation |
| DB Security Group With Public Scope 9564406d-e761-4e61-b8d7-5926e3ab8e79 |
High | Networking and Firewall | The IP address in a DB Security Group should not be '0.0.0.0/0' (IPv4) or '::/0' (IPv6). If so, any IP can access it (read more) | Documentation |
| Route53 Record Undefined 24d932e1-91f0-46ea-836f-fdbd81694151 |
High | Networking and Firewall | Route53 HostedZone must have the Record Set defined. (read more) | Documentation |
| EC2 Public Instance Exposed Through Subnet c44c95fc-ae92-4bb8-bdf8-bb9bc412004a |
High | Networking and Firewall | EC2 instances with public IP addresses shouldn't allow for unrestricted traffic to their subnets (read more) | Documentation |
| Security Groups With Exposed Admin Ports cdbb0467-2957-4a77-9992-7b55b29df7b7 |
High | Networking and Firewall | Security Groups should not have ports open in (20, 21, 22, 23, 115, 137, 138, 139, 2049, 3389) (read more) | Documentation |
| EC2 Network ACL Overlapping Ports 77b6f1e2-bde4-4a6a-ae7e-a40659ff1576 |
High | Networking and Firewall | NetworkACL Entries are reusing or overlapping ports which may create ineffective rules (read more) | Documentation |
| Unrestricted Security Group Ingress 4a1e6b34-1008-4e61-a5f2-1f7c276f8d14 |
High | Networking and Firewall | AWS Security Group Ingress CIDR should not be open to the world (read more) | Documentation |
| Fully Open Ingress e415f8d3-fc2b-4f52-88ab-1129e8c8d3f5 |
High | Networking and Firewall | ECS Service's security group should not allow unrestricted access to all ports from all IPv4 addresses (read more) | Documentation |
| Elasticsearch with HTTPS disabled 4cdc88e6-c0c8-4081-a639-bb3a557cbedf |
High | Networking and Firewall | Amazon Elasticsearch does not have encryption for its domains enabled. To prevent such a scenario, update the attribute 'EnforceHTTPS' to true. (read more) | Documentation |
| Unknown Port Exposed To Internet 829ce3b8-065c-41a3-ad57-e0accfea82d2 |
High | Networking and Firewall | AWS Security Group should not have an unknown port exposed to the entire Internet (read more) | Documentation |
| HTTP Port Open To Internet ddfc4eaa-af23-409f-b96c-bf5c45dc4daa |
High | Networking and Firewall | The HTTP port is open to the internet in a Security Group (read more) | Documentation |
| Default Security Groups With Unrestricted Traffic ea33fcf7-394b-4d11-a228-985c5d08f205 |
High | Networking and Firewall | Check if default security group does not restrict all inbound and outbound traffic. (read more) | Documentation |
| SageMaker Notebook Not Placed In VPC 9c7028d9-04c2-45be-b8b2-1188ccaefb36 |
High | Networking and Firewall | SageMaker Notebook must be placed in a VPC (read more) | Documentation |
| Security Groups Allows Unrestricted Outbound Traffic 66f2d8f9-a911-4ced-ae27-34f09690bb2c |
High | Networking and Firewall | No security group should allow unrestricted egress access (read more) | Documentation |
| Security Groups With Meta IP adcd0082-e90b-4b63-862b-21899f6e6a48 |
High | Networking and Firewall | Security Groups allows 0.0.0.0/0 for all ports and protocols. (read more) | Documentation |
| ELB Sensitive Port Is Exposed To Entire Network 78055456-f670-4d2e-94d5-392d1cf4f5e4 |
High | Networking and Firewall | The load balancer of the application with a sensitive port connection is exposed to the entire internet. (read more) | Documentation |
| RDS Associated with Public Subnet 4e88adee-a8eb-4605-a78d-9fb1096e3091 |
High | Networking and Firewall | RDS should not run in public subnet (read more) | Documentation |
| EKS node group remote access 73d59e76-a12c-4b74-a3d8-d3e1e19c25b3 |
High | Networking and Firewall | Ensure Amazon EKS Node group has implict SSH access (read more) | Documentation |
| ALB Listening on HTTP 275a3217-ca37-40c1-a6cf-bb57d245ab32 |
High | Networking and Firewall | AWS Application Load Balancer (alb) should not listen on HTTP (read more) | Documentation |
| EC2 Sensitive Port Is Publicly Exposed 494b03d3-bf40-4464-8524-7c56ad0700ed |
High | Networking and Firewall | The EC2 instance has a sensitive port connection exposed to the entire network (read more) | Documentation |
| Security Group With Unrestricted Access To SSH 6e856af2-62d7-4ba2-adc1-73b62cef9cc1 |
High | Networking and Firewall | 'SSH' (TCP:22) should not be public in AWS Security Group (read more) | Documentation |
| DB Security Group Open To Large Scope 0104165b-02d5-426f-abc9-91fb48189899 |
High | Networking and Firewall | The IP address in a DB Security Group must not have more than 256 hosts. (read more) | Documentation |
| CloudTrail Logging Disabled 5c0b06d5-b7a4-484c-aeb0-75a836269ff0 |
High | Observability | Checks if logging is enabled for CloudTrail. (read more) | Documentation |
| CMK Rotation Disabled 1c07bfaf-663c-4f6f-b22b-8e2d481e4df5 |
High | Observability | Customer Master Keys (CMK) must have rotation enabled, which means the attribute 'EnableKeyRotation' must be set to 'true' when the key is enabled. (read more) | Documentation |
| S3 Bucket CloudTrail Logging Disabled c3ce69fd-e3df-49c6-be78-1db3f802261c |
High | Observability | Server Access Logging should be enabled on S3 Buckets so that all changes are logged and trackable when the Service used is CloudTrail (read more) | Documentation |
| Elasticsearch Without IAM Authentication 5c666ed9-b586-49ab-9873-c495a833b705 |
Medium | Access Control | AWS Elasticsearch should ensure IAM Authentication (read more) | Documentation |
| SNS Topic Publicity Has Allow and NotAction Simultaneously 818f38ed-8446-4132-9c03-474d49e10195 |
Medium | Access Control | SNS topic Publicity should not have 'Effect: Allow' and argument 'NotAction' at the same time. If it has 'Effect: Allow', the argument stated should be 'Action'. (read more) | Documentation |
| SQS Policy With Public Access 9b6a3f5b-5fd6-40ee-9bc0-ed604911212d |
Medium | Access Control | Checks for dangerous permissions in Action statements in an SQS Queue Policy. This is deemed a potential security risk as it would allow various attacks to the queue (read more) | Documentation |
| Empty Roles For ECS Cluster Task Definitions 7f384a5f-b5a2-4d84-8ca3-ee0a5247becb |
Medium | Access Control | Check if any ECS cluster has not defined proper roles for services' task definitions. (read more) | Documentation |
| IoT Policy Allows Action as Wildcard 4d32780f-43a4-424a-a06d-943c543576a5 |
Medium | Access Control | IoT Policy should not allow Action to be set as * (read more) | Documentation |
| KMS Allows Wildcard Principal f6049677-ec4a-43af-8779-5190b6d03cba |
Medium | Access Control | KMS Should not allow Principal parameter to be set as * (read more) | Documentation |
| EC2 Instance Has No IAM Role f914357d-8386-4d56-9ba6-456e5723f9a6 |
Medium | Access Control | Check if an EC2 instance refers to an IAM profile, which represents an IAM Role. (read more) | Documentation |
| EC2 Network ACL Ineffective Denied Traffic 2623d682-dccb-44cd-99d0-54d9fd62f8f2 |
Medium | Access Control | Ineffective deny rules. A deny rule should be applied to all IP addresses. (read more) | Documentation |
| Public Lambda via API Gateway 57b12981-3816-4c31-b190-a1e614361dd2 |
Medium | Access Control | Allowing to run lambda function using public API Gateway (read more) | Documentation |
| IAM Policy On User e4239438-e639-44aa-adb8-866e400e3ade |
Medium | Access Control | IAM policies should be applied to groups and not to users (read more) | Documentation |
| Lambda Permission Principal Is Wildcard 1d6e16f1-5d8a-4379-bfb3-2dadd38ed5a7 |
Medium | Access Control | Lambda Permission Principal should not contain a wildcard. (read more) | Documentation |
| IAM Policies Attached To User edc95c10-7366-4f30-9b4b-f995c84eceb5 |
Medium | Access Control | IAM policies should be attached only to groups or roles (read more) | Documentation |
| API Gateway Without Configured Authorizer 7fd0d461-5b8c-4815-898c-f2b4b117eb28 |
Medium | Access Control | API Gateway REST API should have an API Gateway Authorizer (read more) | Documentation |
| IoT Policy Allows Wildcard Resource be5b230d-4371-4a28-a441-85dc760e2aa3 |
Medium | Access Control | IoT Policy should not allow Resource to be set as * (read more) | Documentation |
| Neptune Cluster With IAM Database Authentication Disabled a3aa0087-8228-4e7e-b202-dc9036972d02 |
Medium | Access Control | Neptune Cluster should have IAM Database Authentication enabled (read more) | Documentation |
| SQS Queue Policy Allows NotAction 4fbfee74-8186-40d5-a24e-4baa76a855de |
Medium | Access Control | AWS SQS Queue Policy should not allow NotAction since the actions specified in this element are the only actions in that are limited (read more) | Documentation |
| Cross-Account IAM Assume Role Policy Without ExternalId or MFA 85138beb-ce7c-4ca3-a09f-e8fbcc57ddd7 |
Medium | Access Control | Cross-Account IAM Assume Role Policy should require external ID or MFA to protect cross-account access (read more) | Documentation |
| SQS Queue Policy Allows NotPrincipal 4a8fc9a2-2b2f-4b3f-aa8d-401425872034 |
Medium | Access Control | Checks if an SQS Queue policy has an Allow and a NotPrincipal. AWS strongly recommends against using NotPrincipal in the same policy statement as "Effect": "Allow". (read more) |
Documentation |
| S3 Bucket Allows Public ACL 48f100d9-f499-4c6d-b2b8-deafe47ffb26 |
Medium | Access Control | S3 bucket allows public ACL (read more) | Documentation |
| ECR Repository Is Publicly Accessible 75be209d-1948-41f6-a8c8-e22dd0121134 |
Medium | Access Control | Amazon ECR image repositories shouldn't have public access (read more) | Documentation |
| API Gateway Method Does Not Contains An API Key 3641d5b4-d339-4bc2-bfb9-208fe8d3477f |
Medium | Access Control | An API Key should be required on a method request. (read more) | Documentation |
| EBS Volume Not Attached To Instances 1819ac03-542b-4026-976b-f37addd59f3b |
Medium | Availability | EBS Volumes that are unattached to instances may contain sensitive data (read more) | Documentation |
| ElastiCache Nodes Not Created Across Multi AZ cfdef2e5-1fe4-4ef4-bea8-c56e08963150 |
Medium | Availability | ElastiCache Nodes should be created across multi az, which means 'AZMode' should be set to 'cross-az' in multi nodes cluster (read more) | Documentation |
| CMK Is Unusable 2844c749-bd78-4cd1-90e8-b179df827602 |
Medium | Availability | AWS Key Management Service (KMS) must only possess usable Customer Master Keys (CMK), which means the CMKs must have the attribute 'Enabled' set to true and the attribute 'PendingWindowInDays' must be undefined. (read more) | Documentation |
| ECS Service Without Running Tasks 79d745f0-d5f3-46db-9504-bef73e9fd528 |
Medium | Availability | ECS Service should have at least 1 task running (read more) | Documentation |
| Auto Scaling Group With No Associated ELB ad21e616-5026-4b9d-990d-5b007bfe679c |
Medium | Availability | AWS Auto Scaling Groups must have associated ELBs to ensure high availability and improve application performance. This means the attribute 'LoadBalancerNames' must be defined and not empty. (read more) | Documentation |
| RDS With Backup Disabled 8c415f6f-7b90-4a27-a44a-51047e1506f9 |
Medium | Backup | Make sure the AWS RDS configuration has automatic backup configured. If the retention period is equal to 0 there is no backup (read more) | Documentation |
| Stack Retention Disabled fe974ae9-858e-4991-bbd5-e040a834679f |
Medium | Backup | Make sure that retain_stack is enabled to keep the Stack and it's associated resources during resource destruction (read more) | Documentation |
| Low RDS Backup Retention Period e649a218-d099-4550-86a4-1231e1fcb60d |
Medium | Backup | AWS RDS backup retention policy should be at least 7 days (read more) | Documentation |
| RDS Multi-AZ Deployment Disabled 2b1d4935-9acf-48a7-8466-10d18bf51a69 |
Medium | Backup | AWS RDS Instance should have a multi-az deployment (read more) | Documentation |
| IAM Managed Policy Applied to a User 0e5872b4-19a0-4165-8b2f-56d9e14b909f |
Medium | Best Practices | Make sure that any managed IAM policies are implemented in a group and not in a user. (read more) | Documentation |
| IAM Password Without Lowercase Letter f4cf35d6-da92-48de-ab70-57be2b2e6497 |
Medium | Best Practices | IAM Password should have at least one lowercase letter (read more) | Documentation |
| IAM Password Without Number 839f238f-2e3a-4a72-b945-8abdf91af955 |
Medium | Best Practices | IAM user resource Login Profile Password should have at least one number (read more) | Documentation |
| IAM Password Without Minimum Length b1b20ae3-8fa7-4af5-a74d-a2145920fcb1 |
Medium | Best Practices | IAM password should have the required minimum length (read more) | Documentation |
| Cognito UserPool Without MFA 74a18d1a-cf02-4a31-8791-ed0967ad7fdc |
Medium | Best Practices | AWS Cognito UserPool should have MFA (Multi-Factor Authentication) defined to users (read more) | Documentation |
| IAM User Without Password Reset a964d6e3-8e1e-4d93-8120-61fa640dd55a |
Medium | Best Practices | IAM User Login Profile should exist and have PasswordResetRequired property set to true (read more) | Documentation |
| IAM Password Without Symbol d72a7869-e8b9-4e12-bcd2-e8be10b39fa7 |
Medium | Best Practices | IAM password should have the required symbols (read more) | Documentation |
| IAM Password Without Uppercase Letter 445020f6-b69e-4484-847f-02d4b7768902 |
Medium | Best Practices | IAM password should have at least one uppercase letter (read more) | Documentation |
| ECS No Load Balancer Attached fb2b0ecf-1492-491a-a70d-ba1df579175d |
Medium | Best Practices | Amazon ECS service should be configured to use Load Balancing to distribute traffic evenly across the tasks, which means there must exist at least one LoadBalancer. (read more) | Documentation |
| ElasticSearch Not Encrypted At Rest 86a248ab-0e01-4564-a82a-878303e253bb |
Medium | Encryption | Check if ElasticSearch encryption is disabled at Rest (read more) | Documentation |
| RDS Storage Encryption Disabled 65844ba3-03a1-40a8-b3dd-919f122e8c95 |
Medium | Encryption | RDS DBCluster should have storage encrypted set to true (read more) | Documentation |
| DynamoDB Table Not Encrypted 4bd21e68-38c1-4d58-acdc-6a14b203237f |
Medium | Encryption | AWS DynamoDB Tables should have server-side encryption (read more) | Documentation |
| Unscanned ECR Image 9025b2b3-e554-4842-ba87-db7aeec36d35 |
Medium | Encryption | Checks if the ECR Image has been scanned (read more) | Documentation |
| KMS Key Rotation Disabled 235ca980-eb71-48f4-9030-df0c371029eb |
Medium | Encryption | EnableKeyRotation should not be false or undefined (read more) | Documentation |
| EMR Security Configuration Encryption Disabled 5b033ec8-f079-4323-b5c8-99d4620433a9 |
Medium | Encryption | EMR SecurityConfiguration should enable and properly configure encryption at rest and in transit. (read more) | Documentation |
| Default KMS Key Usage e52395b4-250b-4c60-81d5-2e58c1d37abc |
Medium | Encryption | When StorageEncrypted is set to true, KmsKeyId should be defined, to avoid the use of the default KMS Key (read more) |
Documentation |
| SageMaker EndPoint Config Should Specify KmsKeyId Attribute 44034eda-1c3f-486a-831d-e09a7dd94354 |
Medium | Encryption | KmsKeyId attribute should be defined (read more) | Documentation |
| Workspace Without Encryption 89827c57-5a8a-49eb-9731-976a606d70db |
Medium | Encryption | Workspaces should have encryption enabled (read more) | Documentation |
| Memcached Disabled dd0971a6-09c3-4168-8474-a7ef8fbfd99d |
Medium | Encryption | Check if the Memcached is disabled on the ElastiCache (read more) | Documentation |
| IAM Group Inline Policies a58d1a2d-4078-4b80-855b-84cc3f7f4540 |
Medium | Encryption | IAM Groups should not use inline policies and instead use managed policies. If a group is deleted, the inline policy is also deleted (read more) | Documentation |
| AmazonMQ Broker Encryption Disabled 316278b3-87ac-444c-8f8f-a733a28da60f |
Medium | Encryption | AmazonMQ Broker should have Encryption Options defined (read more) | Documentation |
| ElasticSearch Encryption With KMS Disabled d926aa95-0a04-4abc-b20c-acf54afe38a1 |
Medium | Encryption | Check if any ElasticSearch domain isn't encrypted with KMS. (read more) | Documentation |
| SQS With SSE Disabled 12726829-93ed-4d51-9cbe-13423f4299e1 |
Medium | Encryption | Amazon Simple Queue Service (SQS) queue should protect the contents of their messages using Server-Side Encryption (SSE) (read more) | Documentation |
| Config Rule For Encrypted Volumes Disabled 1b6322d9-c755-4f8c-b804-32c19250f2d9 |
Medium | Encryption | Check if AWS config rules do not identify Encrypted Volumes as a source. (read more) | Documentation |
| EBS Volume Encryption Disabled 80b7ac3f-d2b7-4577-9b10-df7913497162 |
Medium | Encryption | EBS volumes should be encrypted (read more) | Documentation |
| API Gateway With Invalid Compression d6653eee-2d4d-4e6a-976f-6794a497999a |
Medium | Encryption | API Gateway should have valid compression, which means attribute 'MinimumCompressionSize' should be set and its value should be greater than -1 and smaller than 10485760. (read more) | Documentation |
| CloudTrail Log Files Not Encrypted With KMS 050a9ba8-d1cb-4c61-a5e8-8805a70d3b85 |
Medium | Encryption | Logs delivered by CloudTrail should be encrypted using KMS to increase security of your CloudTrail (read more) | Documentation |
| Neptune Database Cluster Encryption Disabled bf4473f1-c8a2-4b1b-8134-bd32efabab93 |
Medium | Encryption | Neptune database cluster storage should have encryption enabled (read more) | Documentation |
| CodeBuild Not Encrypted d7467bb6-3ed1-4c82-8095-5e7a818d0aad |
Medium | Encryption | CodeBuild Project should be encrypted, which means 'EncryptionKey' should be defined (read more) | Documentation |
| Alexa Skill Plaintext Client Secret Exposed 3c3b7a58-b018-4d07-9444-d9ee7156e111 |
Medium | Encryption | Alexa skills' client secrets should not be defined as a plaintext string. It should either use 'AWS Systems Manager Parameter Store' or 'AWS Secrets Manager' to retrieve sensitive information (read more) | Documentation |
| IAM User Has Too Many Access Keys 48677914-6fdf-40ec-80c4-2b0e94079f54 |
Medium | Insecure Configurations | Any IAM User should not have more than one access key since it increases the risk of unauthorized access and compromise credentials (read more) | Documentation |
| Inline Policies Are Attached To ECS Service 9e8c89b3-7997-4d15-93e4-7911b9db99fd |
Medium | Insecure Configurations | Check if any ECS service has inline policies attached, which are embedded directly into an entity (user, group,...), instead of the equivalent recommended managed policies. (read more) | Documentation |
| API Gateway Without SSL Certificate ed4c48b8-eccc-4881-95c1-09fdae23db25 |
Medium | Insecure Configurations | SSL Client Certificate should be enabled (read more) | Documentation |
| EMR Cluster Without Security Configuration 48af92a5-c89b-4936-bc62-1086fe2bab23 |
Medium | Insecure Configurations | EMR Cluster should have security configuration defined. (read more) | Documentation |
| Lambda Functions Without Unique IAM Roles ae03f542-1423-402f-9cef-c834e7ee9583 |
Medium | Insecure Configurations | AWS Lambda Functions should not share IAM roles to ensure they will have the minimum privileges needed to perform the required tasks (read more) | Documentation |
| API Gateway With Open Access 1056dfbb-5802-4762-bf2b-8b9b9684b1b0 |
Medium | Insecure Configurations | API Gateway Method should restrict the authorization type, except for the HTTP OPTIONS method. (read more) | Documentation |
| ECR Image Tag Not Immutable 33f41d31-86b1-46a4-81f7-9c9a671f59ac |
Medium | Insecure Configurations | ECR should have an image tag be immutable. This prevents image tags from being overwritten. (read more) | Documentation |
| Lambda Function Without Tags 8df8e857-bd59-44fa-9f4c-d77594b95b46 |
Medium | Insecure Configurations | AWS Lambda Functions must have associated tags. (read more) | Documentation |
| SageMaker Enabling Internet Access 88d55d94-315d-4564-beee-d2d725feab11 |
Medium | Insecure Configurations | SageMaker must have disabled internet access and root access for Creating Notebook Instances. (read more) | Documentation |
| Instance With No VPC 8a6d36cd-0bc6-42b7-92c4-67acc8576861 |
Medium | Insecure Configurations | EC2 Instances should be configured under a VPC network. AWS VPCs provide the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurations. (read more) | Documentation |
| IAM User LoginProfile Password Is In Plaintext 06adef8c-c284-4de7-aad2-af43b07a8ca1 |
Medium | Insecure Configurations | IAM User LoginProfile Password must not be a plaintext string (read more) | Documentation |
| MQ Broker Is Publicly Accessible 68b6a789-82f8-4cfd-85de-e95332fe6a61 |
Medium | Insecure Configurations | Check if any MQ Broker is not publicly accessible (read more) | Documentation |
| GitHub Repository Set To Public 5906092d-5f74-490d-9a03-78febe0f65e1 |
Medium | Insecure Configurations | Repositories must be set to private, which means the attribute 'visibility' must be set to 'private' and/or the attribute 'private' must be set to true (the attribute 'visibility' overrides 'private') (read more) | Documentation |
| S3 Bucket Should Have Bucket Policy 37fa8188-738b-42c8-bf82-6334ea567738 |
Medium | Insecure Defaults | Checks if S3 Bucket has the same name as a Bucket Policy, if it has, S3 Bucket has a Bucket Policy associated (read more) | Documentation |
| RouterTable with Default Routing 4f0908b9-eb66-433f-9145-134274e1e944 |
Medium | Insecure Defaults | NAT gateways are recommended, and not the default route which permits all traffic, in Route Tables. (read more) | Documentation |
| EC2 Permissive Network ACL Protocols 03879981-efa2-47a0-a818-c843e1441b88 |
Medium | Networking and Firewall | To avoid opening all ports for Allow rules, EC2 NetworkACL Entry Protocol should be either 6 (for TCP), 17 (for UDP), 1 (for ICMP), or 58 (for ICMPv6, which must include an IPv6 CIDR block, ICMP type, and code). (read more) | Documentation |
| ELB With Security Group Without Inbound Rules e200a6f3-c589-49ec-9143-7421d4a2c845 |
Medium | Networking and Firewall | An AWS Elastic Load Balancer (ELB) shouldn´t have security groups without outbound rules (read more) | Documentation |
| VPC Without Network Firewall 3e293410-d5b8-411f-85fd-7d26294f20c9 |
Medium | Networking and Firewall | VPC should have a Network Firewall associated (read more) | Documentation |
| Security Group Egress With All Protocols ee464fc2-54a6-4e22-b10a-c6dcd2474d0c |
Medium | Networking and Firewall | AWS Security Group Egress should not specify all protocols to prevent allow traffic on all ports (read more) | Documentation |
| Security Group Ingress With All Protocols 1a427b25-2e9e-4298-9530-0499a55e736b |
Medium | Networking and Firewall | AWS Security Group Ingress should not specify all protocols to prevent allow traffic on all ports (read more) | Documentation |
| ELB With Security Group Without Outbound Rules 01d5a458-a6c4-452a-ac50-054d59275b7c |
Medium | Networking and Firewall | An AWS Elastic Load Balancer (ELB) shouldn´t have security groups without outbound rules (read more) | Documentation |
| API Gateway Endpoint Config is Not Private 4a8daf95-709d-4a36-9132-d3e19878fa34 |
Medium | Networking and Firewall | The API Endpoint type in API Gateway should be set to PRIVATE so it's not exposed to the public internet (read more) | Documentation |
| GameLift Fleet EC2 InboundPermissions With Port Range 43356255-495d-4148-ad8d-f6af5eac09dd |
Medium | Networking and Firewall | AWS GameLift Fleet EC2InboundPermissions should have a single port (read more) | Documentation |
| Security Groups Without VPC Attached 493d9591-6249-47bf-8dc0-5c10161cc558 |
Medium | Networking and Firewall | Security Groups must have a VPC. (read more) | Documentation |
| Security Group Ingress With Port Range 87482183-a8e7-4e42-a566-7a23ec231c16 |
Medium | Networking and Firewall | AWS Security Group Ingress should have a single port (read more) | Documentation |
| API Gateway without WAF fcbf9019-566c-4832-a65c-af00d8137d2b |
Medium | Networking and Firewall | API Gateway should have WAF (Web Application Firewall) enabled (read more) | Documentation |
| Security Group Egress CIDR Open To World 1cc2fbd7-816c-4fbf-ad6d-38a4afa4312a |
Medium | Networking and Firewall | AWS Security Group Egress CIDR should not be open to the world (read more) | Documentation |
| Security Group Egress With Port Range dae9c373-8287-462f-8746-6f93dad93610 |
Medium | Networking and Firewall | AWS Security Group Egress should have a single port (read more) | Documentation |
| TCP/UDP Protocol Network ACL Entry Allows All Ports f57f849c-883b-4cb7-85e7-f7b199dff163 |
Medium | Networking and Firewall | TCP/UDP protocol AWS Network ACL Entry should not allow all ports (read more) | Documentation |
| ALB Is Not Integrated With WAF 105ba098-1e34-48cd-b0f2-a8a43a51bf9b |
Medium | Networking and Firewall | All Application Load Balancers (ALB) must be protected with Web Application Firewall (WAF) service (read more) | Documentation |
| ELBv2 ALB Access Log Disabled c62e8b7d-1fdf-4050-ac4c-76ba9e1d9621 |
Medium | Observability | ELBv2 ALBs should have access log enabled to capture detailed information about requests sent to your load balancer. (read more) | Documentation |
| API Gateway X-Ray Disabled 4ab10c48-bedb-4deb-8f3b-ff12783b61de |
Medium | Observability | API Gateway should have X-Ray Tracing enabled (read more) | Documentation |
| Redshift Cluster Logging Disabled 3de2d4ff-fe53-4fc9-95d3-2f8a69bf90d6 |
Medium | Observability | Make sure Logging is enabled for Redshift Cluster (read more) | Documentation |
| ELB Access Log Disabled ee12ad32-2863-4c0f-b13f-28272d115028 |
Medium | Observability | ELB should have access log enabled (read more) | Documentation |
| CloudWatch Metrics Disabled 5d3c1807-acb3-4bb0-be4e-0440230feeaf |
Medium | Observability | Checks if CloudWatch Metrics is Enabled (read more) | Documentation |
| S3 Bucket Without Versioning a227ec01-f97a-4084-91a4-47b350c1db54 |
Medium | Observability | S3 bucket should have versioning enabled (read more) | Documentation |
| Configuration Aggregator to All Regions Disabled 9f3cf08e-72a2-4eb1-8007-e3b1b0e10d4d |
Medium | Observability | AWS Config Configuration Aggregator All Regions must be set to True (read more) | Documentation |
| ElasticSearch Without Slow Logs 086ea2eb-14a6-4fd4-914b-38e0bc8703e8 |
Medium | Observability | Ensure that AWS Elasticsearch enables support for slow logs (read more) | Documentation |
| S3 Bucket Logging Disabled 4552b71f-0a2a-4bc4-92dd-ed7ec1b4674c |
Medium | Observability | Server Access Logging should be enabled on S3 Buckets so that all changes are logged and trackable (read more) | Documentation |
| API Gateway Stage Access Logging Settings Not Defined 80d45af4-4920-4236-a56e-b7ef419d1941 |
Medium | Observability | API Gateway Stage should have Access Logging Settings defined (read more) | Documentation |
| API Gateway Deployment Without Access Log Setting 06ec63e3-9f72-4fe2-a218-2eb9200b8db5 |
Medium | Observability | API Gateway Deployment should have access log setting defined when connected to an API Gateway Stage. (read more) | Documentation |
| CloudWatch Logging Disabled 0f0fb06b-0f2f-4374-8588-f2c7c348c7a0 |
Medium | Observability | Check if CloudWatch logging is disabled for Route53 hosted zones (read more) | Documentation |
| GuardDuty Detector Disabled a25cd877-375c-4121-a640-730929936fac |
Medium | Observability | Make sure that Amazon GuardDuty is Enabled (read more) | Documentation |
| CloudFront Logging Disabled de77cd9f-0e8b-46cc-b4a4-b6b436838642 |
Medium | Observability | AWS CloudFront distributions should have logging enabled to collect all viewer requests, which means the attribute 'DistributionConfig.Logging' should be defined (read more) | Documentation |
| MQ Broker Logging Disabled e519ed6a-8328-4b69-8eb7-8fa549ac3050 |
Medium | Observability | Check if MQ Brokers don't have logging enabled in any of the two options possible (audit and general). (read more) | Documentation |
| CloudTrail Multi Region Disabled 058ac855-989f-4378-ba4d-52d004020da7 |
Medium | Observability | CloudTrail multi region should be enabled, which means attribute 'IsMultiRegionTrail' should be set to true (read more) | Documentation |
| Stack Notifications Disabled 837e033c-4717-40bd-807e-6abaa30161b7 |
Medium | Observability | AWS CloudFormation should have stack notifications enabled to be notified when an event occurs (read more) | Documentation |
| MSK Cluster Logging Disabled fc7c2c15-f5d0-4b80-adb2-c89019f8f62b |
Medium | Observability | Ensure MSK Cluster Logging is enabled (read more) | Documentation |
| CloudTrail Not Integrated With CloudWatch 65d07da5-9af5-44df-8983-52d2e6f24c44 |
Medium | Observability | CloudTrail should be integrated with CloudWatch (read more) | Documentation |
| CloudTrail SNS Topic Name Undefined 3e09413f-471e-40f3-8626-990c79ae63f3 |
Medium | Observability | Check if SNS topic name is set for CloudTrail (read more) | Documentation |
| Elasticsearch Logs Disabled edbd62d4-8700-41de-b000-b3cfebb5e996 |
Medium | Observability | AWS Elasticsearch should have logs enabled (read more) | Documentation |
| EBS Volume Without KmsKeyId b7063015-6c31-4658-a8e7-14f98f37fd42 |
Medium | Secret Management | EBS Volume should specify a KmsKeyId value (read more) | Documentation |
| DMS Endpoint MongoDB Settings Password Exposed f988a17f-1139-46a3-8928-f27eafd8b024 |
Medium | Secret Management | DMS Endpoint MongoDbSettings Password must not be a plaintext string or a Ref to a Parameter with a Default value. (read more) | Documentation |
| High Access Key Rotation Period 800fa019-49dd-421b-9042-7331fdd83fa2 |
Medium | Secret Management | ConfigRule should enforce access keys to be rotated within 90 days. (read more) | Documentation |
| Secrets Manager Should Specify KmsKeyId c8ae9ba9-c2f7-4e5c-b32e-a4b7712d4d22 |
Medium | Secret Management | Secrets Manager Secret should explicitly specify KmsKeyId, this will allow the secret to be shared cross-account (read more) | Documentation |
| Amplify App Access Token Exposed 73980e43-f399-4fcc-a373-658228f7adf7 |
Medium | Secret Management | Amplify App Access Token must not be in a plain text string or referenced in a parameter as a default value. (read more) | Documentation |
| Directory Service Simple AD Password Exposed 6685d912-d81f-4cfa-95ad-e316ea31c989 |
Medium | Secret Management | DirectoryService SimpleAD password must not be a plaintext string or a Ref to a Parameter with a Default value. (read more) | Documentation |
| Amplify App Basic Auth Config Password Exposed 71493c8b-3014-404c-9802-078b74496fb7 |
Medium | Secret Management | Amplify App BasicAuthConfig Password must not be a plaintext string or a Ref to a Parameter with a Default value. (read more) | Documentation |
| SNS Topic Without KmsMasterKeyId 9d13b150-a2ab-42a1-b6f4-142e41f81e52 |
Medium | Secret Management | KmsMasterKeyId attribute should not be undefined (read more) | Documentation |
| Amplify Branch Basic Auth Config Password Exposed dfb56e5d-ee68-446e-b32a-657b62befe69 |
Medium | Secret Management | Amplify Branch BasicAuthConfig Password must not be a plaintext string or a Ref to a Parameter with a Default value. (read more) | Documentation |
| Amplify App OAuth Token Exposed 03b38885-8f4e-480c-a0e4-12c1affd15db |
Medium | Secret Management | Amplify App OAuth Token must not be a plaintext string or a Ref to a Parameter with a Default value. (read more) | Documentation |
| DMS Endpoint Password Exposed 5f700072-b7ce-4e84-b3f3-497bf1c24a4d |
Medium | Secret Management | DMS Endpoint password must not be a plaintext string or a Ref to a Parameter with a Default value. (read more) | Documentation |
| Hardcoded AWS Access Key In Lambda 2564172f-c92b-4261-9acd-464aed511696 |
Medium | Secret Management | Lambda access/secret keys should not be hardcoded (read more) | Documentation |
| DocDB Cluster Master Password In Plaintext 39423ce4-9011-46cd-b6b1-009edcd9385d |
Medium | Secret Management | DocDB DB Cluster master user password must not be in a plain text string or referenced in a parameter as a default value. (read more) | Documentation |
| Directory Service Microsoft AD Password Set to Plaintext or Default Ref 06b9f52a-8cd5-459b-bdc6-21a22521e1be |
Medium | Secret Management | Directory Service Microsoft AD password must not be a plaintext string or a Ref to a Parameter with a Default value. (read more) | Documentation |
| RefreshToken Is Exposed 5b48c507-0d1f-41b0-a630-76817c6b4189 |
Medium | Secret Management | Alexa ASK Skill AuthenticationConfiguration RefreshToken should not be a plaintext string (read more) | Documentation |
| IAM Group Without Users 8f957abd-9703-413d-87d3-c578950a753c |
Low | Access Control | IAM Group should have at least one user associated (read more) | Documentation |
| IAM User With No Group 06933df4-0ea7-461c-b9b5-104d27390e0e |
Low | Access Control | A IAM user should belong to a group (read more) | Documentation |
| IAM Role Allows All Principals To Assume f80e3aa7-7b34-4185-954e-440a6894dde6 |
Low | Access Control | IAM role allows all services or principals to assume it (read more) | Documentation |
| EC2 Instance Using Default Security Group 08b81bb3-0985-4023-8602-b606ad81d279 |
Low | Access Control | EC2 instances should not use default security group(s) (read more) | Documentation |
| IAM Policy Grants 'AssumeRole' Permission Across All Services e835bd0d-65da-49f7-b6d1-b646da8727e6 |
Low | Access Control | IAM Policy should not grant 'AssumeRole' permission across all services. (read more) | Documentation |
| Support Has No Role Associated d71b5fd7-9020-4b2d-9ec8-b3839faa2744 |
Low | Access Control | Check if any AWS Support policy does not have any role and users and group associated, which means that is not being managed. (read more) | Documentation |
| VPC Attached With Too Many Gateways 97e94d17-e2c7-4109-a53b-6536ac1bb64e |
Low | Availability | The number of gateways attached should not approach or go beyond the limit of 3, in a particular VPC (read more) | Documentation |
| RDS DB Instance With Deletion Protection Disabled 2c161e58-cb52-454f-abea-6470c37b5e6e |
Low | Backup | RDS DBInstance should have deletion protection set to true (read more) | Documentation |
| CDN Configuration Is Missing e4f54ff4-d352-40e8-a096-5141073c37a2 |
Low | Best Practices | Content Delivery Network (CDN) service is used within an AWS account to secure and accelerate the delivery of websites. The use of a CDN can provide a layer of security between your origin content and the destination. (read more) | Documentation |
| Security Group Ingress Has CIDR Not Recommended a3e4e39a-e5fc-4ee9-8cf5-700febfa86dd |
Low | Best Practices | AWS Security Group Ingress CIDR should not be /32 in case of IPV4 or /128 in case of IPV6 (read more) | Documentation |
| Automatic Minor Upgrades Disabled f0104061-8bfc-4b45-8a7d-630eb502f281 |
Low | Best Practices | RDS instance should have automatic minor upgrades enabled, which means the attribute 'AutoMinorVersionUpgrade' must be set to true. (read more) | Documentation |
| Lambda Permission Misconfigured 9b83114b-b2a1-4534-990d-06da015e47aa |
Low | Best Practices | Lambda permission may be misconfigured if the action field is not filled in by 'lambda:InvokeFunction' (read more) | Documentation |
| IAM Access Analyzer Not Enabled 8d29754a-2a18-460d-a1ba-9509f8d359da |
Low | Best Practices | IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions (read more) | Documentation |
| Geo Restriction Disabled 7f8843f0-9ea5-42b4-a02b-753055113195 |
Low | Best Practices | Geo Restriction feature should be enabled, to restrict or allow users in specific locations accessing web application content (read more) | Documentation |
| IAM Policies Without Groups 5e7acff5-095b-40ac-9073-ac2e4ad8a512 |
Low | Best Practices | IAM policy should not apply directly to users, should be with a group (read more) | Documentation |
| EFS Without Tags 08e39832-5e42-4304-98a0-aa5b43393162 |
Low | Build Process | Amazon Elastic Filesystem should have filesystem tags associated (read more) | Documentation |
| DynamoDB With Not Recommented Table Billing Mode c333e906-8d8b-4275-b999-78b6318f8dc6 |
Low | Build Process | Checks if DynamoDB Table Billing Mode is set to either PAY_PER_REQUEST or PROVISIONED (read more) | Documentation |
| S3 Bucket Without Ignore Public ACL 6c8d51af-218d-4bfb-94a9-94eabaa0703a |
Low | Insecure Configurations | S3 bucket without ignore public ACL (read more) | Documentation |
| API Gateway Cache Cluster Disabled 52790cad-d60d-41d5-8483-146f9f21208d |
Low | Insecure Configurations | AWS API Gateway should have cache clustering enabled (read more) | Documentation |
| Lambda Function Without Dead Letter Queue c2eae442-d3ba-4cb1-84ca-1db4f80eae3d |
Low | Insecure Configurations | AWS Lambda Function should be configured for a Dead Letter Queue(DLQ) (read more) | Documentation |
| Wildcard In ACM Certificate Domain Name cc8b294f-006f-4f8f-b5bb-0a9140c33131 |
Low | Insecure Configurations | ACM Certificate should not use wildcards (*) in the domain name (read more) | Documentation |
| Shield Advanced Not In Use ad7444cf-817a-4765-a79e-2145f7981faf |
Low | Networking and Firewall | AWS Shield Advanced should be used for Amazon Route 53 hosted zone, AWS Global Accelerator accelerator, Elastic IP Address, Elastic Load Balancing, and Amazon CloudFront Distribution to protect these resources against robust DDoS attacks (read more) | Documentation |
| EMR Without VPC bf89373a-be40-4c04-99f5-746742dfd7f3 |
Low | Networking and Firewall | Elastic MapReduce Cluster (EMR) should be launched in a Virtual Private Cloud (VPC) (read more) | Documentation |
| EC2 Instance Using Default VPC e42a3ef0-5325-4667-84bf-075ba1c9d58e |
Low | Networking and Firewall | EC2 Instances should not be configured under a default VPC network (read more) | Documentation |
| EC2 Network ACL Duplicate Rule 045ddb54-cfc5-4abb-9e05-e427b2bc96fe |
Low | Networking and Firewall | A Network ACL's rule numbers cannot be repeated unless one is egress and the other is ingress (read more) | Documentation |
| Redshift Using Default Port a478af30-8c3a-404d-aa64-0b673cee509a |
Low | Networking and Firewall | Redshift should not use the default port (5439) because an attacker can easily guess the port (read more) | Documentation |
| RDS Using Default Port 1fe9d958-ddce-4228-a124-05265a959a8b |
Low | Networking and Firewall | RDS should not use the default port (an attacker can easily guess the port). For engines related to Aurora, MariaDB or MySQL, the default port is 3306. PostgreSQL default port is 5432, Oracle default port is 1521 and SQL Server default port is 1433 (read more) | Documentation |
| ElastiCache Using Default Port 323db967-c68e-44e6-916c-a777f95af34b |
Low | Networking and Firewall | ElastiCache should not use the default port (an attacker can easily guess the port). For engine set to Redis, the default port is 6379. The Memcached default port is 11211 (read more) | Documentation |
| CloudFront Without WAF 0f139403-303f-467c-96bd-e717e6cfd62d |
Low | Networking and Firewall | All AWS CloudFront distributions should be integrated with the Web Application Firewall (AWS WAF) service (read more) | Documentation |
| ElastiCache Without VPC ba766c53-fe71-4bbb-be35-b6803f2ef13e |
Low | Networking and Firewall | ElastiCache should be launched in a Virtual Private Cloud (VPC) (read more) | Documentation |
| CloudTrail Log File Validation Disabled 2a3560fe-52ca-4443-b34f-bf0ed5eb74c8 |
Low | Observability | CloudTrail log file validation should be enabled to determine whether a log file has not been tampered (read more) | Documentation |
| VPC FlowLogs Disabled f6d299d2-21eb-41cc-b1e1-fe12d857500b |
Low | Observability | Every VPC resource should have an associated Flow Log (read more) | Documentation |
| ECS Task Definition HealthCheck Missing d24389b4-b209-4ff0-8345-dc7a4569dcdd |
Low | Observability | Amazon ECS must have the HealthCheck property defined to give more control over monitoring the health of tasks (read more) | Documentation |
| Lambda Functions Without X-Ray Tracing 9488c451-074e-4cd3-aee3-7db6104f542c |
Low | Observability | AWS Lambda functions should have TracingConfig enabled. For this, property 'tracingConfig.mode' should have the value 'Active' (read more) | Documentation |
| DocDB Logging Is Disabled 1bf3b3d4-f373-4d7c-afbb-7d85948a67a5 |
Low | Observability | DocDB logging should be enabled (read more) | Documentation |
| API Gateway Deployment Without API Gateway UsagePlan Associated 783860a3-6dca-4c8b-81d0-7b62769ccbca |
Low | Observability | API Gateway Deployment should have API Gateway UsagePlan defined and associated. (read more) | Documentation |
| SDB Domain Declared As A Resource 6ea57c8b-f9c0-4ec7-bae3-bd75a9dee27d |
Low | Resource Management | SimpleDB Domain resource should not be declared (read more) | Documentation |
| ECS Task Definition Invalid CPU or Memory f4c9b5f5-68b8-491f-9e48-4f96644a1d51 |
Low | Resource Management | In ECS Task Definition of FARGATE launch type if you specify an invalid CPU or Memory value, you will receive an error (read more) | Documentation |
| API Gateway Stage Without API Gateway UsagePlan Associated 7f8f1b60-43df-4c28-aa21-fb836dbd8071 |
Low | Resource Management | API Gateway Stage should have API Gateway UsagePlan defined and associated. (read more) | Documentation |
| VPC Without Attached Subnet 3b3b4411-ad1f-40e7-b257-a78a6bb9673a |
Low | Resource Management | VPCs without attached subnets may indicate that they are not being used (read more) | Documentation |
| EC2 Not EBS Optimized 8dd0ff1f-0da4-48df-9bb3-7f338ae36a40 |
Info | Best Practices | It's considered a best practice for an EC2 instance to use an EBS optimized instance. This provides the best performance for your EBS volumes by minimizing contention between Amazon EBS I/O and other traffic from your instance (read more) | Documentation |
| Security Group Rule Without Description 5e6c9c68-8a82-408e-8749-ddad78cbb9c5 |
Info | Best Practices | It's considered a best practice for AWS Security Group to have a description (read more) | Documentation |
| EC2 Instance Monitoring Disabled 0264093f-6791-4475-af34-4b8102dcbcd0 |
Info | Observability | EC2 Instance should have detailed monitoring enabled. With detailed monitoring enabled data is available in 1-minute periods (read more) | Documentation |
AWS_BOM¶
Bellow are listed queries related with CloudFormation AWS_BOM:
| Query | Severity | Category | Description | Help |
|---|---|---|---|---|
| BOM - AWS MSK 2730c169-51d7-4ae7-99b5-584379eff1bb |
Trace | Bill Of Materials | A list of MSK resources specified. Amazon Managed Streaming for Apache Kafka (Amazon MSK) is a fully managed service that enables you to build and run applications that use Apache Kafka to process streaming data. (read more) | Documentation |
| BOM - AWS RDS 6ef03ff6-a2bd-483c-851f-631f248bc0ea |
Trace | Bill Of Materials | A list of RDS resources found. Amazon Relational Database Service (Amazon RDS) is a collection of managed services that makes it simple to set up, operate, and scale databases in the cloud. (read more) | Documentation |
| BOM - AWS EBS 0b0556ea-9cd9-476f-862e-20679dda752b |
Trace | Bill Of Materials | A list of EBS resources found. Amazon Elastic Block Store (Amazon EBS) is an easy-to-use, scalable, high-performance block-storage service designed for Amazon Elastic Compute Cloud (Amazon EC2). (read more) | Documentation |
| BOM - AWS S3 Buckets b5d6a2e0-8f15-4664-bd5b-68ec5c9bab83 |
Trace | Bill Of Materials | A list of S3 resources found. Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. (read more) | Documentation |
| BOM - AWS Elasticache c689f51b-9203-43b3-9d8b-caed123f706c |
Trace | Bill Of Materials | A list of Elasticache resources found. Amazon ElastiCache is a fully managed, in-memory caching service supporting flexible, real-time use cases. You can use ElastiCache for caching, which accelerates application and database performance, or as a primary data store for use cases that don't require durability like session stores, gaming leaderboards, streaming, and analytics. ElastiCache is compatible with Redis and Memcached. (read more) | Documentation |
| BOM - AWS DynamoDB 4e67c0ae-38a0-47f4-a50c-f0c9b75826df |
Trace | Bill Of Materials | A list of DynamoDB resources found. Amazon DynamoDB is a fully managed, serverless, key-value NoSQL database designed to run high-performance applications at any scale. (read more) | Documentation |
| BOM - AWS MQ 209189f3-c879-48a7-9703-fbcfa96d0cef |
Trace | Bill Of Materials | A list of MQ resources found. Amazon MQ is a managed message broker service for Apache ActiveMQ and RabbitMQ that makes it easy to set up and operate message brokers on AWS. (read more) | Documentation |
| BOM - AWS Cassandra 124b173b-e06d-48a6-8acd-f889443d97a4 |
Trace | Bill Of Materials | A list of Cassandra resources found. Amazon Cassandra is an open-source NoSQL database designed to store data for applications that require fast read and write performance (read more) | Documentation |
| BOM - AWS SNS 42e7dca3-8cce-4325-8df0-108888259136 |
Trace | Bill Of Materials | A list of SNS resources specified. Amazon Simple Notification Service (Amazon SNS) is a fully managed messaging service for both application-to-application (A2A) and application-to-person (A2P) communication. (read more) | Documentation |
| BOM - AWS EFS ef05a925-8568-4054-8ff1-f5ba82631c16 |
Trace | Bill Of Materials | A list of EFS resources found. Amazon Elastic File System (Amazon EFS) automatically grows and shrinks as you add and remove files with no need for management or provisioning. (read more) | Documentation |
| BOM - AWS SQS 59a849c2-1127-4023-85a5-ef906dcd458c |
Trace | Bill Of Materials | A list of SQS resources specified. Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. (read more) | Documentation |
| BOM - AWS Kinesis d53323be-dde6-4457-9a43-42df737e71d2 |
Trace | Bill Of Materials | A list of Kinesis resources found. Amazon Kinesis is a real-time streaming service that provides collection, processing, and analysis of video and data streams in real-time (read more) | Documentation |
AWS_SAM¶
Bellow are listed queries related with CloudFormation AWS_SAM:
| Query | Severity | Category | Description | Help |
|---|---|---|---|---|
| Serverless Function Environment Variables Not Encrypted a7f8ac28-eed1-483d-87c8-4c325f022572 |
High | Encryption | AWS Serverless Function should encrypt environment variables (read more) | Documentation |
| Serverless API Without Content Encoding a2f2800e-614b-4bc8-89e6-fec8afd24800 |
Medium | Encryption | AWS Serverless API should enable Content Encoding through the attribute 'MinimumCompressionSize'. This value should be greater than -1 and smaller than 10485760 (read more) | Documentation |
| Serverless Function Without Tags a71ecabe-03b6-456a-b3bc-d1a39aa20c98 |
Medium | Insecure Configurations | AWS Serverless Function should have associated tags (read more) | Documentation |
| Serverless Function Without Unique IAM Role 4ba74f01-aba5-4be2-83bc-be79ff1a3b92 |
Medium | Insecure Configurations | AWS Serverless Function should not share IAM Role to ensure it will have the minimum privileges needed to perform the required tasks (read more) | Documentation |
| Serverless API Endpoint Config Not Private 6b5b0313-771b-4319-ad7a-122ee78700ef |
Medium | Networking and Firewall | AWS Serverless API should set API Endpoint Config type to 'PRIVATE'. This way, it's not exposed to the public internet (read more) | Documentation |
| Serverless API X-Ray Tracing Disabled c757c6a3-ac87-4b9d-b28d-e5a5add6a315 |
Medium | Observability | AWS Serverless API should have X-Ray Tracing enabled (read more) | Documentation |
| Serverless API Access Logging Setting Undefined 0a994e04-c6dc-471d-817e-d37451d18a3b |
Medium | Observability | AWS Serverless API/AWS Serverless HTTP API should have Access Logging Setting(s) defined (read more) | Documentation |
| Serverless API Cache Cluster Disabled 60a05ede-0a68-4d0d-a58f-f538cf55ff79 |
Low | Insecure Configurations | AWS Serverless API should have cache clustering enabled (read more) | Documentation |
| Serverless Function Without Dead Letter Queue cb2f612b-ed42-4ff5-9fb9-255c73d39a18 |
Low | Insecure Configurations | AWS Serverless Function should be configured for a Dead Letter Queue(DLQ) (read more) | Documentation |
| Serverless Function Without X-Ray Tracing dc1ab429-1481-4540-9b1d-280e3f15f1f8 |
Low | Observability | AWS Serverless Function should have Tracing enabled. For this, property 'Tracing' should have the value 'Active' (read more) | Documentation |