Repository: someengineering/fixinventory (language: python)

Issue:
[resotocore][feat] Allow multiple result kinds for ReportCheck
# Description

<!-- Please describe the changes included in this PR here. -->

# To-Dos

<!-- Before submitting this PR, please lint and test your changes locally. -->
<!-- Add an 'x' between the brackets to mark each checkbox as checked. -->
<!-- (Feel free to remove any items that do not apply to this PR.) -->

- [x] Add test coverage for new or updated functionality
- [x] Lint and test with `tox`

# Code of Conduct

By submitting this pull request, I agree to follow the [code of conduct](https://resoto.com/code-of-conduct).



Discussion / hints:

Fix patch:
diff --git a/resotocore/resotocore/db/arangodb_extensions.py b/resotocore/resotocore/db/arangodb_extensions.py
index bd3ad97cd4..a48d9176fb 100644
--- a/resotocore/resotocore/db/arangodb_extensions.py
+++ b/resotocore/resotocore/db/arangodb_extensions.py
@@ -12,23 +12,39 @@
 
 
 class ArangoHTTPClient(HTTPClient):
-    def __init__(self, timeout: int, verify: Union[str, bool, None]):
+    def __init__(
+        self,
+        timeout: int,
+        verify: Union[str, bool, None],
+        retry_attempts: int = 3,
+        backoff_factor: float = 1.0,
+        pool_connections: int = 10,
+        pool_maxsize: int = 20,
+    ):
         log.info(f"Create ArangoHTTPClient with timeout={timeout} and verify={verify}")
-        self.timeout = timeout
-        self.verify = verify
+        self._timeout = timeout
+        self._verify = verify
+        self._retry_attempts = retry_attempts
+        self._backoff_factor = backoff_factor
+        self._pool_connections = pool_connections
+        self._pool_maxsize = pool_maxsize
 
     def create_session(self, host: str) -> Session:
         retry_strategy = Retry(
-            total=3,
-            backoff_factor=1,
+            total=self._retry_attempts,
+            backoff_factor=self._backoff_factor,
             status_forcelist=[429, 500, 502, 503, 504],
             allowed_methods=["HEAD", "GET", "OPTIONS"],
         )
-        http_adapter = HTTPAdapter(max_retries=retry_strategy)
+        http_adapter = HTTPAdapter(
+            pool_connections=self._pool_connections,
+            pool_maxsize=self._pool_maxsize,
+            max_retries=retry_strategy,
+        )
         session = Session()
         session.mount("https://", http_adapter)
         session.mount("http://", http_adapter)
-        session.verify = self.verify
+        session.verify = self._verify
         return session
 
     def send_request(
@@ -41,5 +57,5 @@ def send_request(
         data: Union[str, MultipartEncoder, None] = None,
         auth: Optional[Tuple[str, str]] = None,
     ) -> Response:
-        response = session.request(method, url, params, data, headers, auth=auth, timeout=self.timeout)
+        response = session.request(method, url, params, data, headers, auth=auth, timeout=self._timeout)
         return Response(method, response.url, response.headers, response.status_code, response.reason, response.text)
diff --git a/resotocore/resotocore/report/__init__.py b/resotocore/resotocore/report/__init__.py
index bf81aa90f4..b978c96268 100644
--- a/resotocore/resotocore/report/__init__.py
+++ b/resotocore/resotocore/report/__init__.py
@@ -65,7 +65,7 @@ class ReportCheck:
     provider: str
     service: str
     title: str
-    result_kind: str
+    result_kinds: List[str]
     categories: List[str]
     severity: ReportSeverity
     risk: str
@@ -80,6 +80,8 @@ def environment(self, values: Json) -> Json:
 
     def to_node(self) -> Json:
         reported = to_js(self)
+        # backward compatibility
+        reported["result_kind"] = self.result_kinds[0]
         return dict(id=self.id, kind="report_check", type="node", reported=reported)
 
 
@@ -153,7 +155,7 @@ def from_node(js: Json) -> CheckResult:
                 provider=reported["provider"],
                 service=reported["service"],
                 title=reported["title"],
-                result_kind=reported["result_kind"],
+                result_kinds=reported["result_kinds"],
                 categories=reported["categories"],
                 severity=ReportSeverity(reported["severity"]),
                 risk=reported["risk"],
diff --git a/resotocore/resotocore/report/benchmark_renderer.py b/resotocore/resotocore/report/benchmark_renderer.py
index 9e4e65b30c..60424a4b36 100644
--- a/resotocore/resotocore/report/benchmark_renderer.py
+++ b/resotocore/resotocore/report/benchmark_renderer.py
@@ -80,8 +80,9 @@ def render_check_result(check_result: CheckResult, account: str) -> str:
     failed = account in check_result.number_of_resources_failing_by_account
     result = f"- {cross_mark if failed else check_mark} **{check.severity.name}**: {check.title}\n\n"
     if failed:
+        kinds = ", ".join(f"`{k}`" for k in check.result_kinds)
         result += f"  - Risk: {check.risk}\n\n"
-        result += f"  - There are {check_result.number_of_resources_failing_by_account[account]} `{check.result_kind}` "
+        result += f"  - There are {check_result.number_of_resources_failing_by_account[account]} {kinds} "
         result += "resources failing this check.\n\n"
         result += (
             f"  - Remediation: {check.remediation.text}. See [Link]({check.remediation.url}) for more details.\n\n"
diff --git a/resotocore/resotocore/report/inspector_service.py b/resotocore/resotocore/report/inspector_service.py
index ba3efb4837..f3191e7775 100644
--- a/resotocore/resotocore/report/inspector_service.py
+++ b/resotocore/resotocore/report/inspector_service.py
@@ -136,7 +136,7 @@ def inspection_matches(inspection: ReportCheck) -> bool:
                 (provider is None or provider == inspection.provider)
                 and (service is None or service == inspection.service)
                 and (category is None or category in inspection.categories)
-                and (kind is None or kind == inspection.result_kind)
+                and (kind is None or kind in inspection.result_kinds)
                 and (check_ids is None or inspection.id in check_ids)
                 and (context is None or context.includes_severity(inspection.severity))
             )
@@ -285,9 +285,6 @@ async def __list_failing_resources(
         # final environment: defaults are coming from the check and are eventually overriden in the config
         env = inspection.environment(config)
         account_id_prop = "ancestors.account.reported.id"
-        # if the result kind is an account, we need to use the id directly instead of walking the graph
-        if (result_kind := model.get(inspection.result_kind)) and "account" in result_kind.kind_hierarchy():
-            account_id_prop = "reported.id"
 
         async def perform_search(search: str) -> AsyncIterator[Json]:
             # parse query
@@ -374,11 +371,8 @@ async def __perform_check(
         self, graph: GraphName, model: Model, inspection: ReportCheck, config: Json, context: CheckContext
     ) -> SingleCheckResult:
         resources_by_account = defaultdict(list)
-        # if the result kind is an account, we need to use the id directly instead of walking the graph
-        is_account = (rk := model.get(inspection.result_kind)) and "account" in rk.kind_hierarchy()
-        account_id_path = NodePath.reported_id if is_account else NodePath.ancestor_account_id
         async for resource in await self.__list_failing_resources(graph, model, inspection, config, context):
-            account_id = value_in_path(resource, account_id_path)
+            account_id = value_in_path(resource, NodePath.ancestor_account_id)
             if account_id:
                 resources_by_account[account_id].append(bend(ReportResourceData, resource))
         return resources_by_account
diff --git a/resotocore/resotocore/report/report_config.py b/resotocore/resotocore/report/report_config.py
index 9ec26d9877..af0e79f884 100644
--- a/resotocore/resotocore/report/report_config.py
+++ b/resotocore/resotocore/report/report_config.py
@@ -34,7 +34,9 @@ class ReportCheckConfig:
         }
     )
     title: str = field(metadata={"description": "Title of the check."})
-    result_kind: str = field(metadata={"description": "Resulting kind this check will emit. Example: aws_ec2_instance"})
+    result_kinds: List[str] = field(
+        metadata={"description": "Resulting kind this check will emit. Example: aws_ec2_instance"}
+    )
     categories: List[str] = field(metadata={"description": "Categories of the check. Example: ['security', 'cost']"})
     severity: ReportSeverity = field(metadata={"description": "Severity of the check."})
     risk: str = field(metadata={"description": "What is the risk associated with related resources."})
@@ -86,6 +88,9 @@ def report_check(pdr: str, svc: str, check: Json) -> ReportCheck:
             cr["provider"] = pdr
             cr["service"] = svc
             cr["id"] = f"{pdr}_{svc}_{check['name']}"
+            # handle legacy result_kind
+            if "result_kind" in cr and "result_kinds" not in cr:
+                cr["result_kinds"] = [cr.pop("result_kind")]
             return from_js(cr, ReportCheck)
 
         pdr = js["provider"]
diff --git a/resotocore/resotocore/static/report/benchmark/aws/aws_cis_1_5.json b/resotocore/resotocore/static/report/benchmark/aws/aws_cis_1_5.json
index e62e6a6091..6d36608c11 100644
--- a/resotocore/resotocore/static/report/benchmark/aws/aws_cis_1_5.json
+++ b/resotocore/resotocore/static/report/benchmark/aws/aws_cis_1_5.json
@@ -1,5 +1,5 @@
 {
-    "title": "AWS CIS 1.5.0",
+    "title": "AWS CIS 1.5",
     "framework": "CIS",
     "clouds": ["aws"],
     "version": "1.5",
@@ -507,6 +507,13 @@
                     "checks": [
                         "aws_ec2_routing_tables_with_least_privilege"
                     ]
+                },
+                {
+                    "title": "5.6 Ensure that EC2 Metadata Service only allows IMDSv2",
+                    "description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).",
+                    "checks": [
+                        "aws_ec2_instance_imdsv2_enabled"
+                    ]
                 }
             ]
         }
diff --git a/resotocore/resotocore/static/report/benchmark/aws/aws_cis_2_0.json b/resotocore/resotocore/static/report/benchmark/aws/aws_cis_2_0.json
new file mode 100644
index 0000000000..670e15e687
--- /dev/null
+++ b/resotocore/resotocore/static/report/benchmark/aws/aws_cis_2_0.json
@@ -0,0 +1,514 @@
+{
+    "title": "AWS CIS 2.0",
+    "framework": "CIS",
+    "clouds": ["aws"],
+    "version": "2.0",
+    "description": "The CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Amazon Web Services with an emphasis on foundational, testable, and architecture agnostic settings.",
+    "children": [
+        {
+            "title": "Section 1: Access Management",
+            "description": "This section contains recommendations for configuring identity and access management related options.",
+            "children": [
+                {
+                    "title": "1.1 Maintain current contact details",
+                    "description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.",
+                    "checks": [
+                        "aws_iam_account_maintain_current_contact_details"
+                    ]
+                },
+                {
+                    "title": "1.2 Ensure security contact information is registered",
+                    "description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.",
+                    "checks": [
+                        "aws_iam_account_security_contact_information_is_registered"
+                    ]
+                },
+                {
+                    "title": "1.3 Ensure security questions are registered in the AWS account",
+                    "description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.",
+                    "checks": [
+                        "aws_iam_account_security_questions_are_registered_in_the_aws_account"
+                    ]
+                },
+                {
+                    "title": "1.4 Ensure no 'root' user account access key exists",
+                    "description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.",
+                    "checks": [
+                        "aws_iam_no_root_access_key"
+                    ]
+                },
+                {
+                    "title": "1.5 Ensure MFA is enabled for the 'root' user account",
+                    "description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device.",
+                    "checks": [
+                        "aws_iam_root_mfa_enabled"
+                    ]
+                },
+                {
+                    "title": "1.6 Ensure hardware MFA is enabled for the 'root' user account",
+                    "description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the root user account be protected with a hardware MFA.",
+                    "checks": [
+                        "aws_iam_root_hardware_mfa_enabled"
+                    ]
+                },
+                {
+                    "title": "1.7 Eliminate use of the 'root' user for administrative and daily tasks",
+                    "description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.",
+                    "checks": [
+                        "aws_iam_avoid_root_usage"
+                    ]
+                },
+                {
+                    "title": "1.8 Ensure IAM password policy requires minimum length of 14 or greater",
+                    "description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.",
+                    "checks": [
+                        "aws_iam_password_policy_minimum_length_14"
+                    ]
+                },
+                {
+                    "title": "1.9 Ensure IAM password policy prevents password reuse",
+                    "description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.",
+                    "checks": [
+                        "aws_iam_password_policy_reuse_24"
+                    ]
+                },
+                {
+                    "title": "1.10 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password",
+                    "description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.",
+                    "checks": [
+                        "aws_iam_user_mfa_enabled_console_access"
+                    ]
+                },
+                {
+                    "title": "1.11 Do not setup access keys during initial user setup for all IAM users that have a console password",
+                    "description": "AWS console defaults to no check boxes selected when creating a new IAM user. When creating the IAM User credentials you have to determine what type of access they require.",
+                    "checks": [
+                        "aws_iam_user_uses_access_keys_console_access"
+                    ]
+                },
+                {
+                    "title": "1.12 Ensure credentials unused for 45 days or greater are disabled",
+                    "description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.",
+                    "checks": [
+                        "aws_iam_disable_old_credentials"
+                    ]
+                },
+                {
+                    "title": "1.13 Ensure there is only one active access key available for any single IAM user",
+                    "description": "Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK).",
+                    "checks": [
+                        "aws_iam_user_has_two_active_access_keys"
+                    ]
+                },
+                {
+                    "title": "1.14 Ensure access keys are rotated every 90 days or less",
+                    "description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.",
+                    "checks": [
+                        "aws_iam_rotate_access_keys_after_90_days"
+                    ]
+                },
+                {
+                    "title": "1.15 Ensure IAM Users Receive Permissions Only Through Groups",
+                    "description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.",
+                    "checks": [
+                        "aws_iam_policy_attached_only_to_group_or_roles"
+                    ]
+                },
+                {
+                    "title": "1.16 Ensure IAM policies that allow full \"*:*\" administrative privileges are not attached",
+                    "description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant least privilege -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform only those tasks, instead of allowing full administrative privileges.",
+                    "checks": [
+                        "aws_iam_policy_with_administrative_privileges_not_in_use"
+                    ]
+                },
+                {
+                    "title": "1.17 Ensure a support role has been created to manage incidents with AWS Support",
+                    "description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.",
+                    "checks": [
+                        "aws_iam_support_role_exists"
+                    ]
+                },
+                {
+                    "title": "1.18 Ensure IAM instance roles are used for AWS resource access from instances",
+                    "description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.",
+                    "checks": [
+                        "aws_ec2_instance_profile_attached"
+                    ]
+                },
+                {
+                    "title": "1.19 Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed",
+                    "description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.",
+                    "checks": [
+                        "aws_iam_expired_server_certificates"
+                    ]
+                },
+                {
+                    "title": "1.20 Ensure that IAM Access analyzer is enabled for all regions",
+                    "description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.",
+                    "checks": [
+                        "aws_iam_access_analyzer_enabled"
+                    ]
+                },
+                {
+                    "title": "1.21 Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments",
+                    "description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provide via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.",
+                    "checks": [
+                        "aws_iam_check_saml_providers_sts"
+                    ]
+                },
+                {
+                    "title": "1.22 Ensure access to AWSCloudShellFullAccess is restricted",
+                    "description": "AWS CloudShell is a convenient way of running CLI commands against AWS services. A managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment a user has sudo permissions, and can access the internet. So it is feasible to install file transfer software (for example) and move data from CloudShell to external internet servers.",
+                    "checks": [
+                        "aws_iam_check_cloudshell_access_restricted"
+                    ]
+                }
+            ]
+        },
+        {
+            "title": "Section 2: Storage",
+            "description": "This section contains recommendations for configuring AWS Storage.",
+            "children": [
+                {
+                    "title": "2.1 Simple Storage Service (S3)",
+                    "description": "This section contains recommendations for configuring AWS Simple Storage Service (S3) Buckets.",
+                    "children": [
+                        {
+                            "title": "2.1.2 Ensure S3 Bucket Policy is set to deny HTTP requests",
+                            "description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.",
+                            "checks": [
+                                "aws_s3_bucket_secure_transport_policy"
+                            ]
+                        },
+                        {
+                            "title": "2.1.3 Ensure MFA Delete is enabled on S3 buckets",
+                            "description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
+                            "checks": [
+                                "aws_s3_bucket_no_mfa_delete"
+                            ]
+                        },
+                        {
+                            "title": "2.1.4 Ensure all data in Amazon S3 has been discovered, classified and secured when required",
+                            "description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
+                            "checks": [
+                                "aws_s3_macie_is_enabled"
+                            ]
+                        },
+                        {
+                            "title": "2.1.5 Ensure that S3 Buckets are configured with 'Block public access (bucket settings)'",
+                            "description": "Amazon S3 provides Block public access (bucket settings) and Block public access (account settings) to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principle with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, Block public access (bucket settings) prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, Block public access (account settings) prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
+                            "checks": [
+                                "aws_s3_account_level_public_access_blocks"
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "title": "2.2 Elastic Compute Cloud (EC2)",
+                    "description": "This section contains recommendations for configuring AWS Elastic Compute Cloud (EC2).",
+                    "children": [
+                        {
+                            "title": "2.2.1 Ensure EBS Volume Encryption is Enabled in all Regions",
+                            "description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
+                            "checks": [
+                                "aws_ec2_volume_not_encrypted"
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "title": "2.3 Relational Database Service (RDS)",
+                    "description": "This section contains recommendations for configuring AWS Relational Database Services (RDS).",
+                    "children": [
+                        {
+                            "title": "2.3.1 Ensure that encryption is enabled for RDS Instances",
+                            "description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
+                            "checks": [
+                                "aws_rds_storage_encrypted"
+                            ]
+                        },
+                        {
+                            "title": "2.3.2 Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances",
+                            "description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.",
+                            "checks": [
+                                "aws_rds_auto_minor_version_upgrade"
+                            ]
+                        },
+                        {
+                            "title": "2.3.3 Ensure that public access is not given to RDS Instance",
+                            "description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.",
+                            "checks": [
+                                "aws_rds_no_public_access"
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "title": "2.4 Elastic File System (EFS)",
+                    "description": "This section contains recommendations for configuring AWS Elastic File System (EFS).",
+                    "children": [
+                        {
+                            "title": "2.4.1 Ensure that encryption is enabled for EFS file systems",
+                            "description": "EFS data should be encrypted at rest using AWS KMS (Key Management Service).",
+                            "checks": [
+                                "aws_efs_storage_encrypted"
+                            ]
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "title": "Section 3: Logging",
+            "description": "This section contains recommendations for configuring AWS logging features.",
+            "children": [
+                {
+                    "title": "3.1 Ensure CloudTrail is enabled in all regions",
+                    "description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).",
+                    "checks": [
+                        "aws_cloudtrail_logging_in_all_regions_enabled"
+                    ]
+                },
+                {
+                    "title": "3.2 Ensure CloudTrail log file validation is enabled",
+                    "description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.",
+                    "checks": [
+                        "aws_cloudtrail_log_file_validation_enabled"
+                    ]
+                },
+                {
+                    "title": "3.3 Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible",
+                    "description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.",
+                    "checks": [
+                        "aws_cloudtrail_logs_s3_bucket_is_not_publicly_accessible"
+                    ]
+                },
+                {
+                    "title": "3.4 Ensure CloudTrail trails are integrated with CloudWatch Logs",
+                    "description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs.",
+                    "checks": [
+                        "aws_cloudtrail_no_logging_enabled",
+                        "aws_cloudtrail_no_recent_log_event"
+                    ]
+                },
+                {
+                    "title": "3.5 Ensure AWS Config is enabled in all regions",
+                    "description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.",
+                    "checks": [
+                        "aws_config_enabled_in_all_regions"
+                    ]
+                },
+                {
+                    "title": "3.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket",
+                    "description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.",
+                    "checks": [
+                        "aws_cloudtrail_s3_bucket_logging_enabled"
+                    ]
+                },
+                {
+                    "title": "3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs",
+                    "description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.",
+                    "checks": [
+                        "aws_cloudtrail_uses_encryption_at_rest"
+                    ]
+                },
+                {
+                    "title": "3.8 Ensure rotation for customer created symmetric CMKs is enabled",
+                    "description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.",
+                    "checks": [
+                        "aws_kms_key_rotation_enabled"
+                    ]
+                },
+                {
+                    "title": "3.9 Ensure VPC flow logging is enabled in all VPCs",
+                    "description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.",
+                    "checks": [
+                        "aws_ec2_vpc_flow_logs_enabled"
+                    ]
+                },
+                {
+                    "title": "3.10 Ensure that Object-level logging for write events is enabled for S3 bucket",
+                    "description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
+                    "checks": [
+                        "aws_cloudtrail_s3_data_events_write_enabled"
+                    ]
+                },
+                {
+                    "title": "3.11 Ensure that Object-level logging for read events is enabled for S3 bucket",
+                    "description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.",
+                    "checks": [
+                        "aws_cloudtrail_s3_data_events_read_enabled"
+                    ]
+                }
+            ]
+        },
+        {
+            "title": "Section 4: Monitoring",
+            "description": "This section contains recommendations for configuring AWS to assist with monitoring and responding to account activities.",
+            "children": [
+                {
+                    "title": "4.1 Ensure a log metric filter and alarm exist for unauthorized API calls",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_unauthorized_api_calls"
+                    ]
+                },
+                {
+                    "title": "4.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_console_login_no_mfa"
+                    ]
+                },
+                {
+                    "title": "4.3 Ensure a log metric filter and alarm exist for usage of 'root' account",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for root login attempts.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_root_account_usage"
+                    ]
+                },
+                {
+                    "title": "4.4 Ensure a log metric filter and alarm exist for IAM policy changes",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_iam_policy_changes"
+                    ]
+                },
+                {
+                    "title": "4.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_cloud_trail_configuration_changes"
+                    ]
+                },
+                {
+                    "title": "4.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_authentication_failures"
+                    ]
+                },
+                {
+                    "title": "4.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_kms_key_deletion"
+                    ]
+                },
+                {
+                    "title": "4.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_s3_bucket_policy_changes"
+                    ]
+                },
+                {
+                    "title": "4.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_config_configuration_changes"
+                    ]
+                },
+                {
+                    "title": "4.10 Ensure a log metric filter and alarm exist for security group changes",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_security_group_changes"
+                    ]
+                },
+                {
+                    "title": "4.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_network_acl_changes"
+                    ]
+                },
+                {
+                    "title": "4.12 Ensure a log metric filter and alarm exist for changes to network gateways",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_network_gateway_changes"
+                    ]
+                },
+                {
+                    "title": "4.13 Ensure a log metric filter and alarm exist for route table changes",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_route_table_changes"
+                    ]
+                },
+                {
+                    "title": "4.14 Ensure a log metric filter and alarm exist for VPC changes",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_vpc_changes"
+                    ]
+                },
+                {
+                    "title": "4.15 Ensure a log metric filter and alarm exists for AWS Organizations changes",
+                    "description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.",
+                    "checks": [
+                        "aws_cloudtrail_log_metric_filters_aws_org_changes"
+                    ]
+                },
+                {
+                    "title": "4.16 Ensure AWS Security Hub is enabled",
+                    "description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.",
+                    "checks": [
+                        "aws_cloudtrail_security_hub_enabled"
+                    ]
+                }
+            ]
+        },
+        {
+            "title": "Section 5: Networking",
+            "description": "This section contains recommendations for configuring security-related aspects of AWS Virtual Private Cloud (VPC).",
+            "children": [
+                {
+                    "title": "5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports",
+                    "description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.",
+                    "checks": [
+                        "aws_ec2_allow_ingress_any_port_ipv4",
+                        "aws_ec2_allow_ingress_any_port_ipv6",
+                        "aws_ec2_allow_ingress_ssh_port_22_ipv4",
+                        "aws_ec2_allow_ingress_ssh_port_22_ipv6",
+                        "aws_ec2_allow_ingress_rdp_port_3389_ipv4",
+                        "aws_ec2_allow_ingress_rdp_port_3389_ipv6"
+                    ]
+                },
+                {
+                    "title": "5.2 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports",
+                    "description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.",
+                    "checks": [
+                        "aws_ec2_allow_ingress_from_internet_to_any_port_ipv4",
+                        "aws_ec2_allow_ingress_from_internet_to_ssh_port_22_ipv4",
+                        "aws_ec2_allow_ingress_from_internet_to_rdp_port_3389_ipv4"
+                    ]
+                },
+                {
+                    "title": "5.3 Ensure no security groups allow ingress from ::/0 to remote server administration ports",
+                    "description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.",
+                    "checks": [
+                        "aws_ec2_allow_ingress_from_internet_to_any_port_ipv6",
+                        "aws_ec2_allow_ingress_from_internet_to_ssh_port_22_ipv6",
+                        "aws_ec2_allow_ingress_from_internet_to_rdp_port_3389_ipv6"
+                    ]
+                },
+                {
+                    "title": "5.4 Ensure the default security group of every VPC restricts all traffic",
+                    "description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic.",
+                    "checks": [
+                        "aws_ec2_default_restrict_traffic"
+                    ]
+                },
+                {
+                    "title": "5.5 Ensure routing tables for VPC peering are \"least access\"",
+                    "description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.",
+                    "checks": [
+                        "aws_ec2_routing_tables_with_least_privilege"
+                    ]
+                }
+            ]
+        }
+    ]
+}
diff --git a/resotocore/resotocore/static/report/check_template.json b/resotocore/resotocore/static/report/check_template.json
index d3ff7094da..d919316896 100644
--- a/resotocore/resotocore/static/report/check_template.json
+++ b/resotocore/resotocore/static/report/check_template.json
@@ -1,7 +1,7 @@
 {
     "name": "",
     "title": "",
-    "kind": "result kind returned by the query",
+    "result_kinds": ["result kind returned by the query"],
     "categories": [
         "insights",
         "security",
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_apigateway.json b/resotocore/resotocore/static/report/checks/aws/aws_apigateway.json
index fc830e8f35..5d833921f5 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_apigateway.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_apigateway.json
@@ -5,7 +5,7 @@
         {
             "name": "authorizers_enabled",
             "title": "Check if API Gateway has configured authorizers.",
-            "result_kind": "aws_api_gateway_rest_api",
+            "result_kinds": ["aws_api_gateway_rest_api"],
             "categories": ["security", "compliance"],
             "risk": "If no authorizer is defined, anyone can use the service.",
             "severity": "medium",
@@ -23,7 +23,7 @@
         {
             "name": "client_certificate_enabled",
             "title": "Check if API Gateway has client certificate enabled to access your backend endpoint.",
-            "result_kind": "aws_api_gateway_stage",
+            "result_kinds": ["aws_api_gateway_stage"],
             "categories": ["security", "compliance"],
             "risk": "Man in the middle attacks are possible and other similar risks.",
             "severity": "medium",
@@ -39,7 +39,7 @@
         {
             "name": "logging_enabled",
             "title": "Check if API Gateway has logging enabled.",
-            "result_kind": "aws_api_gateway_stage",
+            "result_kinds": ["aws_api_gateway_stage"],
             "categories": ["compliance"],
             "risk": "If not enabled, monitoring of service use is not possible. Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms.",
             "severity": "medium",
@@ -54,7 +54,7 @@
         {
             "name": "waf_acl_attached",
             "title": "Check if API Gateway has a WAF ACL attached.",
-            "result_kind": "aws_api_gateway_stage",
+            "result_kinds": ["aws_api_gateway_stage"],
             "categories": ["security"],
             "risk": "Potential attacks and / or abuse of service for internet reachable services.",
             "severity": "medium",
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_cloudtrail.json b/resotocore/resotocore/static/report/checks/aws/aws_cloudtrail.json
index 269b4c1a57..6c50cc376d 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_cloudtrail.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_cloudtrail.json
@@ -5,7 +5,7 @@
         {
             "name": "logging_in_all_regions_enabled",
             "title": "Ensure CloudTrail is enabled and set up for logging in all regions",
-            "result_kind": "aws_region",
+            "result_kinds": ["aws_region"],
             "categories": [
                 "security",
                 "compliance"
@@ -23,7 +23,7 @@
         {
             "name": "log_file_validation_enabled",
             "title": "Ensure CloudTrail log file validation is enabled",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -41,7 +41,7 @@
         {
             "name": "logs_s3_bucket_is_not_publicly_accessible",
             "title": "Ensure the S3 bucket CloudTrail logs is not publicly accessible",
-            "result_kind": "aws_s3_bucket",
+            "result_kinds": ["aws_s3_bucket"],
             "categories": [
                 "security",
                 "compliance"
@@ -59,7 +59,7 @@
         {
             "name": "no_logging_enabled",
             "title": "Ensure CloudTrail has logging enabled",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -77,7 +77,7 @@
         {
             "name": "no_recent_log_event",
             "title": "Ensure CloudTrail has log events in the configured duration",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -98,7 +98,7 @@
         {
             "name": "s3_bucket_logging_enabled",
             "title": "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -116,7 +116,7 @@
         {
             "name": "uses_encryption_at_rest",
             "title": "Ensure CloudTrail logs are encrypted at rest using KMS CMKs",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -134,7 +134,7 @@
         {
             "name": "s3_data_events_write_enabled",
             "title": "Check all regions and make sure S3 buckets have Object-level logging for write events is enabled in CloudTrail.",
-            "result_kind": "aws_region",
+            "result_kinds": ["aws_region"],
             "categories": [
                 "security",
                 "compliance"
@@ -152,7 +152,7 @@
         {
             "name": "s3_data_events_read_enabled",
             "title": "Check all regions and make sure S3 buckets have Object-level logging for read events is enabled in CloudTrail.",
-            "result_kind": "aws_region",
+            "result_kinds": ["aws_region"],
             "categories": [
                 "security",
                 "compliance"
@@ -170,7 +170,7 @@
         {
             "name": "log_metric_filters_unauthorized_api_calls",
             "title": "Ensure a log metric filter and alarm exist for unauthorized API calls.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -188,7 +188,7 @@
         {
             "name": "log_metric_filters_sign_in_without_mfa",
             "title": "Ensure a log metric filter and alarm exist for Management Console sign-in without MFA.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -206,7 +206,7 @@
         {
             "name": "log_metric_filters_console_login_no_mfa",
             "title": "Ensure a log metric filter and alarm exist for Management Console sign-in without MFA.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -224,7 +224,7 @@
         {
             "name": "log_metric_filters_root_account_usage",
             "title": "Ensure a log metric filter and alarm exist for usage of root account.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -242,7 +242,7 @@
         {
             "name": "log_metric_filters_iam_policy_changes",
             "title": "Ensure a log metric filter and alarm exist for IAM policy changes.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -260,7 +260,7 @@
         {
             "name": "log_metric_filters_cloud_trail_configuration_changes",
             "title": "Ensure a log metric filter and alarm exist for CloudTrail configuration changes.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -278,7 +278,7 @@
         {
             "name": "log_metric_filters_authentication_failures",
             "title": "Ensure a log metric filter and alarm exist for AWS Management Console authentication failures.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -296,7 +296,7 @@
         {
             "name": "log_metric_filters_kms_key_deletion",
             "title": "Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -314,7 +314,7 @@
         {
             "name": "log_metric_filters_s3_bucket_policy_changes",
             "title": "Ensure a log metric filter and alarm exist for S3 bucket policy changes.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -332,7 +332,7 @@
         {
             "name": "log_metric_filters_config_configuration_changes",
             "title": "Ensure a log metric filter and alarm exist for AWS Config configuration changes.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -350,7 +350,7 @@
         {
             "name": "log_metric_filters_security_group_changes",
             "title": "Ensure a log metric filter and alarm exist for security group changes.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -368,7 +368,7 @@
         {
             "name": "log_metric_filters_network_acl_changes",
             "title": "Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL).",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -386,7 +386,7 @@
         {
             "name": "log_metric_filters_network_gateway_changes",
             "title": "Ensure a log metric filter and alarm exist for changes to network gateways.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -404,7 +404,7 @@
         {
             "name": "log_metric_filters_route_table_changes",
             "title": "Ensure a log metric filter and alarm exist for route table changes",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -422,7 +422,7 @@
         {
             "name": "log_metric_filters_vpc_changes",
             "title": "Ensure a log metric filter and alarm exist for VPC changes.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -440,7 +440,7 @@
         {
             "name": "log_metric_filters_aws_org_changes",
             "title": "Ensure a log metric filter and alarm exist for AWS Organizations changes.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
@@ -458,7 +458,7 @@
         {
             "name": "security_hub_enabled",
             "title": "Check if Security Hub is enabled and its standard subscriptions.",
-            "result_kind": "aws_cloud_trail",
+            "result_kinds": ["aws_cloud_trail"],
             "categories": [
                 "security",
                 "compliance"
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_config.json b/resotocore/resotocore/static/report/checks/aws/aws_config.json
index 33c58e85b5..db6bd0ceed 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_config.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_config.json
@@ -5,7 +5,7 @@
         {
             "name": "enabled_in_all_regions",
             "title": "Ensure AWS Config is enabled in all regions.",
-            "result_kind": "aws_region",
+            "result_kinds": ["aws_region"],
             "categories": ["security", "compliance"],
             "risk": "The AWS configuration item history captured by AWS Config enables security analysis, resource change tracking and compliance auditing.",
             "severity": "medium",
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_ec2.json b/resotocore/resotocore/static/report/checks/aws/aws_ec2.json
index a752f847d8..ec666207b8 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_ec2.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_ec2.json
@@ -5,7 +5,7 @@
         {
             "name": "snapshot_encrypted",
             "title": "Ensure EBS Snapshots are encrypted and not public.",
-            "result_kind": "aws_ec2_snapshot",
+            "result_kinds": ["aws_ec2_snapshot"],
             "categories": ["security", "compliance"],
             "risk": "When you share a snapshot, you are giving others access to all of the data on the snapshot. Share snapshots only with people with whom you want to share all of your snapshot data.",
             "severity": "medium",
@@ -20,7 +20,7 @@
         {
             "name": "unused_elastic_ip",
             "title": "Check if there is any unassigned Elastic IP.",
-            "result_kind": "aws_ec2_elastic_ip",
+            "result_kinds": ["aws_ec2_elastic_ip"],
             "categories": ["cost"],
             "risk": "Unassigned Elastic IPs may result in extra cost.",
             "severity": "medium",
@@ -35,7 +35,7 @@
         {
             "name": "internet_facing_with_instance_profile",
             "title": "Check for internet facing EC2 instances with Instance Profiles attached.",
-            "result_kind": "aws_ec2_instance",
+            "result_kinds": ["aws_ec2_instance"],
             "categories": ["security", "compliance"],
             "risk": "Exposing an EC2 directly to internet increases the attack surface and therefore the risk of compromise.",
             "severity": "medium",
@@ -50,7 +50,7 @@
         {
             "name": "old_instances",
             "title": "Check EC2 Instances older than specific days.",
-            "result_kind": "aws_ec2_instance",
+            "result_kinds": ["aws_ec2_instance"],
             "categories": ["security", "compliance"],
             "risk": "Having old instances within your AWS account could increase the risk of having vulnerable software.",
             "severity": "low",
@@ -68,7 +68,7 @@
         {
             "name": "instance_profile_attached",
             "title": "Ensure IAM instance roles are used for AWS resource access from instances",
-            "result_kind": "aws_ec2_instance",
+            "result_kinds": ["aws_ec2_instance"],
             "categories": ["security", "compliance"],
             "risk": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS IAM roles reduce the risks associated with sharing and rotating credentials that can be used outside of AWS itself. If credentials are compromised, they can be used from outside of the AWS account.",
             "severity": "medium",
@@ -83,7 +83,7 @@
         {
             "name": "public_ip_address",
             "title": "Check for EC2 Instances with Public IP.",
-            "result_kind": "aws_ec2_instance",
+            "result_kinds": ["aws_ec2_instance"],
             "categories": ["security", "compliance"],
             "risk": "Exposing an EC2 directly to internet increases the attack surface and therefore the risk of compromise.",
             "severity": "medium",
@@ -98,7 +98,7 @@
         {
             "name": "allow_ingress_any_port_ipv4",
             "title": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to any port.",
-            "result_kind": "aws_ec2_network_acl",
+            "result_kinds": ["aws_ec2_network_acl"],
             "categories": [ "security", "compliance" ],
             "risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
             "severity": "high",
@@ -114,7 +114,7 @@
         {
             "name": "allow_ingress_any_port_ipv6",
             "title": "Ensure no Network ACLs allow ingress from ::/0 to any port.",
-            "result_kind": "aws_ec2_network_acl",
+            "result_kinds": ["aws_ec2_network_acl"],
             "categories": [ "security", "compliance" ],
             "risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
             "severity": "high",
@@ -130,7 +130,7 @@
         {
             "name": "allow_ingress_ssh_port_22_ipv4",
             "title": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to SSH port 22",
-            "result_kind": "aws_ec2_network_acl",
+            "result_kinds": ["aws_ec2_network_acl"],
             "categories": [ "security", "compliance" ],
             "risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
             "severity": "high",
@@ -146,7 +146,7 @@
         {
             "name": "allow_ingress_ssh_port_22_ipv6",
             "title": "Ensure no Network ACLs allow ingress from ::/0 to SSH port 22",
-            "result_kind": "aws_ec2_network_acl",
+            "result_kinds": ["aws_ec2_network_acl"],
             "categories": [ "security", "compliance" ],
             "risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
             "severity": "high",
@@ -162,7 +162,7 @@
         {
             "name": "allow_ingress_rdp_port_3389_ipv4",
             "title": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to Microsoft RDP port 3389",
-            "result_kind": "aws_ec2_network_acl",
+            "result_kinds": ["aws_ec2_network_acl"],
             "categories": [ "security", "compliance" ],
             "risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
             "severity": "high",
@@ -178,7 +178,7 @@
         {
             "name": "allow_ingress_rdp_port_3389_ipv6",
             "title": "Ensure no Network ACLs allow ingress from ::/0 to Microsoft RDP port 3389",
-            "result_kind": "aws_ec2_network_acl",
+            "result_kinds": ["aws_ec2_network_acl"],
             "categories": [ "security", "compliance" ],
             "risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
             "severity": "high",
@@ -194,7 +194,7 @@
         {
             "name": "allow_ingress_from_internet_to_any_port",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to any port.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -204,13 +204,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_any_port_ipv4",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 to any port.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -220,13 +219,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_any_port_ipv6",
             "title": "Ensure no security groups allow ingress from ::/0 to any port.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -236,13 +234,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_port_mongodb_27017_27018",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MongoDB ports 27017 and 27018.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -252,13 +249,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_ssh_port_22",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to SSH port 22.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -268,13 +264,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_ssh_port_22_ipv4",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 to SSH port 22.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -284,13 +279,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_ssh_port_22_ipv6",
             "title": "Ensure no security groups allow ingress from ::/0 to SSH port 22.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -300,13 +294,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_ftp_port_20_21",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -316,13 +309,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_rdp_port_3389",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to port 3389.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -332,13 +324,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_rdp_port_3389_ipv4",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -348,13 +339,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_rdp_port_3389_ipv6",
             "title": "Ensure no security groups allow ingress from ::/0 to port 3389.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -364,13 +354,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_cassandra_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Cassandra ports 7199 or 9160 or 8888.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -380,13 +369,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_kibana_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -396,13 +384,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_kafka_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Kafka ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -412,13 +399,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_memcached_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Memcached ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -428,13 +414,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_mysql_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MySQL ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -444,13 +429,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_oracledb",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to OracleDB ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -460,13 +444,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_postgresql_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to PostgresQL ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -476,13 +459,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_redis_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Redis ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -492,13 +474,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_sql_server_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to SQLServer ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -508,13 +489,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "allow_ingress_from_internet_to_telnet_ports",
             "title": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet ports.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -524,13 +504,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "wide_open_ipv4_security_group",
             "title": "Security group is configured wide open.",
-            "result_kind": "aws_ec2_security_group",
+            "result_kinds": ["aws_ec2_security_group"],
             "categories": [ "security", "compliance" ],
             "risk": "If Security groups are not properly configured the attack surface is increased.",
             "severity": "high",
@@ -540,13 +519,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "default_restrict_traffic",
             "title": "Ensure the default security group of every VPC restricts all traffic.",
-            "result_kind": "aws_vpc",
+            "result_kinds": ["aws_vpc"],
             "categories": [ "security", "compliance" ],
             "risk": "Even having a perimeter firewall, having security groups open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
             "severity": "high",
@@ -556,13 +534,12 @@
             "remediation": {
                 "text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
                 "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "routing_tables_with_least_privilege",
             "title": "Ensure routing tables for VPC peering are least access.",
-            "result_kind": "aws_vpc",
+            "result_kinds": ["aws_vpc"],
             "categories": [ "security", "compliance" ],
             "risk": "Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC.",
             "severity": "medium",
@@ -578,7 +555,7 @@
         {
             "name": "volume_not_encrypted",
             "title": "Ensure there are no EBS Volumes unencrypted.",
-            "result_kind": "aws_ec2_volume",
+            "result_kinds": ["aws_ec2_volume"],
             "categories": [ "security", "compliance" ],
             "risk": "Data encryption at rest prevents data visibility in the event of its unauthorized access or theft.",
             "severity": "medium",
@@ -588,13 +565,12 @@
             "remediation": {
                 "text": "Encrypt all EBS volumes and Enable Encryption by default You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example; Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot.",
                 "url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"
-            },
-            "internal_notes": ""
+            }
         },
         {
             "name": "vpc_flow_logs_enabled",
             "title": "Ensure VPC Flow Logging is Enabled in all VPCs.",
-            "result_kind": "aws_vpc",
+            "result_kinds": ["aws_vpc"],
             "categories": [ "security", "compliance" ],
             "risk": "VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.",
             "severity": "medium",
@@ -604,8 +580,23 @@
             "remediation": {
                 "text": "It is recommended that VPC Flow Logs be enabled for packet Rejects for VPCs.",
                 "url": "http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html"
+            }
+        },
+        {
+            "name": "instance_imdsv2_enabled",
+            "title": "Ensure that EC2 Metadata Service only allows IMDSv2",
+            "result_kinds": ["aws_ec2_instance"],
+            "categories": [ "security", "compliance" ],
+            "risk": "Allowing Version 1 of the service may open EC2 instances to Server-Side Request Forgery (SSRF) attacks, so Amazon recommends utilizing Version 2 for better instance security.",
+            "severity": "medium",
+            "detect": {
+                "resoto": "is(aws_ec2_instance) and not instance_metadata_options.{(http_endpoint=enabled and http_tokens=required) or http_endpoint=disabled}"
             },
-            "internal_notes": ""
+            "remediation": {
+                "text": "Login to AWS Management Console and open the Amazon EC2 console using https://console.aws.amazon.com/ec2/ Under the Instances menu, select Instances.  For each Instance, select the instance, then choose Actions > Modify instance metadata options.  If the Instance metadata service is enabled, set IMDSv2 to Required.",
+                "awscli": "aws ec2 modify-instance-metadata-options --instance-id <instance_id> --http-tokens required",
+                "url": "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/:https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"
+            }
         }
     ]
 }
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_efs.json b/resotocore/resotocore/static/report/checks/aws/aws_efs.json
index 46d4f1c727..f7f667fa0f 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_efs.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_efs.json
@@ -5,7 +5,7 @@
         {
             "name": "storage_encrypted",
             "title": "Check if EFS protects sensitive data with encryption at rest",
-            "result_kind": "aws_efs_file_system",
+            "result_kinds": ["aws_efs_file_system"],
             "categories": ["security", "compliance"],
             "risk": "EFS should be encrypted at rest to prevent exposure of sensitive data to bad actors",
             "severity": "medium",
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_iam.json b/resotocore/resotocore/static/report/checks/aws/aws_iam.json
index 2f90c1f3ac..8cb1d5b39e 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_iam.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_iam.json
@@ -5,7 +5,7 @@
         {
             "name": "account_maintain_current_contact_details",
             "title": "Maintain current contact details.",
-            "result_kind": "aws_account",
+            "result_kinds": ["aws_account"],
             "categories": [ "security", "compliance" ],
             "risk": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details; and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy. If an AWS account is observed to be behaving in a prohibited or suspicious manner; AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation; proactive measures may be taken; including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question.",
             "severity": "medium",
@@ -20,7 +20,7 @@
         {
             "name": "account_security_contact_information_is_registered",
             "title": "Ensure security contact information is registered",
-            "result_kind": "aws_account",
+            "result_kinds": ["aws_account"],
             "categories": [ "security", "compliance" ],
             "risk": "AWS provides customers with the option of specifying the contact information for accounts security team. It is recommended that this information be provided. Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.",
             "severity": "medium",
@@ -35,7 +35,7 @@
         {
             "name": "account_security_questions_are_registered_in_the_aws_account",
             "title": "Ensure security questions are registered in the AWS account.",
-            "result_kind": "aws_account",
+            "result_kinds": ["aws_account"],
             "categories": [ "security", "compliance" ],
             "risk": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established. When creating a new AWS account a default super user is automatically created. This account is referred to as the root account. It is recommended that the use of this account be limited and highly controlled. During events in which the root password is no longer accessible or the MFA token associated with root is lost",
             "severity": "medium",
@@ -50,7 +50,7 @@
         {
             "name": "no_root_access_key",
             "title": "Ensure no root account access key exists",
-            "result_kind": "aws_root_user",
+            "result_kinds": ["aws_root_user"],
             "categories": [ "security", "compliance" ],
             "risk": "The root account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the root account be removed. Removing access keys associated with the root account limits vectors by which the account can be compromised. Removing the root access keys encourages the creation and use of role based accounts that are least privileged.",
             "severity": "critical",
@@ -65,7 +65,7 @@
         {
             "name": "root_mfa_enabled",
             "title": "Ensure MFA is enabled for the root account",
-            "result_kind": "aws_root_user",
+            "result_kinds": ["aws_root_user"],
             "categories": [ "security", "compliance" ],
             "risk": "The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled when a user signs in to an AWS website they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. When virtual MFA is used for root accounts it is recommended that the device used is NOT a personal device but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (non-personal virtual MFA) This lessens the risks of losing access to the MFA due to device loss / trade-in or if the individual owning the device is no longer employed at the company.",
             "severity": "critical",
@@ -80,7 +80,7 @@
         {
             "name": "root_hardware_mfa_enabled",
             "title": "Ensure hardware MFA is enabled for the root account",
-            "result_kind": "aws_root_user",
+            "result_kinds": ["aws_root_user"],
             "categories": [ "security", "compliance" ],
             "risk": "The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled when a user signs in to an AWS website they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2 it is recommended that the root account be protected with a hardware MFA./ trade-in or if the individual owning the device is no longer employed at the company.",
             "severity": "critical",
@@ -95,7 +95,7 @@
         {
             "name": "avoid_root_usage",
             "title": "Avoid the use of the root accounts",
-            "result_kind": "aws_root_user",
+            "result_kinds": ["aws_root_user"],
             "categories": [ "security", "compliance" ],
             "risk": "The root account has unrestricted access to all resources in the AWS account. It is highly recommended that the use of this account be avoided.",
             "severity": "critical",
@@ -113,7 +113,7 @@
         {
             "name": "password_policy_minimum_length_14",
             "title": "Ensure IAM password policy requires minimum length of 14 or greater",
-            "result_kind": "aws_account",
+            "result_kinds": ["aws_account"],
             "categories": [ "security", "compliance" ],
             "risk": "Password policies are used to enforce password complexity requirements. IAM password policies can be used to ensure password are comprised of different character sets. It is recommended that the password policy require minimum length of 14 or greater.",
             "severity": "medium",
@@ -128,7 +128,7 @@
         {
             "name": "password_policy_reuse_24",
             "title": "Ensure IAM password policy prevents password reuse: 24 or greater",
-            "result_kind": "aws_account",
+            "result_kinds": ["aws_account"],
             "categories": [ "security", "compliance" ],
             "risk": "Password policies are used to enforce password complexity requirements. IAM password policies can be used to ensure password are comprised of different character sets. It is recommended that the password policy prevents at least password reuse of 24 or greater.",
             "severity": "medium",
@@ -143,7 +143,7 @@
         {
             "name": "user_mfa_enabled_console_access",
             "title": "Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password.",
-            "result_kind": "aws_iam_user",
+            "result_kinds": ["aws_iam_user"],
             "categories": [ "security", "compliance" ],
             "risk": "Password policies are used to enforce password complexity requirements. IAM password policies can be used to ensure password are comprised of different character sets. It is recommended that the password policy prevents at least password reuse of 24 or greater.",
             "severity": "high",
@@ -158,7 +158,7 @@
         {
             "name": "user_uses_access_keys_console_access",
             "title": "Do not setup access keys during initial user setup for all IAM users that have a console password",
-            "result_kind": "aws_iam_access_key",
+            "result_kinds": ["aws_iam_access_key"],
             "categories": [ "security", "compliance" ],
             "risk": "AWS console defaults the checkbox for creating access keys to enabled. This results in many access keys being generated unnecessarily. In addition to unnecessary credentials; it also generates unnecessary management work in auditing and rotating these keys. Requiring that additional steps be taken by the user after their profile has been created will give a stronger indication of intent that access keys are (a) necessary for their work and (b) once the access key is established on an account that the keys may be in use somewhere in the organization.",
             "severity": "medium",
@@ -173,7 +173,7 @@
         {
             "name": "disable_old_credentials",
             "title": "Ensure credentials unused for 45 days or greater are disabled",
-            "result_kind": "aws_iam_access_key",
+            "result_kinds": ["aws_iam_access_key"],
             "categories": [ "security", "compliance" ],
             "risk": "To increase the security of your AWS account; remove IAM user credentials (that is; passwords and access keys) that are not needed. For example; when users leave your organization or no longer need AWS access.",
             "severity": "medium",
@@ -191,7 +191,7 @@
         {
             "name": "user_has_two_active_access_keys",
             "title": "Check if IAM users have two active access keys",
-            "result_kind": "aws_iam_user",
+            "result_kinds": ["aws_iam_user"],
             "categories": [ "security", "compliance" ],
             "risk": "Access Keys could be lost or stolen. It creates a critical risk.",
             "severity": "medium",
@@ -206,7 +206,7 @@
         {
             "name": "rotate_access_keys_after_90_days",
             "title": "Ensure access keys are rotated every 90 days or less",
-            "result_kind": "aws_iam_access_key",
+            "result_kinds": ["aws_iam_access_key"],
             "categories": [ "security", "compliance" ],
             "risk": "Access keys consist of an access key ID and secret access key which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI)- Tools for Windows PowerShell- the AWS SDKs- or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.",
             "severity": "medium",
@@ -224,7 +224,7 @@
         {
             "name": "policy_attached_only_to_group_or_roles",
             "title": "Ensure IAM policies are attached only to groups or roles",
-            "result_kind": "aws_iam_access_key",
+            "result_kinds": ["aws_iam_access_key"],
             "categories": [ "security", "compliance" ],
             "risk": "By default IAM users; groups; and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users; groups; or roles. It is recommended that IAM policies be applied directly to groups and roles but not users. Assigning privileges at the group or role level reduces the complexity of access management as the number of users grow. Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.",
             "severity": "low",
@@ -239,7 +239,7 @@
         {
             "name": "policy_with_administrative_privileges_not_in_use",
             "title": "Ensure IAM policies that allow full \"*:*\" administrative privileges are not in use.",
-            "result_kind": "aws_iam_policy",
+            "result_kinds": ["aws_iam_policy"],
             "categories": [ "security", "compliance" ],
             "risk": "IAM policies are the means by which privileges are granted to users; groups; or roles. It is recommended and considered a standard security advice to grant least privilege—that is; granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform only those tasks instead of allowing full administrative privileges. Providing full administrative privileges instead of restricting to the minimum set of permissions that the user is required to do exposes the resources to potentially unwanted actions.",
             "severity": "medium",
@@ -254,7 +254,7 @@
         {
             "name": "support_role_exists",
             "title": "Ensure a support role has been created to manage incidents with AWS Support",
-            "result_kind": "aws_account",
+            "result_kinds": ["aws_account"],
             "categories": [ "security", "compliance" ],
             "risk": "AWS provides a support center that can be used for incident notification and response; as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.",
             "severity": "medium",
@@ -269,7 +269,7 @@
         {
             "name": "expired_server_certificates",
             "title": "Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed.",
-            "result_kind": "aws_iam_server_certificate",
+            "result_kinds": ["aws_iam_server_certificate"],
             "categories": [ "security", "compliance" ],
             "risk": "Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB.",
             "severity": "critical",
@@ -292,7 +292,7 @@
         {
             "name": "access_analyzer_enabled",
             "title": "Check if IAM Access Analyzer is enabled.",
-            "result_kind": "aws_account",
+            "result_kinds": ["aws_account"],
             "categories": [ "security", "compliance" ],
             "risk": "AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer uses a form of mathematical analysis called automated reasoning, which applies logic and mathematical inference to determine all possible access paths allowed by a resource policy.",
             "severity": "low",
@@ -307,7 +307,7 @@
         {
             "name": "check_saml_providers_sts",
             "title": "Check if there are SAML Providers that can be used for STS",
-            "result_kind": "aws_account",
+            "result_kinds": ["aws_account"],
             "categories": [ "security", "compliance" ],
             "risk": "Without SAML provider users with AWS CLI or AWS API access can use IAM static credentials. SAML helps users to assume role by default each time they authenticate.",
             "severity": "low",
@@ -318,6 +318,21 @@
                 "text": "Enable SAML provider and use temporary credentials. You can use temporary security credentials to make programmatic requests for AWS resources using the AWS CLI or AWS API (using the AWS SDKs ). The temporary credentials provide the same permissions that you have with use long-term security credentials such as IAM user credentials. In case of not having SAML provider capabilities prevent usage of long-lived credentials.",
                 "url": "https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html"
             }
+        },
+        {
+            "name": "check_cloudshell_access_restricted",
+            "title": "Ensure access to AWSCloudShellFullAccess is restricted",
+            "result_kind": ["aws_iam_role", "aws_iam_user"],
+            "categories": [ "security", "compliance" ],
+            "risk": "Access to this policy should be restricted as it presents a potential channel for data exfiltration by malicious cloud admins that are given full permissions to the service. AWS documentation describes how to create a more restrictive IAM policy which denies file transfer permissions.",
+            "severity": "medium",
+            "detect": {
+                "resoto": "is(aws_iam_policy) and name==AWSCloudShellFullAccess <-- is(aws_iam_user, aws_iam_role)"
+            },
+            "remediation": {
+                "text": "Open the IAM console at https://console.aws.amazon.com/iam/  In the left pane, select Policies. Search for and select AWSCloudShellFullAccess.  On the Entities attached tab, for each item, check the box and select Detach.",
+                "url": "https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html"
+            }
         }
     ]
 }
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_kms.json b/resotocore/resotocore/static/report/checks/aws/aws_kms.json
index a8628da867..3636b66aaf 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_kms.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_kms.json
@@ -5,7 +5,7 @@
         {
             "name": "key_rotation_enabled",
             "title": "Ensure rotation for customer created KMS CMKs is enabled.",
-            "result_kind": "aws_kms_key",
+            "result_kinds": ["aws_kms_key"],
             "categories": ["security", "compliance"],
             "risk": "Cryptographic best practices discourage extensive reuse of encryption keys. Consequently, Customer Master Keys (CMKs) should be rotated to prevent usage of compromised keys.",
             "severity": "medium",
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_lambda.json b/resotocore/resotocore/static/report/checks/aws/aws_lambda.json
index bd6d11aa2f..e22d8395d3 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_lambda.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_lambda.json
@@ -5,7 +5,7 @@
         {
             "name": "not_publicly_accessible",
             "title": "Check if Lambda functions have resource-based policy set as Public.",
-            "result_kind": "aws_lambda_function",
+            "result_kinds": ["aws_lambda_function"],
             "categories": [
                 "security",
                 "compliance"
@@ -24,7 +24,7 @@
         {
             "name": "cors_policy",
             "title": "Check Lambda Function URL CORS configuration.",
-            "result_kind": "aws_lambda_function",
+            "result_kinds": ["aws_lambda_function"],
             "categories": [
                 "security",
                 "compliance"
@@ -46,7 +46,7 @@
         {
             "name": "is_public",
             "title": "Check Public Lambda Function URL.",
-            "result_kind": "aws_lambda_function",
+            "result_kinds": ["aws_lambda_function"],
             "categories": [
                 "security",
                 "compliance"
@@ -68,7 +68,7 @@
         {
             "name": "supported_runtime",
             "title": "Check that Lambda does not use an obsolete runtime.",
-            "result_kind": "aws_lambda_function",
+            "result_kinds": ["aws_lambda_function"],
             "categories": [
                 "security",
                 "compliance"
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_rds.json b/resotocore/resotocore/static/report/checks/aws/aws_rds.json
index 8a5105bbdf..6ab47685ad 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_rds.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_rds.json
@@ -5,7 +5,7 @@
         {
             "name": "storage_encrypted",
             "title": "Check if RDS instances storage is encrypted.",
-            "result_kind": "aws_rds_instance",
+            "result_kinds": ["aws_rds_instance"],
             "categories": ["security", "compliance"],
             "risk": "If not enabled sensitive information at rest is not protected.",
             "severity": "medium",
@@ -20,7 +20,7 @@
         {
             "name": "auto_minor_version_upgrade",
             "title": "Ensure RDS instances have minor version upgrade enabled.",
-            "result_kind": "aws_rds_instance",
+            "result_kinds": ["aws_rds_instance"],
             "categories": ["security", "compliance"],
             "risk": "Auto Minor Version Upgrade is a feature that you can enable to have your database automatically upgraded when a new minor database engine version is available. Minor version upgrades often patch security vulnerabilities and fix bugs and therefore should be applied.",
             "severity": "low",
@@ -35,7 +35,7 @@
         {
             "name": "no_public_access",
             "title": "Ensure there are no Public Accessible RDS instances.",
-            "result_kind": "aws_rds_instance",
+            "result_kinds": ["aws_rds_instance"],
             "categories": ["security", "compliance"],
             "risk": "Publicly accessible databases could expose sensitive data to bad actors.",
             "severity": "critical",
diff --git a/resotocore/resotocore/static/report/checks/aws/aws_s3.json b/resotocore/resotocore/static/report/checks/aws/aws_s3.json
index c4d0d7913f..6dbb77e8d3 100644
--- a/resotocore/resotocore/static/report/checks/aws/aws_s3.json
+++ b/resotocore/resotocore/static/report/checks/aws/aws_s3.json
@@ -5,7 +5,7 @@
         {
             "name": "bucket_default_encryption",
             "title": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.",
-            "result_kind": "aws_s3_bucket",
+            "result_kinds": ["aws_s3_bucket"],
             "categories": [
                 "security",
                 "compliance"
@@ -27,7 +27,7 @@
         {
             "name": "bucket_no_mfa_delete",
             "title": "Check if S3 bucket MFA Delete is not enabled.",
-            "result_kind": "aws_s3_bucket",
+            "result_kinds": ["aws_s3_bucket"],
             "categories": [
                 "security",
                 "compliance"
@@ -49,7 +49,7 @@
         {
             "name": "bucket_secure_transport_policy",
             "title": "Check if S3 buckets have secure transport policy.",
-            "result_kind": "aws_s3_bucket",
+            "result_kinds": ["aws_s3_bucket"],
             "categories": [
                 "security",
                 "compliance"
@@ -68,7 +68,7 @@
         {
             "name": "macie_is_enabled",
             "title": "Check if Amazon Macie is enabled.",
-            "result_kind": "aws_s3_bucket",
+            "result_kinds": ["aws_s3_bucket"],
             "categories": [
                 "security",
                 "compliance"
@@ -87,7 +87,7 @@
         {
             "name": "account_level_public_access_blocks",
             "title": "Check S3 Account Level Public Access Block.",
-            "result_kind": "aws_s3_bucket",
+            "result_kinds": ["aws_s3_bucket"],
             "categories": [
                 "security",
                 "compliance"


Test patch:
diff --git a/resotocore/tests/resotocore/conftest.py b/resotocore/tests/resotocore/conftest.py
index 1e719e594e..589462f425 100644
--- a/resotocore/tests/resotocore/conftest.py
+++ b/resotocore/tests/resotocore/conftest.py
@@ -611,7 +611,7 @@ async def test_benchmark(config_handler: ConfigHandler) -> Benchmark:
                         "id": "test_test_some_check",
                         "name": "some_check",
                         "title": "Test",
-                        "result_kind": "foo",
+                        "result_kinds": ["foo"],
                         "categories": [],
                         "risk": "Some risk",
                         "severity": "medium",