Repository: tenable/terrascan (language: python)

Issue:
Fail to validate when there are multiple properties with the same name in a resource
I've notices that terraform-validate doesn't properly handle the use case of multiple properties with the same name:

```hcl
resource "aws_elb" "foo" {
  listener {
    lb_port            = 443
    lb_protocol        = "https"
    ssl_certificate_id = "${var.certificate_arn}"
  }
  listener {
    lb_port            = 443
    lb_protocol        = "https"
    ssl_certificate_id = "${var.certificate_arn}"
  }
}
```

I've seen this issue in: 
 - aws_cloudfront_distribution
 - aws_elb
 - aws_redshift_parameter_group


Discussion / hints:
This is no longer an issue as of Terrascan v1.0.0

Fix patch:
diff --git a/pkg/iac-providers/cft/v1/load-file.go b/pkg/iac-providers/cft/v1/load-file.go
index 58e9f2cc9..4f92cc16f 100644
--- a/pkg/iac-providers/cft/v1/load-file.go
+++ b/pkg/iac-providers/cft/v1/load-file.go
@@ -132,7 +132,7 @@ func (a *CFTV1) extractTemplate(file string, data *[]byte) (*cloudformation.Temp
 	}
 
 	zap.S().Debug("sanitizing cft template file", zap.String("file", file))
-	sanitized, err := a.sanitizeCftTemplate(*data, isYaml)
+	sanitized, err := a.sanitizeCftTemplate(file, *data, isYaml)
 	if err != nil {
 		zap.S().Debug("failed to sanitize cft template file", zap.String("file", file), zap.Error(err))
 		return nil, err
@@ -219,7 +219,7 @@ func (*CFTV1) getFileType(file string, data *[]byte) string {
 		if isJSON(string(*data)) {
 			return JSONExtension
 		}
-		return YAMLExtension
+		return TXTExtension
 	}
 	return UnknownExtension
 }
diff --git a/pkg/iac-providers/cft/v1/sanitize-cft-template.go b/pkg/iac-providers/cft/v1/sanitize-cft-template.go
index 34e9199ae..e2ec5d921 100644
--- a/pkg/iac-providers/cft/v1/sanitize-cft-template.go
+++ b/pkg/iac-providers/cft/v1/sanitize-cft-template.go
@@ -36,31 +36,58 @@ const PARAMETERS = "Parameters"
 // RESOURCES is a constant to fetch Resources from CFT
 const RESOURCES = "Resources"
 
-func (a *CFTV1) sanitizeCftTemplate(data []byte, isYAML bool) (map[string]interface{}, error) {
+func (a *CFTV1) sanitizeCftTemplate(fileName string, data []byte, isYAML bool) (map[string]interface{}, error) {
 	var (
 		intrinsified []byte
 		err          error
 	)
-
 	if isYAML {
-		data, err = removeRefAnchors(data)
-		if err != nil {
-			return nil, err
-		}
+		fallbackToDefaultProcessing := false
 
-		// Process all AWS CloudFormation intrinsic functions (e.g. Fn::Join)
-		intrinsified, err = intrinsics.ProcessYAML(data, nil)
-		if err != nil {
-			return nil, fmt.Errorf("error while resolving intrinsic functions, error %w", err)
+		for i := 0; i < 1; i++ {
+			// convert the yaml into json
+			jsonData, err := a.ReadYAMLFileIntoJSON(fileName)
+			if err == nil {
+				jsonData, err := a.resolveResourceIDs(jsonData)
+				if err != nil {
+					zap.S().Debug(fmt.Sprintf("error while resolving Resource IDs, error %s", err.Error()))
+					fallbackToDefaultProcessing = true
+					break
+				}
+				intrinsified, err = intrinsics.ProcessJSON(jsonData, nil)
+				if err != nil {
+					zap.S().Debug(fmt.Sprintf("error while resolving Resource IDs, error %s", err.Error()))
+					fallbackToDefaultProcessing = true
+					break
+				}
+			}
+		}
+		if fallbackToDefaultProcessing || len(intrinsified) == 0 { // fallback to default behaviour of yaml processing
+			data, err = removeRefAnchors(data)
+			if err != nil {
+				return nil, err
+			}
+			// Process all AWS CloudFormation intrinsic functions (e.g. Fn::Join)
+			intrinsified, err = intrinsics.ProcessYAML(data, nil)
+			if err != nil {
+				return nil, fmt.Errorf("error while resolving intrinsic functions, error %w", err)
+			}
 		}
 	} else {
-		// Process all AWS CloudFormation intrinsic functions (e.g. Fn::Join)
-		intrinsified, err = intrinsics.ProcessJSON(data, nil)
-		if err != nil {
-			return nil, fmt.Errorf("error while resolving intrinsic functions, error %w", err)
+		jsonData, err := a.resolveResourceIDs(data)
+		if err == nil {
+			intrinsified, err = intrinsics.ProcessJSON(jsonData, nil)
+			if err != nil {
+				return nil, fmt.Errorf("error while resolving intrinsic functions, error %w", err)
+			}
+		} else {
+			// Process all AWS CloudFormation intrinsic functions (e.g. Fn::Join)
+			intrinsified, err = intrinsics.ProcessJSON(data, nil)
+			if err != nil {
+				return nil, fmt.Errorf("error while resolving intrinsic functions, error %w", err)
+			}
 		}
 	}
-
 	templateFileMap := make(map[string]interface{})
 
 	err = json.Unmarshal(intrinsified, &templateFileMap)
@@ -510,3 +537,117 @@ func findKeyAndReplace(obj interface{}, propValues map[string]interface{}) (inte
 	}
 	return nil, false
 }
+
+// ReadYAMLFileIntoJSON converts the given file into JSON string
+func (a *CFTV1) ReadYAMLFileIntoJSON(fileName string) ([]byte, error) {
+	templateSample, err := a.File(fileName)
+	if err != nil {
+		return nil, err
+	}
+	gostruct, err := templateSample.Map()
+	if err != nil {
+		zap.S().Errorf("failed to map yaml to json. error : %s in file %s", err.Error(), fileName)
+		return nil, err
+	}
+	jsonData, err := json.Marshal(gostruct)
+	if err != nil {
+		zap.S().Errorf("failed to convert yaml to json. error : %s", err.Error())
+		return nil, err
+	}
+	return jsonData, nil
+}
+func (a *CFTV1) getMapOfResourceIds(allData interface{}) map[string]string {
+	mapOfresourceIds := make(map[string]string)
+	mapOfParameters := make(map[string]interface{})
+	if templateFileMap, ok := allData.(map[string]interface{}); ok {
+		r, ok := templateFileMap[PARAMETERS]
+		if ok {
+			rMap, ok := r.(map[string]interface{})
+			if ok {
+				for rName, val := range rMap {
+					zap.S().Debug("inspecting resource", zap.String("Parameters Name", rName))
+					if val1, ok := val.(map[string]interface{}); ok {
+						mapOfParameters[rName] = val1["Default"]
+					}
+				}
+			}
+		}
+	}
+
+	if templateFileMap, ok := allData.(map[string]interface{}); ok {
+		r, ok := templateFileMap[RESOURCES]
+		if ok {
+			rMap, ok := r.(map[string]interface{})
+			if ok {
+				for rName := range rMap {
+					zap.S().Debug("inspecting resource", zap.String("Resource Name", rName))
+					if _, ok := mapOfParameters[rName]; !ok {
+						mapOfresourceIds[rName] = rName
+					}
+				}
+			}
+		}
+	}
+	return mapOfresourceIds
+}
+
+// resolveResourceIDs resolves the indirect resource to resource references
+func (a *CFTV1) resolveResourceIDs(jsonData []byte) ([]byte, error) {
+	var unmarshalled interface{}
+	if err := json.Unmarshal(jsonData, &unmarshalled); err != nil {
+		return nil, fmt.Errorf("invalid JSON: %s", err)
+	}
+	mapOfparentReferences := a.getMapOfResourceIds(unmarshalled)
+	unmarshalledResult := a.resolveIndirectReferences(nil, unmarshalled, "", mapOfparentReferences)
+	resultBytes, err := json.Marshal(unmarshalledResult)
+	if err != nil {
+		return nil, fmt.Errorf("invalid JSON: %s", err)
+	}
+	jsonData = resultBytes
+	return jsonData, nil
+}
+
+// resolveIndirectReferences finds if the references are of the Name of the resource and replace it with actual Name
+func (a *CFTV1) resolveIndirectReferences(parent interface{}, input interface{}, parentKey string, mapOfReferences map[string]string) interface{} {
+
+	switch value := input.(type) {
+
+	case map[string]interface{}:
+		processed := map[string]interface{}{}
+		for key, val := range value {
+			if key == "Ref" && parentKey != "" {
+				valuStr := fmt.Sprintf("%v", val)
+				if _, ok := mapOfReferences[valuStr]; ok {
+					if parentVal, ok := parent.(map[string]interface{}); ok {
+						parentVal[parentKey] = valuStr
+						val = valuStr
+						return val
+					}
+				}
+			}
+			processed[key] = a.resolveIndirectReferences(value, val, key, mapOfReferences)
+		}
+		return processed
+
+	case []interface{}:
+
+		// We found an array in the JSON - recurse through it's elements looking for intrinsic functions
+		processed := []interface{}{}
+		for _, val := range value {
+			processed = append(processed, a.resolveIndirectReferences(parent, val, parentKey, mapOfReferences))
+		}
+		return processed
+
+	case nil:
+		return value
+	case bool:
+		return value
+	case float64:
+		return value
+	case string:
+		return value
+	default:
+		return nil
+
+	}
+}
diff --git a/pkg/iac-providers/cft/v1/yamlparse.go b/pkg/iac-providers/cft/v1/yamlparse.go
new file mode 100644
index 000000000..e76644023
--- /dev/null
+++ b/pkg/iac-providers/cft/v1/yamlparse.go
@@ -0,0 +1,235 @@
+/*
+    Copyright (C) 2022 Tenable, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+		http://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+	Package cft provides the Template type that models a CloudFormation template.
+
+ 	The sub-packages of cft contains various tools for working with templates
+*/
+
+package cftv1
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// Tags is a mapping from YAML short tags to full instrincic function names
+var Tags = map[string]string{
+	"!And":           "Fn::And",
+	"!Base64":        "Fn::Base64",
+	"!Cidr":          "Fn::Cidr",
+	"!Equals":        "Fn::Equals",
+	"!FindInMap":     "Fn::FindInMap",
+	"!GetAZs":        "Fn::GetAZs",
+	"!GetAtt":        "Fn::GetAtt",
+	"!If":            "Fn::If",
+	"!ImportValue":   "Fn::ImportValue",
+	"!Join":          "Fn::Join",
+	"!Not":           "Fn::Not",
+	"!Or":            "Fn::Or",
+	"!Select":        "Fn::Select",
+	"!Split":         "Fn::Split",
+	"!Sub":           "Fn::Sub",
+	"!Ref":           "Ref",
+	"!Condition":     "Condition",
+	"!Rain::Embed":   "Rain::Embed",
+	"!Rain::Include": "Rain::Include",
+	"!Rain::Env":     "Rain::Env",
+	"!Rain::S3Http":  "Rain::S3Http",
+	"!Rain::S3":      "Rain::S3",
+	"!Rain::Module":  "Rain::Module",
+}
+
+// Template represents a CloudFormation template. The Template type
+// is minimal for now but will likely grow new features as needed by rain.
+type Template struct {
+	*yaml.Node
+}
+
+// TODO - We really need a convenient Template data structure
+// that lets us easily access elements.
+// t.Resources["MyResource"].Properties["MyProp"]
+//
+// Add a Model attribute to the struct and an Init function to populate it.
+// t.Model.Resources
+
+// Map returns the template as a map[string]interface{}
+func (t Template) Map() (map[string]interface{}, error) {
+	var out map[string]interface{}
+	err := t.Decode(&out)
+	if err != nil {
+		return nil, fmt.Errorf("error converting template to map: %s", err)
+	}
+	return out, nil
+}
+
+// AppendStateMap appends a "State" section to the template
+func AppendStateMap(state Template) *yaml.Node {
+	state.Node.Content[0].Content = append(state.Node.Content[0].Content,
+		&yaml.Node{Kind: yaml.ScalarNode, Value: "State"})
+	stateMap := &yaml.Node{Kind: yaml.MappingNode, Content: make([]*yaml.Node, 0)}
+	state.Node.Content[0].Content = append(state.Node.Content[0].Content, stateMap)
+	return stateMap
+}
+
+// File reads the file and returns string
+func (a *CFTV1) File(fileName string) (Template, error) {
+	source, err := os.ReadFile(fileName)
+	if err != nil {
+		return Template{}, fmt.Errorf("unable to read file: %s", err)
+	}
+
+	return String(string(source))
+}
+
+// String returns a cft.Template parsed from a string
+func String(input string) (Template, error) {
+	var node yaml.Node
+	err := yaml.Unmarshal([]byte(input), &node)
+	if err != nil {
+		return Template{}, fmt.Errorf("invalid YAML: %s", err)
+	}
+
+	return Node(&node)
+}
+
+// Node returns a cft.Template parse from a *yaml.Node
+func Node(node *yaml.Node) (Template, error) {
+	err := TransformNode(node)
+	return Template{Node: node}, err
+}
+
+// TransformNode takes a *yaml.Node and convert tag-style names into map-style,
+// and converts other scalars into a canonical format
+func TransformNode(n *yaml.Node) error {
+	// Fix badly-parsed numbers
+	if n.ShortTag() == "!!float" && n.Value[0] == '0' {
+		n.Tag = "!!str"
+	}
+
+	// Fix badly-parsed timestamps which are often used for versions in cloudformation
+	if n.ShortTag() == "!!timestamp" {
+		n.Tag = "!!str"
+	}
+
+	// Convert tag-style intrinsics into map-style
+	for tag, funcName := range Tags {
+		if n.ShortTag() == tag {
+			body := Clone(n)
+
+			// Fix empty Fn values (should never be null)
+			if body.Tag == "!!null" {
+				body.Tag = "!!str"
+			} else {
+				body.Tag = ""
+			}
+
+			// Wrap in a map
+			*n = yaml.Node{
+				Kind: yaml.MappingNode,
+				Tag:  "!!map",
+				Content: []*yaml.Node{
+					{
+						Kind:  yaml.ScalarNode,
+						Style: 0,
+						Tag:   "!!str",
+						Value: funcName,
+					},
+					body,
+				},
+			}
+			break
+		}
+	}
+	// Convert GetAtts
+	if n.Kind == yaml.MappingNode && len(n.Content) == 2 {
+		if n.Content[0].Value == "Fn::GetAtt" && n.Content[1].Kind == yaml.ScalarNode {
+			err := parseGetAtt(n.Content[1])
+			if err != nil {
+				return err
+			}
+		}
+	}
+	for _, child := range n.Content {
+		err := TransformNode(child)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Convert string GetAtt into array format so that it it's easier to compare
+func parseGetAtt(n *yaml.Node) error {
+	parts := strings.SplitN(n.Value, ".", 2)
+
+	if len(parts) != 2 {
+		return errors.New("GetAtt requires two parameters")
+	}
+
+	*n = yaml.Node{
+		Kind: yaml.SequenceNode,
+
+		HeadComment: n.HeadComment,
+		LineComment: n.LineComment,
+		FootComment: n.FootComment,
+
+		Content: []*yaml.Node{
+			{
+				Kind:  yaml.ScalarNode,
+				Style: 0,
+				Tag:   "!!str",
+				Value: parts[0],
+			},
+			{
+				Kind:  yaml.ScalarNode,
+				Style: 0,
+				Tag:   "!!str",
+				Value: parts[1],
+			},
+		},
+	}
+	return nil
+}
+
+// Clone returns a copy of the provided node
+func Clone(node *yaml.Node) *yaml.Node {
+	if node == nil {
+		return nil
+	}
+
+	out := &yaml.Node{
+		Kind:        node.Kind,
+		Style:       node.Style,
+		Tag:         node.Tag,
+		Value:       node.Value,
+		Anchor:      node.Anchor,
+		Alias:       Clone(node.Alias),
+		Content:     make([]*yaml.Node, len(node.Content)),
+		HeadComment: node.HeadComment,
+		LineComment: node.LineComment,
+		FootComment: node.FootComment,
+		Line:        node.Line,
+		Column:      node.Column,
+	}
+
+	for i, child := range node.Content {
+		out.Content[i] = Clone(child)
+	}
+	return out
+}
diff --git a/pkg/mapper/iac-providers/arm/config/application-gateway.go b/pkg/mapper/iac-providers/arm/config/application-gateway.go
index 8cde8bd5c..42aa22b46 100644
--- a/pkg/mapper/iac-providers/arm/config/application-gateway.go
+++ b/pkg/mapper/iac-providers/arm/config/application-gateway.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const armWafConfiguration = "webApplicationFirewallConfiguration"
@@ -34,7 +35,7 @@ func ApplicationGatewayConfig(r types.Resource, params map[string]interface{}) m
 	cf := map[string]interface{}{
 		tfName:     fn.LookUpString(nil, params, r.Name),
 		tfLocation: fn.LookUpString(nil, params, tfLocation),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	w := convert.ToMap(r.Properties, armWafConfiguration)
diff --git a/pkg/mapper/iac-providers/arm/config/container-registry.go b/pkg/mapper/iac-providers/arm/config/container-registry.go
index 4240737cf..a8e5a1223 100644
--- a/pkg/mapper/iac-providers/arm/config/container-registry.go
+++ b/pkg/mapper/iac-providers/arm/config/container-registry.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const armAdminUserEnabled = "adminUserEnabled"
@@ -34,7 +35,7 @@ func ContainerRegistryConfig(r types.Resource, params map[string]interface{}) ma
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 		tfSku:      fn.LookUpString(nil, params, r.SKU.Name),
 	}
 
diff --git a/pkg/mapper/iac-providers/arm/config/cosmosdb-account.go b/pkg/mapper/iac-providers/arm/config/cosmosdb-account.go
index db1cbdb72..3c91844c9 100644
--- a/pkg/mapper/iac-providers/arm/config/cosmosdb-account.go
+++ b/pkg/mapper/iac-providers/arm/config/cosmosdb-account.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -36,7 +37,7 @@ func CosmosDBAccountConfig(r types.Resource, params map[string]interface{}) map[
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	var v string
diff --git a/pkg/mapper/iac-providers/arm/config/deployments.go b/pkg/mapper/iac-providers/arm/config/deployments.go
index 9febb6fa6..207ae1dd5 100644
--- a/pkg/mapper/iac-providers/arm/config/deployments.go
+++ b/pkg/mapper/iac-providers/arm/config/deployments.go
@@ -22,6 +22,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 	"go.uber.org/zap"
 )
 
@@ -49,7 +50,7 @@ func DeploymentsConfig(r types.Resource, vars, params map[string]interface{}) ma
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(vars, params, r.Location),
 		tfName:     fn.LookUpString(vars, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	// if template is defined directly
diff --git a/pkg/mapper/iac-providers/arm/config/diagnostic-setting.go b/pkg/mapper/iac-providers/arm/config/diagnostic-setting.go
index 0ba96beff..32e446270 100644
--- a/pkg/mapper/iac-providers/arm/config/diagnostic-setting.go
+++ b/pkg/mapper/iac-providers/arm/config/diagnostic-setting.go
@@ -22,6 +22,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -44,7 +45,7 @@ func DiagnosticSettingConfig(r types.Resource, vars, params map[string]interface
 	cf := map[string]interface{}{
 		tfLocation:         fn.LookUpString(nil, params, r.Location),
 		tfName:             fn.LookUpString(nil, params, r.Name),
-		tfTags:             r.Tags,
+		tfTags:             functions.PatchAWSTags(r.Tags),
 		tfTargetResourceID: fn.LookUpString(vars, params, getTargetResourceID(r.DependsOn)),
 		tfStorageAccountID: fn.LookUpString(vars, params, convert.ToString(r.Properties, armStorageAccountID)),
 	}
diff --git a/pkg/mapper/iac-providers/arm/config/key-vault-key.go b/pkg/mapper/iac-providers/arm/config/key-vault-key.go
index e860a94f7..83ee8ff8b 100644
--- a/pkg/mapper/iac-providers/arm/config/key-vault-key.go
+++ b/pkg/mapper/iac-providers/arm/config/key-vault-key.go
@@ -22,6 +22,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const armAttributes = "attributes"
@@ -32,7 +33,7 @@ func KeyVaultKeyConfig(r types.Resource, params map[string]interface{}) map[stri
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	attr := convert.ToMap(r.Properties, armAttributes)
diff --git a/pkg/mapper/iac-providers/arm/config/key-vault-secret.go b/pkg/mapper/iac-providers/arm/config/key-vault-secret.go
index c4fd6a206..b8bbb417a 100644
--- a/pkg/mapper/iac-providers/arm/config/key-vault-secret.go
+++ b/pkg/mapper/iac-providers/arm/config/key-vault-secret.go
@@ -22,6 +22,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 // KeyVaultSecretConfig returns config for azurerm_key_vault_secret
@@ -29,7 +30,7 @@ func KeyVaultSecretConfig(r types.Resource, params map[string]interface{}) map[s
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	a := convert.ToMap(r.Properties, armAttributes)
diff --git a/pkg/mapper/iac-providers/arm/config/key-vault.go b/pkg/mapper/iac-providers/arm/config/key-vault.go
index 28139ae77..ea0b113b4 100644
--- a/pkg/mapper/iac-providers/arm/config/key-vault.go
+++ b/pkg/mapper/iac-providers/arm/config/key-vault.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const armEnableSoftDelete = "enableSoftDelete"
@@ -34,7 +35,7 @@ func KeyVaultConfig(r types.Resource, params map[string]interface{}) map[string]
 	return map[string]interface{}{
 		tfLocation:          fn.LookUpString(nil, params, r.Location),
 		tfName:              fn.LookUpString(nil, params, r.Name),
-		tfTags:              r.Tags,
+		tfTags:              functions.PatchAWSTags(r.Tags),
 		tfSoftDeleteEnabled: convert.ToBool(r.Properties, armEnableSoftDelete),
 		tfTenantID:          convert.ToString(params, armTenantID),
 	}
diff --git a/pkg/mapper/iac-providers/arm/config/kubernetes-cluster.go b/pkg/mapper/iac-providers/arm/config/kubernetes-cluster.go
index 1ad8b7673..da38cdc95 100644
--- a/pkg/mapper/iac-providers/arm/config/kubernetes-cluster.go
+++ b/pkg/mapper/iac-providers/arm/config/kubernetes-cluster.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -51,7 +52,7 @@ func KubernetesClusterConfig(r types.Resource, vars, params map[string]interface
 	cf := map[string]interface{}{
 		tfLocation:  fn.LookUpString(nil, params, r.Location),
 		tfName:      fn.LookUpString(nil, params, r.Name),
-		tfTags:      r.Tags,
+		tfTags:      functions.PatchAWSTags(r.Tags),
 		tfDNSPrefix: fn.LookUpString(vars, params, convert.ToString(r.Properties, armDNSPrefix)),
 	}
 
diff --git a/pkg/mapper/iac-providers/arm/config/managed-disk.go b/pkg/mapper/iac-providers/arm/config/managed-disk.go
index 40700acbe..baeebc88c 100644
--- a/pkg/mapper/iac-providers/arm/config/managed-disk.go
+++ b/pkg/mapper/iac-providers/arm/config/managed-disk.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -43,7 +44,7 @@ func ManagedDiskConfig(r types.Resource, vars, params map[string]interface{}) ma
 	cf := map[string]interface{}{
 		tfLocation:           fn.LookUpString(nil, params, r.Location),
 		tfName:               fn.LookUpString(nil, params, r.Name),
-		tfTags:               r.Tags,
+		tfTags:               functions.PatchAWSTags(r.Tags),
 		tfStorageAccountType: r.SKU.Name,
 		tfEncryptionSettings: convert.ToMap(r.Properties, armEncryptionSettingsCollection),
 		tfDiskSizeGB:         fn.LookUpFloat64(vars, params, convert.ToString(r.Properties, armDiskSizeGB)),
diff --git a/pkg/mapper/iac-providers/arm/config/management-lock.go b/pkg/mapper/iac-providers/arm/config/management-lock.go
index 7af2201e2..4a1646653 100644
--- a/pkg/mapper/iac-providers/arm/config/management-lock.go
+++ b/pkg/mapper/iac-providers/arm/config/management-lock.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -33,7 +34,7 @@ func ManagementLockConfig(r types.Resource, vars, params map[string]interface{})
 	return map[string]interface{}{
 		tfLocation:  fn.LookUpString(nil, params, r.Location),
 		tfName:      fn.LookUpString(nil, params, r.Name),
-		tfTags:      r.Tags,
+		tfTags:      functions.PatchAWSTags(r.Tags),
 		tfScope:     fn.LookUpString(vars, params, r.Scope),
 		tfLockLevel: convert.ToString(r.Properties, armLevel),
 		tfNotes:     convert.ToString(r.Properties, tfNotes),
diff --git a/pkg/mapper/iac-providers/arm/config/mssql-server.go b/pkg/mapper/iac-providers/arm/config/mssql-server.go
index 3198b4f43..d34089aaa 100644
--- a/pkg/mapper/iac-providers/arm/config/mssql-server.go
+++ b/pkg/mapper/iac-providers/arm/config/mssql-server.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -39,7 +40,7 @@ func MSSQLServerConfig(r types.Resource, vars, params map[string]interface{}) ma
 	return map[string]interface{}{
 		tfLocation:                   fn.LookUpString(nil, params, r.Location),
 		tfName:                       fn.LookUpString(nil, params, r.Name),
-		tfTags:                       r.Tags,
+		tfTags:                       functions.PatchAWSTags(r.Tags),
 		tfAdministratorLogin:         fn.LookUpString(vars, params, convert.ToString(r.Properties, armAdministratorLogin)),
 		tfAdministratorLoginPassword: fn.LookUpString(vars, params, convert.ToString(r.Properties, armAdministratorLoginPassword)),
 		tfMinimumTLSVersion:          fn.LookUpString(vars, params, convert.ToString(r.Properties, armMinimumTLSVersion)),
diff --git a/pkg/mapper/iac-providers/arm/config/mysql-server.go b/pkg/mapper/iac-providers/arm/config/mysql-server.go
index aae4ff8e1..7d89feb8f 100644
--- a/pkg/mapper/iac-providers/arm/config/mysql-server.go
+++ b/pkg/mapper/iac-providers/arm/config/mysql-server.go
@@ -22,6 +22,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -49,7 +50,7 @@ func MySQLServerConfig(r types.Resource, vars, params map[string]interface{}) ma
 		tfLocation:                   fn.LookUpString(nil, params, r.Location),
 		tfName:                       fn.LookUpString(nil, params, r.Name),
 		tfSkuName:                    fn.LookUpString(vars, params, r.SKU.Name),
-		tfTags:                       r.Tags,
+		tfTags:                       functions.PatchAWSTags(r.Tags),
 		tfVersion:                    fn.LookUpString(vars, params, convert.ToString(r.Properties, armVersion)),
 		tfAdministratorLogin:         fn.LookUpString(vars, params, convert.ToString(r.Properties, armAdministratorLogin)),
 		tfAdministratorLoginPassword: fn.LookUpString(vars, params, convert.ToString(r.Properties, armAdministratorLoginPassword)),
diff --git a/pkg/mapper/iac-providers/arm/config/network-security-rule.go b/pkg/mapper/iac-providers/arm/config/network-security-rule.go
index aa3a6525e..983425236 100644
--- a/pkg/mapper/iac-providers/arm/config/network-security-rule.go
+++ b/pkg/mapper/iac-providers/arm/config/network-security-rule.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -45,7 +46,7 @@ func NetworkSecurityRuleConfig(r types.Resource, params map[string]interface{})
 	return map[string]interface{}{
 		tfLocation:             fn.LookUpString(nil, params, r.Location),
 		tfName:                 fn.LookUpString(nil, params, r.Name),
-		tfTags:                 r.Tags,
+		tfTags:                 functions.PatchAWSTags(r.Tags),
 		tfAccess:               convert.ToString(r.Properties, armAccess),
 		tfDirection:            convert.ToBool(r.Properties, armDirection),
 		tfProtocol:             convert.ToString(r.Properties, armProtocol),
diff --git a/pkg/mapper/iac-providers/arm/config/network-watcher-flow-log.go b/pkg/mapper/iac-providers/arm/config/network-watcher-flow-log.go
index 4fda814cc..566f0a22c 100644
--- a/pkg/mapper/iac-providers/arm/config/network-watcher-flow-log.go
+++ b/pkg/mapper/iac-providers/arm/config/network-watcher-flow-log.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -50,7 +51,7 @@ func NetworkWatcherFlowLogConfig(r types.Resource, vars, params map[string]inter
 	cf := map[string]interface{}{
 		tfLocation:               fn.LookUpString(nil, params, r.Location),
 		tfName:                   fn.LookUpString(nil, params, r.Name),
-		tfTags:                   r.Tags,
+		tfTags:                   functions.PatchAWSTags(r.Tags),
 		tfNetworkSecurityGroupID: fn.LookUpString(vars, params, convert.ToString(r.Properties, armTargetResourceID)),
 		tfStorageAccountID:       fn.LookUpString(vars, params, convert.ToString(r.Properties, armStorageID)),
 		tfEnabled:                convert.ToBool(r.Properties, armEnabled),
diff --git a/pkg/mapper/iac-providers/arm/config/patch-schedule.go b/pkg/mapper/iac-providers/arm/config/patch-schedule.go
index dd9159fd3..43999d36b 100644
--- a/pkg/mapper/iac-providers/arm/config/patch-schedule.go
+++ b/pkg/mapper/iac-providers/arm/config/patch-schedule.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -39,6 +40,6 @@ func PatchScheduleConfig(r types.Resource, params map[string]interface{}) map[st
 	return map[string]interface{}{
 		tfDayOfWeek:    fn.LookUpString(nil, params, convert.ToString(sch, armDayOfWeek)),
 		tfStartHourUTC: fn.LookUpFloat64(nil, params, convert.ToString(sch, armStartHourUtc)),
-		tfTags:         r.Tags,
+		tfTags:         functions.PatchAWSTags(r.Tags),
 	}
 }
diff --git a/pkg/mapper/iac-providers/arm/config/postgresql-configuration.go b/pkg/mapper/iac-providers/arm/config/postgresql-configuration.go
index 3cdc0e462..7717f8cec 100644
--- a/pkg/mapper/iac-providers/arm/config/postgresql-configuration.go
+++ b/pkg/mapper/iac-providers/arm/config/postgresql-configuration.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -33,7 +34,7 @@ const tfValue = "value"
 func PostgreSQLConfigurationConfig(r types.Resource, params map[string]interface{}) map[string]interface{} {
 	return map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 		tfName:     convert.ToString(r.Properties, armSource),
 		tfValue:    convert.ToString(r.Properties, armValue),
 	}
diff --git a/pkg/mapper/iac-providers/arm/config/postgresql-server.go b/pkg/mapper/iac-providers/arm/config/postgresql-server.go
index 72eb630f6..d45dc6275 100644
--- a/pkg/mapper/iac-providers/arm/config/postgresql-server.go
+++ b/pkg/mapper/iac-providers/arm/config/postgresql-server.go
@@ -22,6 +22,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 // PostgreSQLServerConfig returns config for azurerm_postgresql_server
@@ -29,7 +30,7 @@ func PostgreSQLServerConfig(r types.Resource, vars, params map[string]interface{
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 		tfSkuName:  fn.LookUpString(vars, params, r.SKU.Name),
 		tfVersion:  fn.LookUpString(vars, params, convert.ToString(r.Properties, armVersion)),
 	}
diff --git a/pkg/mapper/iac-providers/arm/config/redis-cache.go b/pkg/mapper/iac-providers/arm/config/redis-cache.go
index a2f03dd10..0bdc1cdd3 100644
--- a/pkg/mapper/iac-providers/arm/config/redis-cache.go
+++ b/pkg/mapper/iac-providers/arm/config/redis-cache.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -40,7 +41,7 @@ func RedisCacheConfig(r types.Resource, params map[string]interface{}) map[strin
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	if enabledNonSSLPort, ok := fn.LookUp(nil, params, convert.ToString(r.Properties, armEnableNonSSLPort)).(bool); ok {
diff --git a/pkg/mapper/iac-providers/arm/config/redis-firewall-rule.go b/pkg/mapper/iac-providers/arm/config/redis-firewall-rule.go
index 455878ed8..abaab6606 100644
--- a/pkg/mapper/iac-providers/arm/config/redis-firewall-rule.go
+++ b/pkg/mapper/iac-providers/arm/config/redis-firewall-rule.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -37,7 +38,7 @@ func RedisFirewallRuleConfig(r types.Resource, params map[string]interface{}) ma
 	return map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 		tfStartIP:  fn.LookUpString(nil, params, convert.ToString(r.Properties, armStartIP)),
 		tfEndIP:    fn.LookUpString(nil, params, convert.ToString(r.Properties, armEndIP)),
 	}
diff --git a/pkg/mapper/iac-providers/arm/config/resource-group.go b/pkg/mapper/iac-providers/arm/config/resource-group.go
index c34719881..74cd2835f 100644
--- a/pkg/mapper/iac-providers/arm/config/resource-group.go
+++ b/pkg/mapper/iac-providers/arm/config/resource-group.go
@@ -19,6 +19,7 @@ package config
 import (
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 // ResourceGroupConfig returns config for azurerm_resource_group
@@ -26,6 +27,6 @@ func ResourceGroupConfig(r types.Resource, params map[string]interface{}) map[st
 	return map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 }
diff --git a/pkg/mapper/iac-providers/arm/config/role-assignment.go b/pkg/mapper/iac-providers/arm/config/role-assignment.go
index 6b81bad7f..7337ea2f6 100644
--- a/pkg/mapper/iac-providers/arm/config/role-assignment.go
+++ b/pkg/mapper/iac-providers/arm/config/role-assignment.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -38,7 +39,7 @@ func RoleAssignmentConfig(r types.Resource, vars, params map[string]interface{})
 	return map[string]interface{}{
 		tfLocation:         fn.LookUpString(nil, params, r.Location),
 		tfName:             fn.LookUpString(nil, params, r.Name),
-		tfTags:             r.Tags,
+		tfTags:             functions.PatchAWSTags(r.Tags),
 		tfScope:            fn.LookUpString(vars, params, r.Scope),
 		tfLockLevel:        convert.ToString(r.Properties, armLevel),
 		tfPrincipalID:      convert.ToString(r.Properties, armPrincipalID),
diff --git a/pkg/mapper/iac-providers/arm/config/security-center-contact.go b/pkg/mapper/iac-providers/arm/config/security-center-contact.go
index 712972c34..bebb7fd75 100644
--- a/pkg/mapper/iac-providers/arm/config/security-center-contact.go
+++ b/pkg/mapper/iac-providers/arm/config/security-center-contact.go
@@ -22,6 +22,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -44,7 +45,7 @@ func SecurityCenterContactConfig(r types.Resource, params map[string]interface{}
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 		tfPhone:    fn.LookUpString(nil, params, convert.ToString(r.Properties, armPhone)),
 		tfEmail:    fn.LookUpString(nil, params, convert.ToString(r.Properties, armEmails)),
 	}
diff --git a/pkg/mapper/iac-providers/arm/config/security-center-subscription-pricing.go b/pkg/mapper/iac-providers/arm/config/security-center-subscription-pricing.go
index 0ae0ad243..94bd4e099 100644
--- a/pkg/mapper/iac-providers/arm/config/security-center-subscription-pricing.go
+++ b/pkg/mapper/iac-providers/arm/config/security-center-subscription-pricing.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const armPricingTier = "pricingTier"
@@ -30,7 +31,7 @@ func SecurityCenterSubscriptionPricingConfig(r types.Resource, params map[string
 	return map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 		tfTier:     fn.LookUpString(nil, params, convert.ToString(r.Properties, armPricingTier)),
 	}
 }
diff --git a/pkg/mapper/iac-providers/arm/config/sql-active-directory-administrator.go b/pkg/mapper/iac-providers/arm/config/sql-active-directory-administrator.go
index ab82ceedf..802a1b323 100644
--- a/pkg/mapper/iac-providers/arm/config/sql-active-directory-administrator.go
+++ b/pkg/mapper/iac-providers/arm/config/sql-active-directory-administrator.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -37,7 +38,7 @@ func SQLActiveDirectoryAdministratorConfig(r types.Resource, vars, params map[st
 	return map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 		tfLogin:    fn.LookUpString(vars, params, convert.ToString(r.Properties, armLogin)),
 		tfObjectID: fn.LookUpString(vars, params, convert.ToString(r.Properties, armSid)),
 		tfTenantID: fn.LookUpString(vars, params, convert.ToString(r.Properties, armTenantID)),
diff --git a/pkg/mapper/iac-providers/arm/config/sql-firewall-rule.go b/pkg/mapper/iac-providers/arm/config/sql-firewall-rule.go
index fec8b99c4..04db0d804 100644
--- a/pkg/mapper/iac-providers/arm/config/sql-firewall-rule.go
+++ b/pkg/mapper/iac-providers/arm/config/sql-firewall-rule.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -37,7 +38,7 @@ func SQLFirewallRuleConfig(r types.Resource, params map[string]interface{}) map[
 	return map[string]interface{}{
 		tfLocation:       fn.LookUpString(nil, params, r.Location),
 		tfName:           fn.LookUpString(nil, params, r.Name),
-		tfTags:           r.Tags,
+		tfTags:           functions.PatchAWSTags(r.Tags),
 		tfStartIPAddress: fn.LookUpString(nil, params, convert.ToString(r.Properties, armStartIPAddress)),
 		tfEndIPAddress:   fn.LookUpString(nil, params, convert.ToString(r.Properties, armEndIPAddress)),
 	}
diff --git a/pkg/mapper/iac-providers/arm/config/storage-account.go b/pkg/mapper/iac-providers/arm/config/storage-account.go
index 776e6e287..fec2bbd64 100644
--- a/pkg/mapper/iac-providers/arm/config/storage-account.go
+++ b/pkg/mapper/iac-providers/arm/config/storage-account.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -44,7 +45,7 @@ func StorageAccountConfig(r types.Resource, vars, params map[string]interface{})
 	cf := map[string]interface{}{
 		tfLocation:               fn.LookUpString(nil, params, r.Location),
 		tfName:                   fn.LookUpString(nil, params, r.Name),
-		tfTags:                   r.Tags,
+		tfTags:                   functions.PatchAWSTags(r.Tags),
 		tfAccountTier:            r.SKU.Tier,
 		tfAccountReplicationType: r.SKU.Name,
 		tfEnableHTTPSTrafficOnly: convert.ToBool(r.Properties, armSupportsHTTPSTrafficOnly),
diff --git a/pkg/mapper/iac-providers/arm/config/storage-container.go b/pkg/mapper/iac-providers/arm/config/storage-container.go
index b55b7a195..c55c8fd11 100644
--- a/pkg/mapper/iac-providers/arm/config/storage-container.go
+++ b/pkg/mapper/iac-providers/arm/config/storage-container.go
@@ -22,6 +22,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const publicAccess = "publicAccess"
@@ -32,7 +33,7 @@ func StorageContainerConfig(r types.Resource, params map[string]interface{}) map
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	access := fn.LookUpString(nil, params, convert.ToString(r.Properties, publicAccess))
diff --git a/pkg/mapper/iac-providers/arm/config/virtual-machine.go b/pkg/mapper/iac-providers/arm/config/virtual-machine.go
index 63399dec7..a1f64a76e 100644
--- a/pkg/mapper/iac-providers/arm/config/virtual-machine.go
+++ b/pkg/mapper/iac-providers/arm/config/virtual-machine.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const armNetworkInterfaces = "networkInterfaces"
@@ -30,7 +31,7 @@ func VirtualMachineConfig(r types.Resource, params map[string]interface{}) map[s
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	profile := convert.ToMap(r.Properties, armNetworkProfile)
diff --git a/pkg/mapper/iac-providers/arm/config/virtual-network.go b/pkg/mapper/iac-providers/arm/config/virtual-network.go
index a9c23d36d..674492014 100644
--- a/pkg/mapper/iac-providers/arm/config/virtual-network.go
+++ b/pkg/mapper/iac-providers/arm/config/virtual-network.go
@@ -20,6 +20,7 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/convert"
 	fn "github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/functions"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/arm/types"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 const (
@@ -40,7 +41,7 @@ func VirtualNetworkConfig(r types.Resource, vars, params map[string]interface{})
 	cf := map[string]interface{}{
 		tfLocation: fn.LookUpString(nil, params, r.Location),
 		tfName:     fn.LookUpString(nil, params, r.Name),
-		tfTags:     r.Tags,
+		tfTags:     functions.PatchAWSTags(r.Tags),
 	}
 
 	subs := convert.ToSlice(r.Properties, armSubnets)
diff --git a/pkg/mapper/iac-providers/cft/cft.go b/pkg/mapper/iac-providers/cft/cft.go
index b2d3a7605..0ea21da92 100644
--- a/pkg/mapper/iac-providers/cft/cft.go
+++ b/pkg/mapper/iac-providers/cft/cft.go
@@ -263,7 +263,7 @@ func (m cftMapper) mapConfigForResource(r cloudformation.Resource, resourceName
 	case *ecs.TaskDefinition:
 		return config.GetEcsTaskDefinitionConfig(resource)
 	case *s3.Bucket:
-		return config.GetS3BucketConfig(resource)
+		return config.GetS3BucketConfig(resource, resourceName)
 	case *s3.BucketPolicy:
 		return config.GetS3BucketPolicyConfig(resource)
 	case *sqs.Queue:
@@ -314,6 +314,8 @@ func (m cftMapper) mapConfigForResource(r cloudformation.Resource, resourceName
 		return config.GetSecretsManagerSecretRotationConfig(resource)
 	case *ssm.Parameter:
 		return config.GetSSMParameterConfig(resource)
+	case *elasticloadbalancingv2.LoadBalancer:
+		return config.GetElasticLoadBalancingV2LoadBalancerConfig(resource, resourceName)
 	default:
 	}
 	return []config.AWSResourceConfig{}
diff --git a/pkg/mapper/iac-providers/cft/config/api-gateway-rest-api.go b/pkg/mapper/iac-providers/cft/config/api-gateway-rest-api.go
index 6b9ee81a0..b171e0209 100644
--- a/pkg/mapper/iac-providers/cft/config/api-gateway-rest-api.go
+++ b/pkg/mapper/iac-providers/cft/config/api-gateway-rest-api.go
@@ -30,11 +30,12 @@ type APIGatewayRestAPIConfig struct {
 }
 
 // GetAPIGatewayRestAPIConfig returns config for aws_api_gateway_rest_api
+// aws_api_gateway_rest_api
 func GetAPIGatewayRestAPIConfig(a *apigateway.RestApi) []AWSResourceConfig {
 	cf := APIGatewayRestAPIConfig{
 		Config: Config{
 			Name: functions.GetVal(a.Name),
-			Tags: a.Tags,
+			Tags: functions.PatchAWSTags(a.Tags),
 		},
 		MinimumCompressionSize: functions.GetVal(a.MinimumCompressionSize),
 		Policy:                 a.Policy,
diff --git a/pkg/mapper/iac-providers/cft/config/api-gateway-stage.go b/pkg/mapper/iac-providers/cft/config/api-gateway-stage.go
index 43be8efed..61e670be8 100644
--- a/pkg/mapper/iac-providers/cft/config/api-gateway-stage.go
+++ b/pkg/mapper/iac-providers/cft/config/api-gateway-stage.go
@@ -43,11 +43,13 @@ type Settings struct {
 type APIGatewayStageConfig struct {
 	AccessLogSettings   interface{} `json:"access_log_settings"`
 	ClientCertificateID string      `json:"client_certificate_id"`
+	RestAPIID           string      `json:"rest_api_id"`
 	Config
 	XrayTracingEnabled bool `json:"xray_tracing_enabled"`
 }
 
 // GetAPIGatewayStageConfig returns config for aws_api_gateway_stage and aws_api_gateway_method_settings
+// aws_api_gateway_method_settings
 func GetAPIGatewayStageConfig(s *apigateway.Stage) []AWSResourceConfig {
 
 	resourceConfigs := make([]AWSResourceConfig, 0)
@@ -55,9 +57,11 @@ func GetAPIGatewayStageConfig(s *apigateway.Stage) []AWSResourceConfig {
 	cf := APIGatewayStageConfig{
 		Config: Config{
 			Name: functions.GetVal(s.StageName),
-			Tags: s.Tags,
+			Tags: functions.PatchAWSTags(s.Tags),
 		},
 	}
+	cf.RestAPIID = s.RestApiId
+
 	if s.AccessLogSetting != nil {
 		cf.AccessLogSettings = s.AccessLogSetting
 	} else {
@@ -79,7 +83,7 @@ func GetAPIGatewayStageConfig(s *apigateway.Stage) []AWSResourceConfig {
 			msc := MethodSettingConfig{
 				Config: Config{
 					Name: functions.GetVal(s.StageName),
-					Tags: s.Tags,
+					Tags: functions.PatchAWSTags(s.Tags),
 				},
 				MethodSettings: []Settings{{
 					MetricsEnabled: functions.GetVal(settings.MetricsEnabled),
diff --git a/pkg/mapper/iac-providers/cft/config/api-gatewayv2-api.go b/pkg/mapper/iac-providers/cft/config/api-gatewayv2-api.go
index b64bcdc9a..ac4beccce 100644
--- a/pkg/mapper/iac-providers/cft/config/api-gatewayv2-api.go
+++ b/pkg/mapper/iac-providers/cft/config/api-gatewayv2-api.go
@@ -49,6 +49,7 @@ type APIGatewayV2ApiConfig struct {
 }
 
 // GetAPIGatewayV2ApiConfig returns config for aws_apigatewayv2_api resource
+// aws_apigatewayv2_api
 func GetAPIGatewayV2ApiConfig(a *apigatewayv2.Api) []AWSResourceConfig {
 	var corsConfigData []CorsConfigurationBlock
 
@@ -65,7 +66,7 @@ func GetAPIGatewayV2ApiConfig(a *apigatewayv2.Api) []AWSResourceConfig {
 	cf := APIGatewayV2ApiConfig{
 		Config: Config{
 			Name: functions.GetVal(a.Name),
-			Tags: a.Tags,
+			Tags: functions.PatchAWSTags(a.Tags),
 		},
 		Name:                      functions.GetVal(a.Name),
 		ProtocolType:              functions.GetVal(a.ProtocolType),
diff --git a/pkg/mapper/iac-providers/cft/config/api-gatewayv2-stage.go b/pkg/mapper/iac-providers/cft/config/api-gatewayv2-stage.go
index 553712222..b6cb7d554 100644
--- a/pkg/mapper/iac-providers/cft/config/api-gatewayv2-stage.go
+++ b/pkg/mapper/iac-providers/cft/config/api-gatewayv2-stage.go
@@ -18,6 +18,7 @@ package config
 
 import (
 	"github.com/awslabs/goformation/v7/cloudformation/apigatewayv2"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 // APIGatewayV2StageConfig holds config for aws_api_gatewayv2_stage
@@ -27,11 +28,12 @@ type APIGatewayV2StageConfig struct {
 }
 
 // GetAPIGatewayV2StageConfig returns config for aws_api_gatewayv2_stage
+// aws_api_gatewayv2_stage no policy
 func GetAPIGatewayV2StageConfig(s *apigatewayv2.Stage) []AWSResourceConfig {
 	cf := APIGatewayV2StageConfig{
 		Config: Config{
 			Name: s.StageName,
-			Tags: s.Tags,
+			Tags: functions.PatchAWSTags(s.Tags),
 		},
 	}
 	if s.AccessLogSettings != nil {
diff --git a/pkg/mapper/iac-providers/cft/config/app-autoscaling-policy.go b/pkg/mapper/iac-providers/cft/config/app-autoscaling-policy.go
index b4ad243c5..6a28a8196 100644
--- a/pkg/mapper/iac-providers/cft/config/app-autoscaling-policy.go
+++ b/pkg/mapper/iac-providers/cft/config/app-autoscaling-policy.go
@@ -32,6 +32,7 @@ type AppAutoScalingPolicyConfig struct {
 }
 
 // GetAppAutoScalingPolicyConfig returns config for AppAutoScalingPolicy
+// aws_appautoscaling_policy
 func GetAppAutoScalingPolicyConfig(a *applicationautoscaling.ScalingPolicy) []AWSResourceConfig {
 	cf := AppAutoScalingPolicyConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/appmesh-mesh.go b/pkg/mapper/iac-providers/cft/config/appmesh-mesh.go
index 0f3e8c0b4..363ea176f 100644
--- a/pkg/mapper/iac-providers/cft/config/appmesh-mesh.go
+++ b/pkg/mapper/iac-providers/cft/config/appmesh-mesh.go
@@ -39,6 +39,7 @@ type AppMeshMeshConfig struct {
 }
 
 // GetAppMeshMeshConfig returns config for AppMeshMesh
+// aws_appmesh_mesh
 func GetAppMeshMeshConfig(m *appmesh.Mesh) []AWSResourceConfig {
 	var spec []AppMeshSpecBlock
 	if m.Spec != nil {
@@ -54,7 +55,7 @@ func GetAppMeshMeshConfig(m *appmesh.Mesh) []AWSResourceConfig {
 	cf := AppMeshMeshConfig{
 		Config: Config{
 			Name: functions.GetVal(m.MeshName),
-			Tags: m.Tags,
+			Tags: functions.PatchAWSTags(m.Tags),
 		},
 		Name: functions.GetVal(m.MeshName),
 		Spec: spec,
diff --git a/pkg/mapper/iac-providers/cft/config/athena-workgroup.go b/pkg/mapper/iac-providers/cft/config/athena-workgroup.go
index f29c571ea..f0b9e51e6 100644
--- a/pkg/mapper/iac-providers/cft/config/athena-workgroup.go
+++ b/pkg/mapper/iac-providers/cft/config/athena-workgroup.go
@@ -56,6 +56,7 @@ type AthenaWorkGroupConfig struct {
 }
 
 // GetAthenaWorkGroupConfig returns config for aws_athena_workgroup resource
+// aws_athena_workgroup
 func GetAthenaWorkGroupConfig(w *athena.WorkGroup) []AWSResourceConfig {
 	var workGroupConfig []WorkgroupConfigurationBlock
 
diff --git a/pkg/mapper/iac-providers/cft/config/autoscaling-launch-configuration.go b/pkg/mapper/iac-providers/cft/config/autoscaling-launch-configuration.go
index a6fcef321..01ea616a0 100644
--- a/pkg/mapper/iac-providers/cft/config/autoscaling-launch-configuration.go
+++ b/pkg/mapper/iac-providers/cft/config/autoscaling-launch-configuration.go
@@ -17,9 +17,6 @@
 package config
 
 import (
-	"encoding/base64"
-	"unicode"
-
 	"github.com/awslabs/goformation/v7/cloudformation/autoscaling"
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
@@ -48,6 +45,7 @@ type AutoScalingLaunchConfigurationConfig struct {
 }
 
 // GetAutoScalingLaunchConfigurationConfig returns config for AutoScalingLaunchConfiguration
+// aws_launch_configuration
 func GetAutoScalingLaunchConfigurationConfig(l *autoscaling.LaunchConfiguration) []AWSResourceConfig {
 	var ebsBlockDevice []EbsBlockDeviceBlock
 	if l.BlockDeviceMappings != nil {
@@ -77,13 +75,8 @@ func GetAutoScalingLaunchConfigurationConfig(l *autoscaling.LaunchConfiguration)
 		EbsBlockDevice:   ebsBlockDevice,
 	}
 
-	data, err := base64.StdEncoding.Strict().DecodeString(functions.GetVal(l.UserData))
-	datastr := string(data)
-
-	if isASCII(datastr) && err == nil {
-		cf.UserDataBase64 = datastr
-	} else {
-		cf.UserData = datastr
+	if l.UserData != nil {
+		cf.UserDataBase64 = *l.UserData
 	}
 
 	return []AWSResourceConfig{{
@@ -92,11 +85,12 @@ func GetAutoScalingLaunchConfigurationConfig(l *autoscaling.LaunchConfiguration)
 	}}
 }
 
-func isASCII(s string) bool {
-	for i := 0; i < len(s); i++ {
-		if s[i] > unicode.MaxASCII {
-			return false
-		}
-	}
-	return true
-}
+// isASCII  not in use as we dont need to convert base64 data to string for iac scanning
+// func isASCII(s string) bool {
+// 	for i := 0; i < len(s); i++ {
+// 		if s[i] > unicode.MaxASCII {
+// 			return false
+// 		}
+// 	}
+// 	return true
+// }
diff --git a/pkg/mapper/iac-providers/cft/config/backup-vault.go b/pkg/mapper/iac-providers/cft/config/backup-vault.go
index 86c2e73b4..955fe5279 100644
--- a/pkg/mapper/iac-providers/cft/config/backup-vault.go
+++ b/pkg/mapper/iac-providers/cft/config/backup-vault.go
@@ -29,6 +29,7 @@ type BackupVaultConfig struct {
 }
 
 // GetBackupVaultConfig returns config for BackupVault
+// aws_backup_vault
 func GetBackupVaultConfig(b *backup.BackupVault) []AWSResourceConfig {
 	cf := BackupVaultConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/certificatemanager-certificate.go b/pkg/mapper/iac-providers/cft/config/certificatemanager-certificate.go
index 2654ef888..0d0563805 100644
--- a/pkg/mapper/iac-providers/cft/config/certificatemanager-certificate.go
+++ b/pkg/mapper/iac-providers/cft/config/certificatemanager-certificate.go
@@ -29,10 +29,11 @@ type CertificateManagerCertificateConfig struct {
 }
 
 // GetCertificateManagerCertificateConfig returns config for CertificateManagerCertificate
+// aws_acm_certificate
 func GetCertificateManagerCertificateConfig(c *certificatemanager.Certificate) []AWSResourceConfig {
 	cf := CertificateManagerCertificateConfig{
 		Config: Config{
-			Tags: c.Tags,
+			Tags: functions.PatchAWSTags(c.Tags),
 		},
 		DomainName:       c.DomainName,
 		ValidationMethod: functions.GetVal(c.ValidationMethod),
diff --git a/pkg/mapper/iac-providers/cft/config/cloudformation-stack.go b/pkg/mapper/iac-providers/cft/config/cloudformation-stack.go
index 359e72708..4a581a72c 100644
--- a/pkg/mapper/iac-providers/cft/config/cloudformation-stack.go
+++ b/pkg/mapper/iac-providers/cft/config/cloudformation-stack.go
@@ -31,9 +31,10 @@ type CloudFormationStackConfig struct {
 }
 
 // GetCloudFormationStackConfig returns config for aws_cloudformation_stack
+// aws_cloudformation_stack
 func GetCloudFormationStackConfig(s *cloudformation.Stack) []AWSResourceConfig {
 	cf := CloudFormationStackConfig{
-		Config:           Config{Tags: s.Tags},
+		Config:           Config{Tags: fn.PatchAWSTags(s.Tags)},
 		TemplateURL:      "",
 		NotificationARNs: nil,
 		TemplateData:     []byte{},
diff --git a/pkg/mapper/iac-providers/cft/config/cloudfront-distribution.go b/pkg/mapper/iac-providers/cft/config/cloudfront-distribution.go
index a2e8d7a25..b3ff9148e 100644
--- a/pkg/mapper/iac-providers/cft/config/cloudfront-distribution.go
+++ b/pkg/mapper/iac-providers/cft/config/cloudfront-distribution.go
@@ -32,10 +32,11 @@ type CloudFrontDistributionConfig struct {
 }
 
 // GetCloudFrontDistributionConfig returns config for aws_cloudfront_distribution
+// aws_cloudfront_distribution
 func GetCloudFrontDistributionConfig(d *cloudfront.Distribution) []AWSResourceConfig {
 	cf := CloudFrontDistributionConfig{
 		Config: Config{
-			Tags: d.Tags,
+			Tags: functions.PatchAWSTags(d.Tags),
 		},
 	}
 	if checkDistributionConfig(d.DistributionConfig) {
diff --git a/pkg/mapper/iac-providers/cft/config/cloudtrail.go b/pkg/mapper/iac-providers/cft/config/cloudtrail.go
index 2902d4e03..9ce48a43f 100644
--- a/pkg/mapper/iac-providers/cft/config/cloudtrail.go
+++ b/pkg/mapper/iac-providers/cft/config/cloudtrail.go
@@ -31,6 +31,7 @@ type CloudTrailConfig struct {
 }
 
 // GetCloudTrailConfig returns config for aws_cloudtrail
+// aws_cloudtrail
 func GetCloudTrailConfig(t *cloudtrail.Trail) []AWSResourceConfig {
 	cf := CloudTrailConfig{
 		Config:                  Config{Tags: t.Tags, Name: functions.GetVal(t.TrailName)},
diff --git a/pkg/mapper/iac-providers/cft/config/cloudwatch-log-group.go b/pkg/mapper/iac-providers/cft/config/cloudwatch-log-group.go
index 3fd1a30dd..24abcec13 100644
--- a/pkg/mapper/iac-providers/cft/config/cloudwatch-log-group.go
+++ b/pkg/mapper/iac-providers/cft/config/cloudwatch-log-group.go
@@ -30,6 +30,7 @@ type LogCloudWatchGroupConfig struct {
 }
 
 // GetLogCloudWatchGroupConfig returns config for aws_cloudwatch_log_group
+// aws_cloudwatch_log_group
 func GetLogCloudWatchGroupConfig(r *logs.LogGroup) []AWSResourceConfig {
 	cf := LogCloudWatchGroupConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/codebuild-project.go b/pkg/mapper/iac-providers/cft/config/codebuild-project.go
index 2f46f8714..5312c6ac5 100644
--- a/pkg/mapper/iac-providers/cft/config/codebuild-project.go
+++ b/pkg/mapper/iac-providers/cft/config/codebuild-project.go
@@ -63,6 +63,7 @@ type CodebuildProjectConfig struct {
 }
 
 // GetCodebuildProjectConfig returns CodebuildProject
+// aws_codebuild_project
 func GetCodebuildProjectConfig(p *codebuild.Project) []AWSResourceConfig {
 
 	var artifactBlock []ArtifactBlock
diff --git a/pkg/mapper/iac-providers/cft/config/cognito-user-pool.go b/pkg/mapper/iac-providers/cft/config/cognito-user-pool.go
index bb7d252c6..989c18c0b 100644
--- a/pkg/mapper/iac-providers/cft/config/cognito-user-pool.go
+++ b/pkg/mapper/iac-providers/cft/config/cognito-user-pool.go
@@ -39,6 +39,7 @@ type CognitoUserPoolConfig struct {
 }
 
 // GetCognitoUserPoolConfig returns config for CognitoUserPool
+// aws_cognito_user_pool no policy
 func GetCognitoUserPoolConfig(u *cognito.UserPool) []AWSResourceConfig {
 	var passwordPolicy []PasswordPolicyBlock
 	if u.Policies != nil && u.Policies.PasswordPolicy != nil {
diff --git a/pkg/mapper/iac-providers/cft/config/config-configrule.go b/pkg/mapper/iac-providers/cft/config/config-configrule.go
index 3324ebabd..5ec0fd068 100644
--- a/pkg/mapper/iac-providers/cft/config/config-configrule.go
+++ b/pkg/mapper/iac-providers/cft/config/config-configrule.go
@@ -28,6 +28,7 @@ type AWSConfigConfigRuleConfig struct {
 }
 
 // GetConfigConfigRuleConfig returns config for aws_config_config_rule
+// aws_config_config_rule
 func GetConfigConfigRuleConfig(c *config.ConfigRule) []AWSResourceConfig {
 	cf := AWSConfigConfigRuleConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/config-configurationaggregator.go b/pkg/mapper/iac-providers/cft/config/config-configurationaggregator.go
index 56566adb2..fcc61ffb6 100644
--- a/pkg/mapper/iac-providers/cft/config/config-configurationaggregator.go
+++ b/pkg/mapper/iac-providers/cft/config/config-configurationaggregator.go
@@ -29,10 +29,11 @@ type ConfigurationAggregatorConfig struct {
 }
 
 // GetConfigConfigurationAggregatorConfig returns config for aws_config_configuration_aggregator
+// aws_config_configuration_aggregator
 func GetConfigConfigurationAggregatorConfig(c *config.ConfigurationAggregator) []AWSResourceConfig {
 	cf := ConfigurationAggregatorConfig{
 		Config: Config{
-			Tags: c.Tags,
+			Tags: functions.PatchAWSTags(c.Tags),
 			Name: functions.GetVal(c.ConfigurationAggregatorName),
 		},
 	}
diff --git a/pkg/mapper/iac-providers/cft/config/dax-cluster.go b/pkg/mapper/iac-providers/cft/config/dax-cluster.go
index 406c615a4..94c88f306 100644
--- a/pkg/mapper/iac-providers/cft/config/dax-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/dax-cluster.go
@@ -28,6 +28,7 @@ type DaxClusterConfig struct {
 }
 
 // GetDaxClusterConfig returns config for aws_dax_cluster
+// aws_dax_cluster
 func GetDaxClusterConfig(t *dax.Cluster) []AWSResourceConfig {
 	cf := DaxClusterConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/db-event-subscription.go b/pkg/mapper/iac-providers/cft/config/db-event-subscription.go
index cad0bb83a..9caa6e013 100644
--- a/pkg/mapper/iac-providers/cft/config/db-event-subscription.go
+++ b/pkg/mapper/iac-providers/cft/config/db-event-subscription.go
@@ -32,6 +32,7 @@ type DBEventSubscriptionConfig struct {
 }
 
 // GetDBEventSubscriptionConfig returns config for aws_db_event_subscription resource
+// aws_db_event_subscription
 func GetDBEventSubscriptionConfig(d *rds.EventSubscription) []AWSResourceConfig {
 	cf := DBEventSubscriptionConfig{
 		Config:          Config{},
diff --git a/pkg/mapper/iac-providers/cft/config/db-instance.go b/pkg/mapper/iac-providers/cft/config/db-instance.go
index bf4ce6a64..677dad6d7 100644
--- a/pkg/mapper/iac-providers/cft/config/db-instance.go
+++ b/pkg/mapper/iac-providers/cft/config/db-instance.go
@@ -44,10 +44,11 @@ type DBInstanceConfig struct {
 }
 
 // GetDBInstanceConfig returns config for aws_db_instance
+// aws_db_instance
 func GetDBInstanceConfig(d *rds.DBInstance) []AWSResourceConfig {
 	cf := DBInstanceConfig{
 		Config: Config{
-			Tags: d.Tags,
+			Tags: functions.PatchAWSTags(d.Tags),
 			Name: functions.GetVal(d.DBName),
 		},
 		EnabledCloudWatchLogsExports: d.EnableCloudwatchLogsExports,
diff --git a/pkg/mapper/iac-providers/cft/config/db-security-group.go b/pkg/mapper/iac-providers/cft/config/db-security-group.go
index 11159c4b9..48b1394d2 100644
--- a/pkg/mapper/iac-providers/cft/config/db-security-group.go
+++ b/pkg/mapper/iac-providers/cft/config/db-security-group.go
@@ -34,6 +34,7 @@ type DBSecurityGroupConfig struct {
 }
 
 // GetDBSecurityGroupConfig returns config for aws_db_security_group
+// aws_db_security_group
 func GetDBSecurityGroupConfig(dbsg *rds.DBSecurityGroup) []AWSResourceConfig {
 	cf := DBSecurityGroupConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/dms-replication-instance.go b/pkg/mapper/iac-providers/cft/config/dms-replication-instance.go
index 4c4301783..3942e5133 100644
--- a/pkg/mapper/iac-providers/cft/config/dms-replication-instance.go
+++ b/pkg/mapper/iac-providers/cft/config/dms-replication-instance.go
@@ -39,10 +39,11 @@ type DmsReplicationInstanceConfig struct {
 }
 
 // GetDmsReplicationInstanceConfig returns config for DmsReplicationInstance
+// aws_dms_replication_instance
 func GetDmsReplicationInstanceConfig(r *dms.ReplicationInstance) []AWSResourceConfig {
 	cf := DmsReplicationInstanceConfig{
 		Config: Config{
-			Tags: r.Tags,
+			Tags: functions.PatchAWSTags(r.Tags),
 		},
 
 		AllocatedStorage:           functions.GetVal(r.AllocatedStorage),
diff --git a/pkg/mapper/iac-providers/cft/config/docdb-cluster.go b/pkg/mapper/iac-providers/cft/config/docdb-cluster.go
index d6156f920..8c0808ebf 100644
--- a/pkg/mapper/iac-providers/cft/config/docdb-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/docdb-cluster.go
@@ -30,10 +30,11 @@ type DocDBClusterConfig struct {
 }
 
 // GetDocDBConfig returns config for aws_docdb_cluster
+// aws_docdb_cluster no such resource in policy
 func GetDocDBConfig(d *docdb.DBCluster) []AWSResourceConfig {
 	cf := DocDBClusterConfig{
 		Config: Config{
-			Tags: d.Tags,
+			Tags: functions.PatchAWSTags(d.Tags),
 		},
 		KmsKeyID:                    functions.GetVal(d.KmsKeyId),
 		StorageEncrypted:            functions.GetVal(d.StorageEncrypted),
diff --git a/pkg/mapper/iac-providers/cft/config/dynamodb-table.go b/pkg/mapper/iac-providers/cft/config/dynamodb-table.go
index d96321bca..ee6024700 100644
--- a/pkg/mapper/iac-providers/cft/config/dynamodb-table.go
+++ b/pkg/mapper/iac-providers/cft/config/dynamodb-table.go
@@ -36,9 +36,11 @@ type DynamoDBTableConfig struct {
 	Config
 	ServerSideEncryption []SSE  `json:"server_side_encryption"`
 	PointInTimeRecovery  []PITR `json:"point_in_time_recovery"`
+	BillingMode          string `json:"billing_mode"`
 }
 
 // GetDynamoDBTableConfig returns config for aws_dynamodb_table
+// aws_dynamodb_table
 func GetDynamoDBTableConfig(t *dynamodb.Table) []AWSResourceConfig {
 	cf := DynamoDBTableConfig{
 		Config: Config{
@@ -47,6 +49,9 @@ func GetDynamoDBTableConfig(t *dynamodb.Table) []AWSResourceConfig {
 		},
 	}
 
+	if t.BillingMode != nil {
+		cf.BillingMode = *t.BillingMode
+	}
 	if t.SSESpecification != nil {
 		cf.ServerSideEncryption = make([]SSE, 1)
 
diff --git a/pkg/mapper/iac-providers/cft/config/ebs-volume.go b/pkg/mapper/iac-providers/cft/config/ebs-volume.go
index ebfba205c..51296b80b 100644
--- a/pkg/mapper/iac-providers/cft/config/ebs-volume.go
+++ b/pkg/mapper/iac-providers/cft/config/ebs-volume.go
@@ -29,10 +29,11 @@ type EbsVolumeConfig struct {
 }
 
 // GetEbsVolumeConfig returns config for aws_ebs_volume
+// aws_ebs_volume
 func GetEbsVolumeConfig(v *ec2.Volume) []AWSResourceConfig {
 	cf := EbsVolumeConfig{
 		Config: Config{
-			Tags: v.Tags,
+			Tags: functions.PatchAWSTags(v.Tags),
 		},
 		Encrypted: functions.GetVal(v.Encrypted),
 		KmsKeyID:  functions.GetVal(v.KmsKeyId),
diff --git a/pkg/mapper/iac-providers/cft/config/ec2-instance.go b/pkg/mapper/iac-providers/cft/config/ec2-instance.go
index 7d561a3b0..650284870 100644
--- a/pkg/mapper/iac-providers/cft/config/ec2-instance.go
+++ b/pkg/mapper/iac-providers/cft/config/ec2-instance.go
@@ -54,24 +54,29 @@ type NetworkInterfaceBlock struct {
 // EC2InstanceConfig holds config for EC2Instance
 type EC2InstanceConfig struct {
 	Config
-	AMI                 string                  `json:"ami"`
-	InstanceType        string                  `json:"instance_type"`
-	EBSOptimized        bool                    `json:"ebs_optimized"`
-	Hibernation         bool                    `json:"hibernation"`
-	Monitoring          bool                    `json:"monitoring"`
-	IAMInstanceProfile  string                  `json:"iam_instance_profile"`
-	VPCSecurityGroupIDs []string                `json:"vpc_security_group_ids"`
-	NetworkInterface    []NetworkInterfaceBlock `json:"network_interface"`
+	AMI                      string                  `json:"ami"`
+	InstanceType             string                  `json:"instance_type"`
+	EBSOptimized             bool                    `json:"ebs_optimized"`
+	Hibernation              bool                    `json:"hibernation"`
+	Monitoring               bool                    `json:"monitoring"`
+	IAMInstanceProfile       string                  `json:"iam_instance_profile"`
+	VPCSecurityGroupIDs      []string                `json:"vpc_security_group_ids"`
+	NetworkInterface         []NetworkInterfaceBlock `json:"network_interface"`
+	UserData                 string                  `json:"user_data_base64"`
+	AssociatePublicIPAddress bool                    `json:"associate_public_ip_address"`
+	SubnetID                 string                  `json:"subnet_id"`
 }
 
 // GetEC2InstanceConfig returns config for EC2Instance
+// aws_instance
 func GetEC2InstanceConfig(i *ec2.Instance, instanceName string) []AWSResourceConfig {
 	networkInterfaces := i.NetworkInterfaces
 
 	nics := make([]NetworkInterfaceBlock, len(networkInterfaces))
 	niconfigs := make([]NetworkInterfaceConfig, len(networkInterfaces))
 	awsconfig := make([]AWSResourceConfig, len(networkInterfaces))
-
+	associatePublicAddress := false
+	var vpcSecurityID []string
 	for index, networkInterface := range networkInterfaces {
 		nics[index].NetworkInterfaceID = functions.GetVal(networkInterface.NetworkInterfaceId)
 		nics[index].DeleteOnTermination = functions.GetVal(networkInterface.DeleteOnTermination)
@@ -98,20 +103,45 @@ func GetEC2InstanceConfig(i *ec2.Instance, instanceName string) []AWSResourceCon
 		awsconfig[index].Name = nicname
 		awsconfig[index].Resource = niconfigs[index]
 		awsconfig[index].Metadata = i.AWSCloudFormationMetadata
+		if networkInterface.AssociatePublicIpAddress != nil {
+			associatePublicAddress = associatePublicAddress || *networkInterface.AssociatePublicIpAddress
+		}
+		if networkInterface.GroupSet != nil {
+			for _, groupName := range networkInterface.GroupSet {
+				if groupName != "" {
+					vpcSecurityID = append(vpcSecurityID, groupName)
+				}
+			}
+
+		}
+	}
+	subnetID := ""
+	if i.SubnetId != nil {
+		subnetID = *i.SubnetId
+	}
+
+	if i.SecurityGroupIds != nil {
+		vpcSecurityID = append(vpcSecurityID, i.SecurityGroupIds...)
 	}
 
 	ec2Config := EC2InstanceConfig{
 		Config: Config{
-			Tags: i.Tags,
+			Tags: functions.PatchAWSTags(i.Tags),
 			Name: instanceName,
 		},
-		AMI:                 functions.GetVal(i.ImageId),
-		InstanceType:        functions.GetVal(i.InstanceType),
-		EBSOptimized:        functions.GetVal(i.EbsOptimized),
-		Monitoring:          functions.GetVal(i.Monitoring),
-		IAMInstanceProfile:  functions.GetVal(i.IamInstanceProfile),
-		VPCSecurityGroupIDs: i.SecurityGroupIds,
-		NetworkInterface:    nics,
+		AMI:                      functions.GetVal(i.ImageId),
+		InstanceType:             functions.GetVal(i.InstanceType),
+		EBSOptimized:             functions.GetVal(i.EbsOptimized),
+		Monitoring:               functions.GetVal(i.Monitoring),
+		IAMInstanceProfile:       functions.GetVal(i.IamInstanceProfile),
+		VPCSecurityGroupIDs:      vpcSecurityID,
+		NetworkInterface:         nics,
+		AssociatePublicIPAddress: associatePublicAddress,
+		SubnetID:                 subnetID,
+	}
+
+	if i.UserData != nil {
+		ec2Config.UserData = *i.UserData
 	}
 
 	if i.HibernationOptions != nil {
diff --git a/pkg/mapper/iac-providers/cft/config/ec2-vpc.go b/pkg/mapper/iac-providers/cft/config/ec2-vpc.go
index 318857d5e..bf92cf1d2 100644
--- a/pkg/mapper/iac-providers/cft/config/ec2-vpc.go
+++ b/pkg/mapper/iac-providers/cft/config/ec2-vpc.go
@@ -31,10 +31,11 @@ type Ec2VpcConfig struct {
 }
 
 // GetEc2VpcConfig returns config for Ec2Vpc
+// aws_vpc
 func GetEc2VpcConfig(v *ec2.VPC) []AWSResourceConfig {
 	cf := Ec2VpcConfig{
 		Config: Config{
-			Tags: v.Tags,
+			Tags: functions.PatchAWSTags(v.Tags),
 		},
 		CIDRBlock:          functions.GetVal(v.CidrBlock),
 		EnableDNSSupport:   functions.GetVal(v.EnableDnsSupport),
diff --git a/pkg/mapper/iac-providers/cft/config/ecr-repository.go b/pkg/mapper/iac-providers/cft/config/ecr-repository.go
index 056177f21..b62f8f710 100644
--- a/pkg/mapper/iac-providers/cft/config/ecr-repository.go
+++ b/pkg/mapper/iac-providers/cft/config/ecr-repository.go
@@ -34,6 +34,7 @@ type ImageScanningConfigurationBlock struct {
 }
 
 // GetEcrRepositoryConfig returns config for aws_ecr_repository
+// aws_ecr_repository
 func GetEcrRepositoryConfig(r *ecr.Repository) []AWSResourceConfig {
 	var imageScanningConfiguration []ImageScanningConfigurationBlock
 	if r.ImageScanningConfiguration != nil {
@@ -43,7 +44,7 @@ func GetEcrRepositoryConfig(r *ecr.Repository) []AWSResourceConfig {
 
 	cf := EcrRepositoryConfig{
 		Config: Config{
-			Tags: r.Tags,
+			Tags: functions.PatchAWSTags(r.Tags),
 			Name: functions.GetVal(r.RepositoryName),
 		},
 		ImageScanningConfiguration: imageScanningConfiguration,
diff --git a/pkg/mapper/iac-providers/cft/config/ecs-cluster.go b/pkg/mapper/iac-providers/cft/config/ecs-cluster.go
index ba4a70424..4fdbfae81 100644
--- a/pkg/mapper/iac-providers/cft/config/ecs-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/ecs-cluster.go
@@ -65,6 +65,7 @@ type EcsClusterConfig struct {
 }
 
 // GetEcsClusterConfig returns config for aws_ecs_cluster resource
+// aws_ecs_cluster
 func GetEcsClusterConfig(e *ecs.Cluster) []AWSResourceConfig {
 	var clusterSettingsData []ClusterSettingsBlock
 	var capacityProviderStrategyData []CapacityProviderStrategyBlock
@@ -87,7 +88,7 @@ func GetEcsClusterConfig(e *ecs.Cluster) []AWSResourceConfig {
 	cf := EcsClusterConfig{
 		Config: Config{
 			Name: functions.GetVal(e.ClusterName),
-			Tags: e.Tags,
+			Tags: functions.PatchAWSTags(e.Tags),
 		},
 		ClusterName:                     functions.GetVal(e.ClusterName),
 		ClusterSettings:                 clusterSettingsData,
diff --git a/pkg/mapper/iac-providers/cft/config/ecs-service.go b/pkg/mapper/iac-providers/cft/config/ecs-service.go
index f2d74d995..fb9cc3320 100644
--- a/pkg/mapper/iac-providers/cft/config/ecs-service.go
+++ b/pkg/mapper/iac-providers/cft/config/ecs-service.go
@@ -28,11 +28,12 @@ type EcsServiceConfig struct {
 }
 
 // GetEcsServiceConfig returns config for aws_ecs_service
+// aws_ecs_service
 func GetEcsServiceConfig(c *ecs.Service) []AWSResourceConfig {
 	cf := EcsServiceConfig{
 		Config: Config{
 			Name: functions.GetVal(c.ServiceName),
-			Tags: c.Tags,
+			Tags: functions.PatchAWSTags(c.Tags),
 		},
 		IamRole: functions.GetVal(c.Role),
 	}
diff --git a/pkg/mapper/iac-providers/cft/config/ecs-task-definition.go b/pkg/mapper/iac-providers/cft/config/ecs-task-definition.go
index 12468877b..b72740cd5 100644
--- a/pkg/mapper/iac-providers/cft/config/ecs-task-definition.go
+++ b/pkg/mapper/iac-providers/cft/config/ecs-task-definition.go
@@ -52,6 +52,7 @@ type EnvironmentConfig struct {
 }
 
 // GetEcsTaskDefinitionConfig returns config for aws_ecs_service and aws_ecs_task_definition
+// aws_ecs_task_definition
 func GetEcsTaskDefinitionConfig(t *ecs.TaskDefinition) []AWSResourceConfig {
 	cf := EcsTaskDefinitionConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/efs-file-system.go b/pkg/mapper/iac-providers/cft/config/efs-file-system.go
index a546236f2..3b1a692ac 100644
--- a/pkg/mapper/iac-providers/cft/config/efs-file-system.go
+++ b/pkg/mapper/iac-providers/cft/config/efs-file-system.go
@@ -42,6 +42,7 @@ type EfsFileSystemPolicyConfig struct {
 }
 
 // GetEfsFileSystemConfig returns config for aws_efs_file_system and aws_efs_file_system_policy
+// aws_efs_file_system and aws_efs_file_system_policy
 func GetEfsFileSystemConfig(f *efs.FileSystem) []AWSResourceConfig {
 
 	resourceConfigs := make([]AWSResourceConfig, 0)
diff --git a/pkg/mapper/iac-providers/cft/config/eks-cluster.go b/pkg/mapper/iac-providers/cft/config/eks-cluster.go
index 3c812f499..13beb8bfd 100644
--- a/pkg/mapper/iac-providers/cft/config/eks-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/eks-cluster.go
@@ -39,6 +39,7 @@ type EksClusterConfig struct {
 }
 
 // GetEksClusterConfig returns config for EksCluster
+// aws_eks_cluster
 func GetEksClusterConfig(c *eks.Cluster) []AWSResourceConfig {
 	var vpcConfig []EKSVPCConfigBlock
 	if c.ResourcesVpcConfig != nil {
@@ -59,13 +60,17 @@ func GetEksClusterConfig(c *eks.Cluster) []AWSResourceConfig {
 		VPCConfig: vpcConfig,
 	}
 
-	enabledTypes := c.Logging.ClusterLogging.EnabledTypes
-	if c.Logging != nil && c.Logging.ClusterLogging != nil && len(enabledTypes) > 0 {
-		enabledClusterLogTypes := make([]string, len(enabledTypes))
-		for i, enabledType := range enabledTypes {
-			enabledClusterLogTypes[i] = functions.GetVal(enabledType.Type)
+	if c.Logging != nil {
+		if c.Logging.ClusterLogging != nil {
+			enabledTypes := c.Logging.ClusterLogging.EnabledTypes
+			if len(enabledTypes) > 0 {
+				enabledClusterLogTypes := make([]string, len(enabledTypes))
+				for i, enabledType := range enabledTypes {
+					enabledClusterLogTypes[i] = functions.GetVal(enabledType.Type)
+				}
+				cf.EnabledClusterLogTypes = enabledClusterLogTypes
+			}
 		}
-		cf.EnabledClusterLogTypes = enabledClusterLogTypes
 	}
 
 	return []AWSResourceConfig{{
diff --git a/pkg/mapper/iac-providers/cft/config/eks-node-group.go b/pkg/mapper/iac-providers/cft/config/eks-node-group.go
index adfc740d5..735d4704d 100644
--- a/pkg/mapper/iac-providers/cft/config/eks-node-group.go
+++ b/pkg/mapper/iac-providers/cft/config/eks-node-group.go
@@ -40,6 +40,7 @@ type EksNodeGroupConfig struct {
 }
 
 // GetEksNodeGroupConfig returns config for EksNodeGroup
+// aws_eks_node_group
 func GetEksNodeGroupConfig(g *eks.Nodegroup) []AWSResourceConfig {
 	var scalingConfig []EksNodeGroupScalingConfigBlock
 	if g.ScalingConfig != nil {
@@ -52,7 +53,7 @@ func GetEksNodeGroupConfig(g *eks.Nodegroup) []AWSResourceConfig {
 	cf := EksNodeGroupConfig{
 		Config: Config{
 			Name: functions.GetVal(g.NodegroupName),
-			Tags: g.Tags,
+			Tags: functions.PatchAWSTags(g.Tags),
 		},
 		ClusterName:   g.ClusterName,
 		NodeGroupName: functions.GetVal(g.NodegroupName),
diff --git a/pkg/mapper/iac-providers/cft/config/elasticache-cluster.go b/pkg/mapper/iac-providers/cft/config/elasticache-cluster.go
index 793c9e56d..775bccc5f 100644
--- a/pkg/mapper/iac-providers/cft/config/elasticache-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/elasticache-cluster.go
@@ -30,10 +30,11 @@ type ElastiCacheClusterConfig struct {
 }
 
 // GetElastiCacheClusterConfig returns config for aws_elasticache_cluster
+// aws_elasticache_cluster
 func GetElastiCacheClusterConfig(e *elasticache.CacheCluster) []AWSResourceConfig {
 	cf := ElastiCacheClusterConfig{
 		Config: Config{
-			Tags: e.Tags,
+			Tags: functions.PatchAWSTags(e.Tags),
 			Name: functions.GetVal(e.ClusterName),
 		},
 		AZMode:        functions.GetVal(e.AZMode),
diff --git a/pkg/mapper/iac-providers/cft/config/elasticache-replicationgroup.go b/pkg/mapper/iac-providers/cft/config/elasticache-replicationgroup.go
index 317da07c2..811501dd6 100644
--- a/pkg/mapper/iac-providers/cft/config/elasticache-replicationgroup.go
+++ b/pkg/mapper/iac-providers/cft/config/elasticache-replicationgroup.go
@@ -29,10 +29,11 @@ type ElastiCacheReplicationGroupConfig struct {
 }
 
 // GetElastiCacheReplicationGroupConfig returns config for aws_elasticache_replication_group
+// aws_elasticache_replication_group
 func GetElastiCacheReplicationGroupConfig(r *elasticache.ReplicationGroup) []AWSResourceConfig {
 	cf := ElastiCacheReplicationGroupConfig{
 		Config: Config{
-			Tags: r.Tags,
+			Tags: functions.PatchAWSTags(r.Tags),
 		},
 		AtRestEncryptionEnabled:  functions.GetVal(r.AtRestEncryptionEnabled),
 		TransitEncryptionEnabled: functions.GetVal(r.TransitEncryptionEnabled),
diff --git a/pkg/mapper/iac-providers/cft/config/elasticloadbalancing-loadbalancer.go b/pkg/mapper/iac-providers/cft/config/elasticloadbalancing-loadbalancer.go
index aa54a8c3e..c43a20961 100644
--- a/pkg/mapper/iac-providers/cft/config/elasticloadbalancing-loadbalancer.go
+++ b/pkg/mapper/iac-providers/cft/config/elasticloadbalancing-loadbalancer.go
@@ -45,8 +45,10 @@ type ElasticLoadBalancingLoadBalancerPoliciesConfig struct {
 
 // ElasticLoadBalancingLoadBalancerConfig holds config for aws_elb
 type ElasticLoadBalancingLoadBalancerConfig struct {
-	Listeners           interface{} `json:"listener"`
-	AccessLoggingPolicy interface{} `json:"access_logs,omitempty"`
+	Listeners              interface{} `json:"listener"`
+	AccessLoggingPolicy    interface{} `json:"access_logs,omitempty"`
+	CrossZoneLoadBalancing bool        `json:"cross_zone_load_balancing,omitempty"`
+
 	Config
 }
 
@@ -62,6 +64,7 @@ type ELBListenerConfig struct {
 }
 
 // GetElasticLoadBalancingLoadBalancerConfig returns config for aws_elb
+// aws_lb
 func GetElasticLoadBalancingLoadBalancerConfig(e *elasticloadbalancing.LoadBalancer, elbname string) []AWSResourceConfig {
 	elbpolicies := make([]ElasticLoadBalancingLoadBalancerPoliciesConfig, len(e.Policies))
 	awsconfig := make([]AWSResourceConfig, len(e.Policies))
@@ -102,10 +105,16 @@ func GetElasticLoadBalancingLoadBalancerConfig(e *elasticloadbalancing.LoadBalan
 
 	cf := ElasticLoadBalancingLoadBalancerConfig{
 		Config: Config{
-			Tags: e.Tags,
+			Tags: functions.PatchAWSTags(e.Tags),
 		},
 	}
 
+	if e.CrossZone != nil {
+		cf.CrossZoneLoadBalancing = *e.CrossZone
+	} else {
+		cf.CrossZoneLoadBalancing = false
+
+	}
 	if e.AccessLoggingPolicy != nil {
 		cf.AccessLoggingPolicy = ELBAccessLoggingPolicyConfig{
 			Enabled: e.AccessLoggingPolicy.Enabled,
diff --git a/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-listener.go b/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-listener.go
index 0d26f57de..725457f2f 100644
--- a/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-listener.go
+++ b/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-listener.go
@@ -41,6 +41,7 @@ type RedirectConfig struct {
 }
 
 // GetElasticLoadBalancingV2ListenerConfig returns config for aws_lb_listener
+// aws_lb_listener
 func GetElasticLoadBalancingV2ListenerConfig(l *elasticloadbalancingv2.Listener) []AWSResourceConfig {
 	// create a listener subresource per DefaultAction defined in cft
 	// as only one default action per listener is possible in terraform
diff --git a/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-loadbalancer.go b/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-loadbalancer.go
new file mode 100644
index 000000000..d1e3a0e87
--- /dev/null
+++ b/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-loadbalancer.go
@@ -0,0 +1,117 @@
+/*
+    Copyright (C) 2022 Tenable, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+		http://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/awslabs/goformation/v7/cloudformation/elasticloadbalancingv2"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
+)
+
+// AccessLogs holds inned terraform structure for access_log attribute
+type AccessLogs struct {
+	Bucket  string
+	Prefix  string
+	Enabled bool
+}
+
+// SubnetMapping is internal struct as per terrform schema
+type SubnetMapping struct {
+	AllocationID       string `json:"allocation_id"`
+	IPv6Address        string `json:"ipv6_address"`
+	PrivateIPv4Address string `json:"private_ipv4_Address"`
+	SubnetID           string `json:"subnet_id"`
+}
+
+// ElasticLoadBalancingV2LoadBalancerConfig holds config for aws_lb as per terraform schema
+type ElasticLoadBalancingV2LoadBalancerConfig struct {
+	SecurityGroups           []string        `json:"security_groups"`
+	Subnets                  []string        `json:"subnets"`
+	LoadBalancerType         string          `json:"load_balancer_type"`
+	EnableDeletionProtection bool            `json:"enable_deletion_protection"`
+	Internal                 bool            `json:"internal"`
+	AccessLogs               AccessLogs      `json:"access_logs"`
+	EnableCrossZone          bool            `json:"enable_cross_zone_load_balancing"`
+	EnableHTTP               bool            `json:"enable_http2"`
+	SubnetMappings           []SubnetMapping `json:"subnet_mapping"`
+	Config
+}
+
+// GetElasticLoadBalancingV2LoadBalancerConfig returns config for aws_lb
+// aws_lb
+func GetElasticLoadBalancingV2LoadBalancerConfig(e *elasticloadbalancingv2.LoadBalancer, elbname string) []AWSResourceConfig {
+	awsconfig := make([]AWSResourceConfig, 0)
+	cf := ElasticLoadBalancingV2LoadBalancerConfig{
+		Config: Config{
+			Tags: functions.PatchAWSTags(e.Tags),
+			Name: *e.Name,
+		},
+		Internal: false,
+	}
+
+	cf.LoadBalancerType = "application"
+	if len(e.SecurityGroups) != 0 {
+		cf.SecurityGroups = e.SecurityGroups
+	}
+	if len(e.Subnets) != 0 {
+		cf.Subnets = e.Subnets
+	}
+	cf.SubnetMappings = make([]SubnetMapping, 0)
+	if len(e.SubnetMappings) != 0 {
+		for _, mapping := range e.SubnetMappings {
+			var subnetMapping SubnetMapping
+			if mapping.IPv6Address != nil {
+				subnetMapping.IPv6Address = *mapping.IPv6Address
+			}
+			if mapping.PrivateIPv4Address != nil {
+				subnetMapping.PrivateIPv4Address = *mapping.PrivateIPv4Address
+			}
+
+			if mapping.AllocationId != nil {
+				subnetMapping.AllocationID = *mapping.AllocationId
+			}
+			subnetMapping.SubnetID = mapping.SubnetId
+			cf.SubnetMappings = append(cf.SubnetMappings, subnetMapping)
+		}
+	}
+
+	if len(e.LoadBalancerAttributes) != 0 {
+		for _, attrib := range e.LoadBalancerAttributes {
+			if attrib.Key != nil && attrib.Value != nil {
+				switch *attrib.Key {
+				case "load_balancing.cross_zone.enabled":
+					cf.EnableCrossZone = functions.GetBoolValueFromString(*attrib.Value)
+				case "deletion_protection.enabled":
+					cf.EnableDeletionProtection = functions.GetBoolValueFromString(*attrib.Value)
+				case "routing.http2.enabled":
+					cf.EnableHTTP = functions.GetBoolValueFromString(*attrib.Value)
+				case "access_logs.s3.enabled":
+					cf.AccessLogs.Enabled = functions.GetBoolValueFromString(*attrib.Value)
+				case "access_logs.s3.bucket":
+					cf.AccessLogs.Bucket = *attrib.Value
+				case "access_logs.s3.prefix":
+					cf.AccessLogs.Prefix = *attrib.Value
+				default:
+				}
+			}
+		}
+	}
+	var awsconfigElb AWSResourceConfig
+	awsconfigElb.Resource = cf
+	awsconfigElb.Metadata = e.AWSCloudFormationMetadata
+	awsconfig = append(awsconfig, awsconfigElb)
+	return awsconfig
+}
diff --git a/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-target-group.go b/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-target-group.go
index f3c05802d..e11f2e929 100644
--- a/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-target-group.go
+++ b/pkg/mapper/iac-providers/cft/config/elasticloadbalancingv2-target-group.go
@@ -28,13 +28,14 @@ type ElasticLoadBalancingV2TargetGroupConfig struct {
 }
 
 // GetElasticLoadBalancingV2TargetGroupConfig returns config for aws_lb_target_group
+// aws_lb_target_group
 func GetElasticLoadBalancingV2TargetGroupConfig(l *elasticloadbalancingv2.TargetGroup) []AWSResourceConfig {
 	// create a listener subresource per DefaultAction defined in cft
 	// as only one default action per listener is possible in terraform
 	cf := ElasticLoadBalancingV2TargetGroupConfig{
 		Config: Config{
 			Name: functions.GetVal(l.Name),
-			Tags: l.Tags,
+			Tags: functions.PatchAWSTags(l.Tags),
 		},
 		Protocol: functions.GetVal(l.Protocol),
 	}
diff --git a/pkg/mapper/iac-providers/cft/config/elasticsearch-domain.go b/pkg/mapper/iac-providers/cft/config/elasticsearch-domain.go
index cc1862538..0a720c79b 100644
--- a/pkg/mapper/iac-providers/cft/config/elasticsearch-domain.go
+++ b/pkg/mapper/iac-providers/cft/config/elasticsearch-domain.go
@@ -61,6 +61,7 @@ type NodeToNodeEncryptionOptionsConfig struct {
 }
 
 // GetElasticsearchDomainConfig returns config for aws_elasticsearch_domain and aws_elasticsearch_domain_policy
+// aws_elasticsearch_domain and aws_elasticsearch_domain_policy
 func GetElasticsearchDomainConfig(d *elasticsearch.Domain) []AWSResourceConfig {
 	resourceConfigs := make([]AWSResourceConfig, 0)
 
@@ -68,7 +69,7 @@ func GetElasticsearchDomainConfig(d *elasticsearch.Domain) []AWSResourceConfig {
 	esDomainConfig := ElasticsearchDomainConfig{
 		Config: Config{
 			Name: functions.GetVal(d.DomainName),
-			Tags: d.Tags,
+			Tags: functions.PatchAWSTags(d.Tags),
 		},
 	}
 
diff --git a/pkg/mapper/iac-providers/cft/config/emr-cluster.go b/pkg/mapper/iac-providers/cft/config/emr-cluster.go
index 31de33ed4..0b7f02f5e 100644
--- a/pkg/mapper/iac-providers/cft/config/emr-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/emr-cluster.go
@@ -38,6 +38,7 @@ type EmrClusterConfig struct {
 }
 
 // GetEmrClusterConfig returns config for EmrCluster
+// aws_emr_cluster
 func GetEmrClusterConfig(c *emr.Cluster) []AWSResourceConfig {
 	var kerberosAttributes []KerberosAttributesBlock
 	if c.KerberosAttributes != nil {
diff --git a/pkg/mapper/iac-providers/cft/config/global-accelerator.go b/pkg/mapper/iac-providers/cft/config/global-accelerator.go
index 4001dd7aa..f9490544b 100644
--- a/pkg/mapper/iac-providers/cft/config/global-accelerator.go
+++ b/pkg/mapper/iac-providers/cft/config/global-accelerator.go
@@ -30,11 +30,12 @@ type GlobalAcceleratorConfig struct {
 }
 
 // GetGlobalAcceleratorConfig returns config for aws_globalaccelerator_accelerator resource
+// aws_globalaccelerator_accelerator
 func GetGlobalAcceleratorConfig(g *globalaccelerator.Accelerator) []AWSResourceConfig {
 	cf := GlobalAcceleratorConfig{
 		Config: Config{
 			Name: g.Name,
-			Tags: g.Tags,
+			Tags: functions.PatchAWSTags(g.Tags),
 		},
 		Name:          g.Name,
 		Enabled:       functions.GetVal(g.Enabled),
diff --git a/pkg/mapper/iac-providers/cft/config/guardduty-detector.go b/pkg/mapper/iac-providers/cft/config/guardduty-detector.go
index 99548fc83..6d6955bd6 100644
--- a/pkg/mapper/iac-providers/cft/config/guardduty-detector.go
+++ b/pkg/mapper/iac-providers/cft/config/guardduty-detector.go
@@ -27,6 +27,7 @@ type GuardDutyDetectorConfig struct {
 }
 
 // GetGuardDutyDetectorConfig returns config for aws_guardduty_detector
+// aws_guardduty_detector no policy
 func GetGuardDutyDetectorConfig(d *guardduty.Detector) []AWSResourceConfig {
 	cf := GuardDutyDetectorConfig{
 		Config: Config{},
diff --git a/pkg/mapper/iac-providers/cft/config/iam-group.go b/pkg/mapper/iac-providers/cft/config/iam-group.go
index 8183d30bb..f7fb61324 100644
--- a/pkg/mapper/iac-providers/cft/config/iam-group.go
+++ b/pkg/mapper/iac-providers/cft/config/iam-group.go
@@ -43,6 +43,7 @@ type IamGroupConfig struct {
 }
 
 // GetIamGroupConfig returns config for aws_iam_group_policy
+// aws_iam_group, aws_iam_group_policy
 func GetIamGroupConfig(r *iam.Group) []AWSResourceConfig {
 	// aws_iam_role_policy as a SubResource
 	policyConfigs := make([]AWSResourceConfig, 0)
diff --git a/pkg/mapper/iac-providers/cft/config/iam-role.go b/pkg/mapper/iac-providers/cft/config/iam-role.go
index fa48c1cf2..dd0fa86b9 100644
--- a/pkg/mapper/iac-providers/cft/config/iam-role.go
+++ b/pkg/mapper/iac-providers/cft/config/iam-role.go
@@ -43,7 +43,7 @@ type IamRolePolicyConfig struct {
 	PolicyDocument string `json:"policy"`
 }
 
-// GetIamRoleConfig returns config for aws_iam_role and aws_iam_role_policy
+// GetIamRoleConfig returns config for aws_iam_role and aws_iam_role_policy // aws_iam_role, aws_iam_role_policy
 func GetIamRoleConfig(r *iam.Role) []AWSResourceConfig {
 	resourceConfigs := make([]AWSResourceConfig, 0)
 
@@ -51,7 +51,7 @@ func GetIamRoleConfig(r *iam.Role) []AWSResourceConfig {
 	roleConfig := IamRoleConfig{
 		Config: Config{
 			Name: functions.GetVal(r.RoleName),
-			Tags: r.Tags,
+			Tags: functions.PatchAWSTags(r.Tags),
 		},
 	}
 	policyDocument, err := json.Marshal(r.AssumeRolePolicyDocument)
diff --git a/pkg/mapper/iac-providers/cft/config/iam-user.go b/pkg/mapper/iac-providers/cft/config/iam-user.go
index d9b0e2e34..3d2ba79c9 100644
--- a/pkg/mapper/iac-providers/cft/config/iam-user.go
+++ b/pkg/mapper/iac-providers/cft/config/iam-user.go
@@ -51,6 +51,7 @@ type IamUserConfig struct {
 }
 
 // GetIamUserConfig returns config for aws_iam_user, aws_iam_user_policy, aws_iam_user_login_profile
+// aws_iam_user_policy, aws_iam_user_login_profile
 func GetIamUserConfig(i *iam.User) []AWSResourceConfig {
 
 	resourceConfigs := make([]AWSResourceConfig, 0)
@@ -61,7 +62,7 @@ func GetIamUserConfig(i *iam.User) []AWSResourceConfig {
 		Resource: IamUserConfig{
 			Config: Config{
 				Name: functions.GetVal(i.UserName),
-				Tags: i.Tags,
+				Tags: functions.PatchAWSTags(i.Tags),
 			},
 			UserName: functions.GetVal(i.UserName),
 		},
diff --git a/pkg/mapper/iac-providers/cft/config/kinesis-firehose-delivery-stream.go b/pkg/mapper/iac-providers/cft/config/kinesis-firehose-delivery-stream.go
index 74551fd4c..f01c469d5 100644
--- a/pkg/mapper/iac-providers/cft/config/kinesis-firehose-delivery-stream.go
+++ b/pkg/mapper/iac-providers/cft/config/kinesis-firehose-delivery-stream.go
@@ -35,11 +35,12 @@ type KinesisFirehoseDeliveryStreamSseConfig struct {
 }
 
 // GetKinesisFirehoseDeliveryStreamConfig returns aws_kinesis_firehose_delivery_stream
+// aws_kinesis_firehose_delivery_stream
 func GetKinesisFirehoseDeliveryStreamConfig(k *kinesisfirehose.DeliveryStream) []AWSResourceConfig {
 	cf := KinesisFirehoseDeliveryStreamConfig{
 		Config: Config{
 			Name: functions.GetVal(k.DeliveryStreamName),
-			Tags: k.Tags,
+			Tags: functions.PatchAWSTags(k.Tags),
 		},
 	}
 	sseConfig := KinesisFirehoseDeliveryStreamSseConfig{}
diff --git a/pkg/mapper/iac-providers/cft/config/kinesis-stream.go b/pkg/mapper/iac-providers/cft/config/kinesis-stream.go
index 58c79a327..345b8a092 100644
--- a/pkg/mapper/iac-providers/cft/config/kinesis-stream.go
+++ b/pkg/mapper/iac-providers/cft/config/kinesis-stream.go
@@ -30,11 +30,12 @@ type KinesisStreamConfig struct {
 }
 
 // GetKinesisStreamConfig returns config for aws_kinesis_stream
+// aws_kinesis_stream
 func GetKinesisStreamConfig(k *kinesis.Stream) []AWSResourceConfig {
 	cf := KinesisStreamConfig{
 		Config: Config{
 			Name: functions.GetVal(k.Name),
-			Tags: k.Tags,
+			Tags: functions.PatchAWSTags(k.Tags),
 		},
 		Name: functions.GetVal(k.Name),
 	}
diff --git a/pkg/mapper/iac-providers/cft/config/kms-key.go b/pkg/mapper/iac-providers/cft/config/kms-key.go
index 605cbe3ee..898b5f363 100644
--- a/pkg/mapper/iac-providers/cft/config/kms-key.go
+++ b/pkg/mapper/iac-providers/cft/config/kms-key.go
@@ -34,10 +34,11 @@ type KmsKeyConfig struct {
 }
 
 // GetKmsKeyConfig returns config for aws_kms_key
+// aws_kms_key
 func GetKmsKeyConfig(k *kms.Key) []AWSResourceConfig {
 	cf := KmsKeyConfig{
 		Config: Config{
-			Tags: k.Tags,
+			Tags: functions.PatchAWSTags(k.Tags),
 		},
 		Enabled:             functions.GetVal(k.Enabled),
 		EnableKeyRotation:   functions.GetVal(k.EnableKeyRotation),
diff --git a/pkg/mapper/iac-providers/cft/config/lambda-function.go b/pkg/mapper/iac-providers/cft/config/lambda-function.go
index 0c4479c38..a6bf2da92 100644
--- a/pkg/mapper/iac-providers/cft/config/lambda-function.go
+++ b/pkg/mapper/iac-providers/cft/config/lambda-function.go
@@ -64,6 +64,7 @@ type LambdaFunctionConfig struct {
 }
 
 // GetLambdaFunctionConfig returns config for LambdaFunction
+// aws_lambda_function
 func GetLambdaFunctionConfig(sf interface{}) []AWSResourceConfig {
 	if l, ok := sf.(*lambda.Function); ok {
 		return getLambdaConfig(l)
diff --git a/pkg/mapper/iac-providers/cft/config/mq-broker.go b/pkg/mapper/iac-providers/cft/config/mq-broker.go
index 725b9c0fe..54cee5fc3 100644
--- a/pkg/mapper/iac-providers/cft/config/mq-broker.go
+++ b/pkg/mapper/iac-providers/cft/config/mq-broker.go
@@ -29,11 +29,12 @@ type MqBrokerConfig struct {
 }
 
 // GetMqBorkerConfig returns config for aws_mq_broker
+// aws_mq_broker
 func GetMqBorkerConfig(c *amazonmq.Broker) []AWSResourceConfig {
 	cf := MqBrokerConfig{
 		Config: Config{
 			Name: c.BrokerName,
-			Tags: c.Tags,
+			Tags: functions.PatchAWSTags(c.Tags),
 		},
 		PubliclyAccessible: c.PubliclyAccessible,
 	}
diff --git a/pkg/mapper/iac-providers/cft/config/msk-cluster.go b/pkg/mapper/iac-providers/cft/config/msk-cluster.go
index c8b1dab90..96e7d6a31 100644
--- a/pkg/mapper/iac-providers/cft/config/msk-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/msk-cluster.go
@@ -52,6 +52,7 @@ type MskClusterConfig struct {
 }
 
 // GetMskClusterConfig returns config for MskCluster
+// aws_msk_cluster
 func GetMskClusterConfig(c *msk.Cluster) []AWSResourceConfig {
 	var brokerNodeGroupInfo []BrokerNodeGroupInfoBlock
 	if c.BrokerNodeGroupInfo != nil {
@@ -82,7 +83,7 @@ func GetMskClusterConfig(c *msk.Cluster) []AWSResourceConfig {
 	cf := MskClusterConfig{
 		Config: Config{
 			Name: c.ClusterName,
-			Tags: c.Tags,
+			Tags: functions.PatchAWSTags(c.Tags),
 		},
 		ClusterName:         c.ClusterName,
 		KafkaVersion:        c.KafkaVersion,
diff --git a/pkg/mapper/iac-providers/cft/config/nat-gateway.go b/pkg/mapper/iac-providers/cft/config/nat-gateway.go
index 51eaf3ec9..2a3e800bf 100644
--- a/pkg/mapper/iac-providers/cft/config/nat-gateway.go
+++ b/pkg/mapper/iac-providers/cft/config/nat-gateway.go
@@ -30,10 +30,11 @@ type NatGatewayConfig struct {
 }
 
 // GetNatGatewayConfig returns config for aws_nat_gateway
+// aws_nat_gateway
 func GetNatGatewayConfig(e *ec2.NatGateway) []AWSResourceConfig {
 	cf := NatGatewayConfig{
 		Config: Config{
-			Tags: e.Tags,
+			Tags: functions.PatchAWSTags(e.Tags),
 		},
 		AllocationID:     functions.GetVal(e.AllocationId),
 		ConnectivityType: functions.GetVal(e.ConnectivityType),
diff --git a/pkg/mapper/iac-providers/cft/config/neptune-cluster-instance.go b/pkg/mapper/iac-providers/cft/config/neptune-cluster-instance.go
index 4f4852672..e38707f99 100644
--- a/pkg/mapper/iac-providers/cft/config/neptune-cluster-instance.go
+++ b/pkg/mapper/iac-providers/cft/config/neptune-cluster-instance.go
@@ -34,10 +34,11 @@ type NeptuneClusterInstanceConfig struct {
 }
 
 // GetNeptuneClusterInstanceConfig returns config for aws_neptune_cluster_instance resource
+// aws_neptune_cluster_instance
 func GetNeptuneClusterInstanceConfig(n *neptune.DBInstance) []AWSResourceConfig {
 	cf := NeptuneClusterInstanceConfig{
 		Config: Config{
-			Tags: n.Tags,
+			Tags: functions.PatchAWSTags(n.Tags),
 		},
 		AutoMinorVersionUpgrade:    functions.GetVal(n.AutoMinorVersionUpgrade),
 		AvailabilityZone:           functions.GetVal(n.AvailabilityZone),
diff --git a/pkg/mapper/iac-providers/cft/config/neptune-cluster.go b/pkg/mapper/iac-providers/cft/config/neptune-cluster.go
index 223564b3e..da8686665 100644
--- a/pkg/mapper/iac-providers/cft/config/neptune-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/neptune-cluster.go
@@ -29,10 +29,11 @@ type NeptuneClusterConfig struct {
 }
 
 // GetNeptuneClusterConfig returns config for aws_neptune_cluster
+// aws_neptune_cluster
 func GetNeptuneClusterConfig(d *neptune.DBCluster) []AWSResourceConfig {
 	cf := NeptuneClusterConfig{
 		Config: Config{
-			Tags: d.Tags,
+			Tags: functions.PatchAWSTags(d.Tags),
 		},
 		StorageEncrypted:            functions.GetVal(d.StorageEncrypted),
 		EnableCloudwatchLogsExports: d.EnableCloudwatchLogsExports,
diff --git a/pkg/mapper/iac-providers/cft/config/qldb-ledger.go b/pkg/mapper/iac-providers/cft/config/qldb-ledger.go
index 93ee211f7..3a075955b 100644
--- a/pkg/mapper/iac-providers/cft/config/qldb-ledger.go
+++ b/pkg/mapper/iac-providers/cft/config/qldb-ledger.go
@@ -30,12 +30,13 @@ type QldbLedgerConfig struct {
 }
 
 // GetQldbLedgerConfig returns config for aws_qldb_ledger resource
+// aws_qldb_ledger
 func GetQldbLedgerConfig(q *qldb.Ledger) []AWSResourceConfig {
 
 	cf := QldbLedgerConfig{
 		Config: Config{
 			Name: functions.GetVal(q.Name),
-			Tags: q.Tags,
+			Tags: functions.PatchAWSTags(q.Tags),
 		},
 		Name:               functions.GetVal(q.Name),
 		PermissionsMode:    q.PermissionsMode,
diff --git a/pkg/mapper/iac-providers/cft/config/ram-resource-share.go b/pkg/mapper/iac-providers/cft/config/ram-resource-share.go
index 46f2369f5..451da7eb3 100644
--- a/pkg/mapper/iac-providers/cft/config/ram-resource-share.go
+++ b/pkg/mapper/iac-providers/cft/config/ram-resource-share.go
@@ -29,11 +29,12 @@ type RAMResourceShareConfig struct {
 }
 
 // GetRAMResourceShareConfig returns config for RAMResourceShare
+// aws_ram_resource_share
 func GetRAMResourceShareConfig(r *ram.ResourceShare) []AWSResourceConfig {
 	cf := RAMResourceShareConfig{
 		Config: Config{
 			Name: r.Name,
-			Tags: r.Tags,
+			Tags: functions.PatchAWSTags(r.Tags),
 		},
 		Name:                    r.Name,
 		AllowExternalPrincipals: functions.GetVal(r.AllowExternalPrincipals),
diff --git a/pkg/mapper/iac-providers/cft/config/rds-cluster.go b/pkg/mapper/iac-providers/cft/config/rds-cluster.go
index bb4ae93e6..a440c9855 100644
--- a/pkg/mapper/iac-providers/cft/config/rds-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/rds-cluster.go
@@ -21,22 +21,52 @@ import (
 	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
+// ScalingConfig holds Scalingconfig for aws_rds_cluster
+type ScalingConfig struct {
+	AutoPause             bool   `json:"auto_pause"`
+	MaxCapacity           int    `json:"max_capacity"`
+	MinCapacity           int    `json:"min_capacity"`
+	SecondsUntilAutoPause int    `json:"seconds_until_auto_pause"`
+	TimeOutAction         string `json:"timeout_Action"`
+}
+
 // RDSClusterConfig holds config for aws_rds_cluster
 type RDSClusterConfig struct {
 	Config
-	BackupRetentionPeriod int  `json:"backup_retention_period,omitempty"`
-	StorageEncrypted      bool `json:"storage_encrypted"`
+	BackupRetentionPeriod int           `json:"backup_retention_period,omitempty"`
+	StorageEncrypted      bool          `json:"storage_encrypted"`
+	ScalingConfiguration  ScalingConfig `json:"scaling_configuration"`
 }
 
 // GetRDSClusterConfig returns config for aws_rds_cluster
+// aws_rds_cluster
 func GetRDSClusterConfig(c *rds.DBCluster) []AWSResourceConfig {
+	var scalingConfigData ScalingConfig
+
+	if c.EngineMode != nil {
+		if *c.EngineMode == "serverless" && c.ScalingConfiguration != nil {
+			if c.ScalingConfiguration.MaxCapacity != nil {
+				scalingConfigData.MaxCapacity = *c.ScalingConfiguration.MaxCapacity
+			}
+			if c.ScalingConfiguration.MinCapacity != nil {
+				scalingConfigData.MinCapacity = *c.ScalingConfiguration.MinCapacity
+			}
+			if c.ScalingConfiguration.AutoPause != nil {
+				scalingConfigData.AutoPause = *c.ScalingConfiguration.AutoPause
+			}
+			if c.ScalingConfiguration.SecondsUntilAutoPause != nil {
+				scalingConfigData.SecondsUntilAutoPause = *c.ScalingConfiguration.SecondsUntilAutoPause
+			}
+		}
+	}
 	cf := RDSClusterConfig{
 		Config: Config{
 			Name: functions.GetVal(c.DatabaseName),
-			Tags: c.Tags,
+			Tags: functions.PatchAWSTags(c.Tags),
 		},
 		BackupRetentionPeriod: functions.GetVal(c.BackupRetentionPeriod),
 		StorageEncrypted:      functions.GetVal(c.StorageEncrypted),
+		ScalingConfiguration:  scalingConfigData,
 	}
 	return []AWSResourceConfig{{
 		Resource: cf,
diff --git a/pkg/mapper/iac-providers/cft/config/redshift-cluster.go b/pkg/mapper/iac-providers/cft/config/redshift-cluster.go
index 700cd2d68..cca196b1d 100644
--- a/pkg/mapper/iac-providers/cft/config/redshift-cluster.go
+++ b/pkg/mapper/iac-providers/cft/config/redshift-cluster.go
@@ -31,11 +31,12 @@ type RedshiftClusterConfig struct {
 }
 
 // GetRedshiftClusterConfig returns config for aws_redshift_cluster
+// aws_redshift_cluster
 func GetRedshiftClusterConfig(c *redshift.Cluster) []AWSResourceConfig {
 	cf := RedshiftClusterConfig{
 		Config: Config{
 			Name: c.DBName,
-			Tags: c.Tags,
+			Tags: functions.PatchAWSTags(c.Tags),
 		},
 		KmsKeyID:           functions.GetVal(c.KmsKeyId),
 		Encrypted:          functions.GetVal(c.Encrypted),
diff --git a/pkg/mapper/iac-providers/cft/config/redshift-parameter-group.go b/pkg/mapper/iac-providers/cft/config/redshift-parameter-group.go
index 0aee3987f..3f9c48622 100644
--- a/pkg/mapper/iac-providers/cft/config/redshift-parameter-group.go
+++ b/pkg/mapper/iac-providers/cft/config/redshift-parameter-group.go
@@ -18,6 +18,7 @@ package config
 
 import (
 	"github.com/awslabs/goformation/v7/cloudformation/redshift"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 // ParameterBlock holds config for Parameter
@@ -36,6 +37,7 @@ type RedshiftParameterGroupConfig struct {
 }
 
 // GetRedshiftParameterGroupConfig returns config for RedshiftParameterGroup
+// aws_redshift_parameter_group
 func GetRedshiftParameterGroupConfig(p *redshift.ClusterParameterGroup, paramGroupName string) []AWSResourceConfig {
 	var parameterBlock []ParameterBlock
 	if p.Parameters != nil {
@@ -49,7 +51,7 @@ func GetRedshiftParameterGroupConfig(p *redshift.ClusterParameterGroup, paramGro
 	cf := RedshiftParameterGroupConfig{
 		Config: Config{
 			Name: paramGroupName,
-			Tags: p.Tags,
+			Tags: functions.PatchAWSTags(p.Tags),
 		},
 		Name:        paramGroupName,
 		Description: p.Description,
diff --git a/pkg/mapper/iac-providers/cft/config/route-table-association.go b/pkg/mapper/iac-providers/cft/config/route-table-association.go
index 1733216b9..0c130a563 100644
--- a/pkg/mapper/iac-providers/cft/config/route-table-association.go
+++ b/pkg/mapper/iac-providers/cft/config/route-table-association.go
@@ -28,6 +28,7 @@ type RouteTableAssociationConfig struct {
 }
 
 // GetRouteTableAssociationConfig returns config for aws_route_table_association
+// aws_route_table_association
 func GetRouteTableAssociationConfig(e *ec2.SubnetRouteTableAssociation) []AWSResourceConfig {
 	cf := RouteTableAssociationConfig{
 		RouteTableID: e.RouteTableId,
diff --git a/pkg/mapper/iac-providers/cft/config/route-table.go b/pkg/mapper/iac-providers/cft/config/route-table.go
index 0dd9377f2..adbd78d52 100644
--- a/pkg/mapper/iac-providers/cft/config/route-table.go
+++ b/pkg/mapper/iac-providers/cft/config/route-table.go
@@ -18,6 +18,7 @@ package config
 
 import (
 	"github.com/awslabs/goformation/v7/cloudformation/ec2"
+	"github.com/tenable/terrascan/pkg/mapper/iac-providers/cft/functions"
 )
 
 // RouteTableConfig holds config for aws_route_table
@@ -27,10 +28,11 @@ type RouteTableConfig struct {
 }
 
 // GetRouteTableConfig returns config for aws_route_table
+// aws_route_table
 func GetRouteTableConfig(e *ec2.RouteTable) []AWSResourceConfig {
 	cf := RouteTableConfig{
 		Config: Config{
-			Tags: e.Tags,
+			Tags: functions.PatchAWSTags(e.Tags),
 		},
 		VpcID: e.VpcId,
 	}
diff --git a/pkg/mapper/iac-providers/cft/config/route.go b/pkg/mapper/iac-providers/cft/config/route.go
index e8c7150a8..74beab0d2 100644
--- a/pkg/mapper/iac-providers/cft/config/route.go
+++ b/pkg/mapper/iac-providers/cft/config/route.go
@@ -40,6 +40,7 @@ type RouteConfig struct {
 }
 
 // GetRouteConfig returns config for aws_route
+// aws_route no pilicy
 func GetRouteConfig(e *ec2.Route) []AWSResourceConfig {
 	cf := RouteConfig{
 		CarrierGatewayID:            functions.GetVal(e.CarrierGatewayId),
diff --git a/pkg/mapper/iac-providers/cft/config/route53-record.go b/pkg/mapper/iac-providers/cft/config/route53-record.go
index fddb16ec9..da0073c7e 100644
--- a/pkg/mapper/iac-providers/cft/config/route53-record.go
+++ b/pkg/mapper/iac-providers/cft/config/route53-record.go
@@ -27,6 +27,7 @@ type Route53RecordConfig struct {
 }
 
 // GetRoute53RecordConfig returns config for aws_route53_record
+// aws_route53_record
 func GetRoute53RecordConfig(r *route53.RecordSet) []AWSResourceConfig {
 	cf := Route53RecordConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/s3-bucket-policy.go b/pkg/mapper/iac-providers/cft/config/s3-bucket-policy.go
index 6ac391dd9..3bcd2f691 100644
--- a/pkg/mapper/iac-providers/cft/config/s3-bucket-policy.go
+++ b/pkg/mapper/iac-providers/cft/config/s3-bucket-policy.go
@@ -30,6 +30,7 @@ type S3BucketPolicyConfig struct {
 }
 
 // GetS3BucketPolicyConfig returns config for aws_s3_bucket_policy
+// aws_s3_bucket_policy
 func GetS3BucketPolicyConfig(p *s3.BucketPolicy) []AWSResourceConfig {
 	cf := S3BucketPolicyConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/s3-bucket.go b/pkg/mapper/iac-providers/cft/config/s3-bucket.go
index 7aa7a239f..e44419634 100644
--- a/pkg/mapper/iac-providers/cft/config/s3-bucket.go
+++ b/pkg/mapper/iac-providers/cft/config/s3-bucket.go
@@ -27,21 +27,33 @@ import (
 const (
 	// PublicAccessBlock represents subresource aws_s3_bucket_public_access_block for attribute PublicAccessBlockConfiguration
 	PublicAccessBlock = "PublicAccessBlock"
+	// ServerSideEncription represents subresource aws_s3_bucket for attribute aws_s3_bucket_server_side_encryption_configuration
+	ServerSideEncription = "ServerSideEncription"
+	// Versioning represents subresource aws_s3_bucket for attribute aws_s3_bucket_versioning
+	Versioning = "Versioning"
 )
 
+// BucketConfig holds common config for aws_s3_bucket
+type BucketConfig struct {
+	Config
+	ProviderVersion string `json:"provider_version"`
+}
+
 // S3BucketConfig holds config for aws_s3_bucket
 type S3BucketConfig struct {
-	Config
-	Bucket               string                       `json:"bucket"`
-	AccessControl        string                       `json:"acl"`
-	BucketEncryption     []ServerSideEncryptionConfig `json:"server_side_encryption_configuration,omitempty"`
-	Logging              []LoggingConfig              `json:"logging"`
-	WebsiteConfiguration []WebsiteConfig              `json:"website"`
-	Versioning           []VersioningConfig           `json:"versioning,omitempty"`
+	BucketConfig
+	Bucket        string `json:"bucket"`
+	AccessControl string `json:"acl"`
+	// BucketEncryption     []ServerSideEncryptionConfig `json:"server_side_encryption_configuration,omitempty"`
+	Logging              []LoggingConfig    `json:"logging"`
+	WebsiteConfiguration []WebsiteConfig    `json:"website"`
+	Versioning           []VersioningConfig `json:"versioning,omitempty"`
 }
 
 // ServerSideEncryptionConfig holds config for server_side_encryption_configuration
 type ServerSideEncryptionConfig struct {
+	BucketConfig
+	Bucket                            string                     `json:"bucket"`
 	ServerSideEncryptionConfiguration []ServerSideEncryptionRule `json:"rule"`
 }
 
@@ -78,7 +90,7 @@ type VersioningConfig struct {
 
 // S3BucketPublicAccessBlockConfig holds config for aws_s3_bucket_public_access_block
 type S3BucketPublicAccessBlockConfig struct {
-	Config
+	BucketConfig
 	Bucket                string `json:"bucket"`
 	BlockPublicAcls       bool   `json:"block_public_acls"`
 	BlockPublicPolicy     bool   `json:"block_public_policy"`
@@ -87,37 +99,21 @@ type S3BucketPublicAccessBlockConfig struct {
 }
 
 // GetS3BucketConfig returns config for aws_s3_bucket
-func GetS3BucketConfig(s *s3.Bucket) []AWSResourceConfig {
+func GetS3BucketConfig(s *s3.Bucket, resourceName string) []AWSResourceConfig {
 	resourceConfigs := make([]AWSResourceConfig, 0)
 
 	cf := S3BucketConfig{
-		Config: Config{
-			Name: functions.GetVal(s.BucketName),
-			Tags: s.Tags,
+		BucketConfig: BucketConfig{
+			Config: Config{
+				Name: functions.GetVal(s.BucketName),
+				Tags: s.Tags,
+			},
+			ProviderVersion: "5.0.0",
 		},
 		Bucket:        functions.GetVal(s.BucketName),
 		AccessControl: strings.ToLower(functions.GetVal(s.AccessControl)),
 	}
 
-	// add sse configurations
-	if s.BucketEncryption != nil {
-		sseRules := make([]ServerSideEncryptionRule, 0)
-		for _, sseRule := range s.BucketEncryption.ServerSideEncryptionConfiguration {
-			if sseRule.ServerSideEncryptionByDefault != nil {
-				defaultConfig := DefaultSSEConfig{
-					KMSMasterKeyID: functions.GetVal(sseRule.ServerSideEncryptionByDefault.KMSMasterKeyID),
-					SSEAlgorithm:   sseRule.ServerSideEncryptionByDefault.SSEAlgorithm,
-				}
-				sseRules = append(sseRules, ServerSideEncryptionRule{
-					ServerSideEncryptionByDefault: []DefaultSSEConfig{defaultConfig},
-				})
-			}
-		}
-		cf.BucketEncryption = []ServerSideEncryptionConfig{{
-			ServerSideEncryptionConfiguration: sseRules,
-		}}
-	}
-
 	// add logging configurations
 	if s.LoggingConfiguration != nil {
 		cf.Logging = []LoggingConfig{{
@@ -151,16 +147,21 @@ func GetS3BucketConfig(s *s3.Bucket) []AWSResourceConfig {
 	resourceConfigs = append(resourceConfigs, AWSResourceConfig{
 		Resource: cf,
 		Metadata: s.AWSCloudFormationMetadata,
+		Name:     resourceName,
 	})
 
 	// add aws_s3_bucket_public_access_block
 	if s.PublicAccessBlockConfiguration != nil {
 		resourceConfigs = append(resourceConfigs, AWSResourceConfig{
 			Resource: S3BucketPublicAccessBlockConfig{
-				Config: Config{
-					Name: functions.GetVal(s.BucketName),
+				BucketConfig: BucketConfig{
+					Config: Config{
+						Name: functions.GetVal(s.BucketName),
+						Tags: s.Tags,
+					},
+					ProviderVersion: "5.0.0",
 				},
-				Bucket:                fmt.Sprintf("aws_s3_bucket.%s", functions.GetVal(s.BucketName)),
+				Bucket:                fmt.Sprintf("aws_s3_bucket.%s", resourceName),
 				BlockPublicAcls:       functions.GetVal(s.PublicAccessBlockConfiguration.BlockPublicAcls),
 				BlockPublicPolicy:     functions.GetVal(s.PublicAccessBlockConfiguration.BlockPublicPolicy),
 				IgnorePublicAcls:      functions.GetVal(s.PublicAccessBlockConfiguration.IgnorePublicAcls),
@@ -172,5 +173,40 @@ func GetS3BucketConfig(s *s3.Bucket) []AWSResourceConfig {
 		})
 	}
 
+	// add aws_s3_bucket_server_side_encryption_configuration
+	if s.BucketEncryption != nil {
+		sseRules2 := make([]ServerSideEncryptionRule, 0)
+		for _, sseRule := range s.BucketEncryption.ServerSideEncryptionConfiguration {
+
+			if sseRule.ServerSideEncryptionByDefault != nil {
+
+				defaultConfig := DefaultSSEConfig{
+					KMSMasterKeyID: functions.GetVal(sseRule.ServerSideEncryptionByDefault.KMSMasterKeyID),
+					SSEAlgorithm:   sseRule.ServerSideEncryptionByDefault.SSEAlgorithm,
+				}
+				sseRules2 = append(sseRules2, ServerSideEncryptionRule{
+					BucketKeyEnabled:              functions.GetVal(sseRule.BucketKeyEnabled),
+					ServerSideEncryptionByDefault: []DefaultSSEConfig{defaultConfig},
+				})
+			}
+		}
+		resourceConfigs = append(resourceConfigs, AWSResourceConfig{
+			Resource: ServerSideEncryptionConfig{
+				BucketConfig: BucketConfig{
+					Config: Config{
+						Name: functions.GetVal(s.BucketName),
+						Tags: s.Tags,
+					},
+					ProviderVersion: "5.0.0",
+				},
+				Bucket:                            fmt.Sprintf("aws_s3_bucket.%s", resourceName),
+				ServerSideEncryptionConfiguration: sseRules2,
+			},
+			Metadata: s.AWSCloudFormationMetadata,
+			Type:     ServerSideEncription,
+			Name:     functions.GetVal(s.BucketName),
+		})
+	}
+
 	return resourceConfigs
 }
diff --git a/pkg/mapper/iac-providers/cft/config/sagemaker-model.go b/pkg/mapper/iac-providers/cft/config/sagemaker-model.go
index dd8212dd6..c2f090f43 100644
--- a/pkg/mapper/iac-providers/cft/config/sagemaker-model.go
+++ b/pkg/mapper/iac-providers/cft/config/sagemaker-model.go
@@ -46,6 +46,7 @@ type SagemakerModelConfig struct {
 }
 
 // GetSagemakerModelConfig returns config for SagemakerModel
+// aws_sagemaker_model
 func GetSagemakerModelConfig(m *sagemaker.Model) []AWSResourceConfig {
 	var containerBlock []ContainerBlock
 	if m.Containers != nil {
@@ -64,7 +65,7 @@ func GetSagemakerModelConfig(m *sagemaker.Model) []AWSResourceConfig {
 	cf := SagemakerModelConfig{
 		Config: Config{
 			Name: functions.GetVal(m.ModelName),
-			Tags: m.Tags,
+			Tags: functions.PatchAWSTags(m.Tags),
 		},
 		Name:             functions.GetVal(m.ModelName),
 		ExecutionRoleARN: m.ExecutionRoleArn,
diff --git a/pkg/mapper/iac-providers/cft/config/sagemaker-notebookinstance.go b/pkg/mapper/iac-providers/cft/config/sagemaker-notebookinstance.go
index bbb1b31a1..e9d6e3b7c 100644
--- a/pkg/mapper/iac-providers/cft/config/sagemaker-notebookinstance.go
+++ b/pkg/mapper/iac-providers/cft/config/sagemaker-notebookinstance.go
@@ -33,11 +33,12 @@ type SagemakerNotebookInstanceConfig struct {
 }
 
 // GetSagemakerNotebookInstanceConfig returns config for SagemakerNotebookInstance
+// aws_sagemaker_notebook_instance
 func GetSagemakerNotebookInstanceConfig(n *sagemaker.NotebookInstance) []AWSResourceConfig {
 	cf := SagemakerNotebookInstanceConfig{
 		Config: Config{
 			Name: functions.GetVal(n.NotebookInstanceName),
-			Tags: n.Tags,
+			Tags: functions.PatchAWSTags(n.Tags),
 		},
 		Name:                 functions.GetVal(n.NotebookInstanceName),
 		RoleARN:              n.RoleArn,
diff --git a/pkg/mapper/iac-providers/cft/config/secretsmanager-secret-policy.go b/pkg/mapper/iac-providers/cft/config/secretsmanager-secret-policy.go
index fdf0537f1..ba98ffcf9 100644
--- a/pkg/mapper/iac-providers/cft/config/secretsmanager-secret-policy.go
+++ b/pkg/mapper/iac-providers/cft/config/secretsmanager-secret-policy.go
@@ -29,6 +29,7 @@ type SecretsManagerSecretPolicyConfig struct {
 }
 
 // GetSecretsManagerSecretPolicyConfig returns config for aws_secretsmanager_secret_policy
+// aws_secretsmanager_secret_policy
 func GetSecretsManagerSecretPolicyConfig(s *secretsmanager.ResourcePolicy) []AWSResourceConfig {
 	cf := SecretsManagerSecretPolicyConfig{}
 	policy, err := json.Marshal(s.ResourcePolicy)
diff --git a/pkg/mapper/iac-providers/cft/config/secretsmanager-secret-rotation.go b/pkg/mapper/iac-providers/cft/config/secretsmanager-secret-rotation.go
index 55576419a..021466fdb 100644
--- a/pkg/mapper/iac-providers/cft/config/secretsmanager-secret-rotation.go
+++ b/pkg/mapper/iac-providers/cft/config/secretsmanager-secret-rotation.go
@@ -35,6 +35,7 @@ type SecretsManagerSecretRotationConfig struct {
 }
 
 // GetSecretsManagerSecretRotationConfig returns config for SecretsManagerSecretRotation
+// aws_secretsmanager_secret_rotation no policy
 func GetSecretsManagerSecretRotationConfig(r *secretsmanager.RotationSchedule) []AWSResourceConfig {
 	var rotationRules []SecretRotationRulesBlock
 	if r.RotationRules != nil {
diff --git a/pkg/mapper/iac-providers/cft/config/secretsmanager-secret.go b/pkg/mapper/iac-providers/cft/config/secretsmanager-secret.go
index 902b4ea96..4d1a46306 100644
--- a/pkg/mapper/iac-providers/cft/config/secretsmanager-secret.go
+++ b/pkg/mapper/iac-providers/cft/config/secretsmanager-secret.go
@@ -28,10 +28,11 @@ type SecretsManagerSecretConfig struct {
 }
 
 // GetSecretsManagerSecretConfig returns config for aws_secretsmanager_secret
+// aws_secretsmanager_secret
 func GetSecretsManagerSecretConfig(s *secretsmanager.Secret) []AWSResourceConfig {
 	cf := SecretsManagerSecretConfig{
 		Config: Config{
-			Tags: s.Tags,
+			Tags: functions.PatchAWSTags(s.Tags),
 			Name: functions.GetVal(s.Name),
 		},
 		KmsKeyID: functions.GetVal(s.KmsKeyId),
diff --git a/pkg/mapper/iac-providers/cft/config/security-group.go b/pkg/mapper/iac-providers/cft/config/security-group.go
index 0d767a750..deb36f660 100644
--- a/pkg/mapper/iac-providers/cft/config/security-group.go
+++ b/pkg/mapper/iac-providers/cft/config/security-group.go
@@ -41,11 +41,12 @@ type SecurityGroupConfig struct {
 }
 
 // GetSecurityGroupConfig returns config for aws_security_group
+// aws_security_group
 func GetSecurityGroupConfig(s *ec2.SecurityGroup) []AWSResourceConfig {
 	cf := SecurityGroupConfig{
 		Config: Config{
 			Name: functions.GetVal(s.GroupName),
-			Tags: s.Tags,
+			Tags: functions.PatchAWSTags(s.Tags),
 		},
 		GroupName:        functions.GetVal(s.GroupName),
 		GroupDescription: s.GroupDescription,
@@ -75,9 +76,17 @@ func getIngressEgress(ie any) IngressEgress {
 	if egress, ok := ie.(*ec2.SecurityGroup_Egress); ok {
 		return getEgress(egress)
 	}
+	if egress, ok := ie.(ec2.SecurityGroup_Egress); ok {
+		return getEgress(&egress)
+	}
+
 	if ingress, ok := ie.(*ec2.SecurityGroup_Ingress); ok {
 		return getIngress(ingress)
 	}
+
+	if ingress, ok := ie.(ec2.SecurityGroup_Ingress); ok {
+		return getIngress(&ingress)
+	}
 	return IngressEgress{}
 }
 
diff --git a/pkg/mapper/iac-providers/cft/config/sns-topic-policy.go b/pkg/mapper/iac-providers/cft/config/sns-topic-policy.go
index b1c9bfe0c..bcdcfbb36 100644
--- a/pkg/mapper/iac-providers/cft/config/sns-topic-policy.go
+++ b/pkg/mapper/iac-providers/cft/config/sns-topic-policy.go
@@ -30,6 +30,7 @@ type SnsTopicPolicyConfig struct {
 }
 
 // GetSnsTopicPolicyConfig returns config for SnsTopicPolicy
+// aws_sns_topic_policy
 func GetSnsTopicPolicyConfig(p *sns.TopicPolicy) []AWSResourceConfig {
 	policyDoc, _ := json.Marshal(p.PolicyDocument)
 
diff --git a/pkg/mapper/iac-providers/cft/config/sns-topic.go b/pkg/mapper/iac-providers/cft/config/sns-topic.go
index a10d208a6..a2c8db450 100644
--- a/pkg/mapper/iac-providers/cft/config/sns-topic.go
+++ b/pkg/mapper/iac-providers/cft/config/sns-topic.go
@@ -29,6 +29,7 @@ type SnsTopicConfig struct {
 }
 
 // GetSnsTopicConfig returns config for SnsTopic
+// aws_sns_topic
 func GetSnsTopicConfig(t *sns.Topic) []AWSResourceConfig {
 	cf := SnsTopicConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/sqs-queue-policy.go b/pkg/mapper/iac-providers/cft/config/sqs-queue-policy.go
index d8dd8383c..6b30b9793 100644
--- a/pkg/mapper/iac-providers/cft/config/sqs-queue-policy.go
+++ b/pkg/mapper/iac-providers/cft/config/sqs-queue-policy.go
@@ -30,6 +30,7 @@ type SqsQueuePolicyConfig struct {
 }
 
 // GetSqsQueuePolicyConfig returns config for SqsQueuePolicy
+// aws_sqs_queue_policy no policy
 func GetSqsQueuePolicyConfig(p *sqs.QueuePolicy) []AWSResourceConfig {
 	policyDoc, _ := json.Marshal(p.PolicyDocument)
 
diff --git a/pkg/mapper/iac-providers/cft/config/sqs-queue.go b/pkg/mapper/iac-providers/cft/config/sqs-queue.go
index b6af9ea8e..ac4736e37 100644
--- a/pkg/mapper/iac-providers/cft/config/sqs-queue.go
+++ b/pkg/mapper/iac-providers/cft/config/sqs-queue.go
@@ -31,6 +31,7 @@ type SqsQueueConfig struct {
 }
 
 // GetSqsQueueConfig returns config for SqsQueue
+// aws_sqs_queue
 func GetSqsQueueConfig(q *sqs.Queue) []AWSResourceConfig {
 	cf := SqsQueueConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/config/ssm-parameter.go b/pkg/mapper/iac-providers/cft/config/ssm-parameter.go
index b3dfc4d89..ff44cd656 100644
--- a/pkg/mapper/iac-providers/cft/config/ssm-parameter.go
+++ b/pkg/mapper/iac-providers/cft/config/ssm-parameter.go
@@ -33,16 +33,24 @@ type SSMParameterConfig struct {
 }
 
 // GetSSMParameterConfig returns config for SSM Parameter
+// aws_ssm_parameter no policy
 func GetSSMParameterConfig(b *ssm.Parameter) []AWSResourceConfig {
+	if b == nil {
+		cf := SSMParameterConfig{Config: Config{}}
+		return []AWSResourceConfig{{
+			Resource: cf,
+		}}
+	}
 	cf := SSMParameterConfig{
-		Config: Config{
-			Name: *b.Name,
-			Tags: b.Tags,
-		},
-		Name:  *b.Name,
-		Type:  b.Type,
-		Value: b.Value,
+		Config: Config{},
+		Type:   b.Type,
+		Value:  b.Value,
+	}
+	if b.Name != nil {
+		cf.Name = *b.Name
+		cf.Config.Name = *b.Name
 	}
+
 	if b.Description != nil {
 		cf.Description = *b.Description
 	}
@@ -56,6 +64,10 @@ func GetSSMParameterConfig(b *ssm.Parameter) []AWSResourceConfig {
 		cf.AllowedPattern = *b.AllowedPattern
 	}
 
+	if b.Tags != nil {
+		cf.Tags = b.Tags
+	}
+
 	return []AWSResourceConfig{{
 		Resource: cf,
 		Metadata: b.AWSCloudFormationMetadata,
diff --git a/pkg/mapper/iac-providers/cft/config/subnet.go b/pkg/mapper/iac-providers/cft/config/subnet.go
index b09273b53..3fe9b71a7 100644
--- a/pkg/mapper/iac-providers/cft/config/subnet.go
+++ b/pkg/mapper/iac-providers/cft/config/subnet.go
@@ -34,10 +34,11 @@ type SubnetConfig struct {
 }
 
 // GetSubnetConfig returns config for aws_subnet
+// aws_subnet
 func GetSubnetConfig(e *ec2.Subnet) []AWSResourceConfig {
 	cf := SubnetConfig{
 		Config: Config{
-			Tags: e.Tags,
+			Tags: functions.PatchAWSTags(e.Tags),
 		},
 		AssignIpv6AddressOnCreation: functions.GetVal(e.AssignIpv6AddressOnCreation),
 		AvailabilityZone:            functions.GetVal(e.AvailabilityZone),
diff --git a/pkg/mapper/iac-providers/cft/config/waf-size-constraint-set.go b/pkg/mapper/iac-providers/cft/config/waf-size-constraint-set.go
index 795bed658..734ace071 100644
--- a/pkg/mapper/iac-providers/cft/config/waf-size-constraint-set.go
+++ b/pkg/mapper/iac-providers/cft/config/waf-size-constraint-set.go
@@ -43,6 +43,7 @@ type WafSizeConstraintSetConfig struct {
 }
 
 // GetWafSizeConstraintSetConfig returns config for aws_waf_size_constraint_set
+// aws_waf_size_constraint_set
 func GetWafSizeConstraintSetConfig(w *waf.SizeConstraintSet) []AWSResourceConfig {
 	sizeConstraintSet := setSizeConstraintSet(w)
 
diff --git a/pkg/mapper/iac-providers/cft/config/workspaces-workspace.go b/pkg/mapper/iac-providers/cft/config/workspaces-workspace.go
index b70dc75de..dba9c3020 100644
--- a/pkg/mapper/iac-providers/cft/config/workspaces-workspace.go
+++ b/pkg/mapper/iac-providers/cft/config/workspaces-workspace.go
@@ -29,6 +29,7 @@ type WorkspacesWorkspaceConfig struct {
 }
 
 // GetWorkspacesWorkspaceConfig returns config for aws_workspaces_workspace
+// aws_workspaces_workspace
 func GetWorkspacesWorkspaceConfig(w *workspaces.Workspace) []AWSResourceConfig {
 	cf := WorkspacesWorkspaceConfig{
 		Config: Config{
diff --git a/pkg/mapper/iac-providers/cft/functions/util.go b/pkg/mapper/iac-providers/cft/functions/util.go
index c91ca10f1..80e1d2575 100644
--- a/pkg/mapper/iac-providers/cft/functions/util.go
+++ b/pkg/mapper/iac-providers/cft/functions/util.go
@@ -16,6 +16,10 @@
 
 package functions
 
+import (
+	"encoding/json"
+)
+
 // GetVal function pointer of any type, validates and returns value
 func GetVal[T any](ptr *T) T {
 	if ptr == nil {
@@ -24,3 +28,57 @@ func GetVal[T any](ptr *T) T {
 	}
 	return *ptr
 }
+
+// interfaceToStruct takes the input data and populates the input struct.
+func interfaceToStruct(sourceData, structPtr interface{}) error {
+	byteData, err := json.Marshal(sourceData)
+	if err != nil {
+		return err
+	}
+
+	err = json.Unmarshal(byteData, structPtr)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// PatchAWSTags returns tags in map[string]string format instead key="" and value= ""
+func PatchAWSTags(sourceData interface{}) interface{} {
+
+	type awsTags struct {
+		Key   string `json:"key"`
+		Value string `json:"value"`
+	}
+
+	var tagsList []awsTags
+	err := interfaceToStruct(sourceData, &tagsList)
+	if err != nil {
+		if valueRawMap, ok := sourceData.(map[string]interface{}); ok {
+			return valueRawMap
+		}
+		return sourceData
+	}
+
+	// build the tags map to mimic terraform's aws tag format
+	tfTagsMap := make(map[string]string)
+	for i := range tagsList {
+		if len(tagsList[i].Key) != 0 {
+			tfTagsMap[tagsList[i].Key] = tagsList[i].Value
+		}
+	}
+
+	return tfTagsMap
+}
+
+// GetBoolValueFromString returns boolean value from string
+func GetBoolValueFromString(inputStr string) bool {
+	if inputStr == "true" {
+		return true
+	} else if inputStr == "false" {
+		return false
+	}
+	return false
+
+}
diff --git a/pkg/mapper/iac-providers/cft/store/store.go b/pkg/mapper/iac-providers/cft/store/store.go
index a21d71ea7..24b4ee9f4 100644
--- a/pkg/mapper/iac-providers/cft/store/store.go
+++ b/pkg/mapper/iac-providers/cft/store/store.go
@@ -81,6 +81,7 @@ var ResourceTypes = map[string]string{
 	"AWS::ECS::TaskDefinition":                         AwsEcsTaskDefinition,
 	"AWS::S3::Bucket":                                  AwsS3Bucket,
 	"AWS::S3::Bucket.PublicAccessBlock":                AwsS3BucketPublicAccessBlock,
+	"AWS::S3::Bucket.ServerSideEncription":             AwsS3BucketServersideEncription,
 	"AWS::S3::BucketPolicy":                            AwsS3BucketPolicy,
 	"AWS::SQS::Queue":                                  AwsSqsQueue,
 	"AWS::SQS::QueuePolicy":                            AwsSqsQueuePolicy,
@@ -112,4 +113,5 @@ var ResourceTypes = map[string]string{
 	"AWS::EC2::Subnet":                                 AwsSubnet,
 	"AWS::EC2::Route":                                  AwsRoute,
 	"AWS::SSM::Parameter":                              AwsSSMParameter,
+	"AWS::ElasticLoadBalancingV2::LoadBalancer":        AwsLb,
 }
diff --git a/pkg/mapper/iac-providers/cft/store/types.go b/pkg/mapper/iac-providers/cft/store/types.go
index 71cd9baf8..64ff7b38d 100644
--- a/pkg/mapper/iac-providers/cft/store/types.go
+++ b/pkg/mapper/iac-providers/cft/store/types.go
@@ -81,6 +81,7 @@ const (
 	AwsEcsTaskDefinition             = "aws_ecs_task_definition"
 	AwsS3Bucket                      = "aws_s3_bucket"
 	AwsS3BucketPublicAccessBlock     = "aws_s3_bucket_public_access_block"
+	AwsS3BucketServersideEncription  = "aws_s3_bucket_server_side_encryption_configuration"
 	AwsS3BucketPolicy                = "aws_s3_bucket_policy"
 	AwsSqsQueue                      = "aws_sqs_queue"
 	AwsSqsQueuePolicy                = "aws_sqs_queue_policy"
@@ -111,4 +112,5 @@ const (
 	AwsSubnet                        = "aws_subnet"
 	AwsRoute                         = "aws_route"
 	AwsSSMParameter                  = "aws_ssm_parameter"
+	AwsLb                            = "aws_lb"
 )
diff --git a/pkg/version/version.go b/pkg/version/version.go
index 43ea62c2a..30de86bf7 100644
--- a/pkg/version/version.go
+++ b/pkg/version/version.go
@@ -19,7 +19,7 @@ package version
 import "fmt"
 
 // Terrascan The Terrascan version
-const Terrascan = "1.18.12"
+const Terrascan = "1.19.1"
 
 // Get returns the terrascan version
 func Get() string {


Test patch:
diff --git a/pkg/iac-providers/cft/v1/sanitize-cft-template_test.go b/pkg/iac-providers/cft/v1/sanitize-cft-template_test.go
index 9a5e7ad50..5273afa01 100644
--- a/pkg/iac-providers/cft/v1/sanitize-cft-template_test.go
+++ b/pkg/iac-providers/cft/v1/sanitize-cft-template_test.go
@@ -66,7 +66,7 @@ func TestCFTV1_sanitizeCftTemplate(t *testing.T) {
 				t.Error("CFTV1.sanitizeCftTemplate() got no error, expected parsing error")
 			}
 
-			templateMap, err := a.sanitizeCftTemplate(data, tt.args.isYAML)
+			templateMap, err := a.sanitizeCftTemplate(tt.inputFile, data, tt.args.isYAML)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("CFTV1.sanitizeCftTemplate() error = %v, wantErr %v", err, tt.wantErr)
 				return
diff --git a/pkg/iac-providers/cft/v1/testdata/deploy.yaml b/pkg/iac-providers/cft/v1/testdata/deploy.yaml
index 24abb60fd..91904864e 100644
--- a/pkg/iac-providers/cft/v1/testdata/deploy.yaml
+++ b/pkg/iac-providers/cft/v1/testdata/deploy.yaml
@@ -26,5 +26,5 @@ Resources:
         Statement:
           - Effect: Allow
             Action: *
-            Principal: '*'
+            Principal: 'star'