Project: Checkov (Provisioning / Security & Compliance)
File: serverless.md

layout: default title: serverless resource scans nav_order: 1 | | Id | Type | Entity | Policy | IaC | Resource Link | |-||-|-|-||--| | 0 | CKVAWS1 | resource | serverless_aws | Ensure IAM policies that allow full "-" administrative privileges are not created | serverless | | | 1 | CKVAWS41 | resource | serverless_aws | Ensure no hard coded AWS access key and secret key exists in provider | serverless | | | 2 | CKVAWS49 | resource | serverless_aws | Ensure no IAM policies documents allow "*" as a statement's actions | serverless | | | | Id | Type | Entity | Policy | IaC | Resource Link | |--|-|-|-|-|-|--| | 0 | CKVAWS2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | | | 1 | CKVAWS3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | | | 2 | CKVAWS5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | | | 3 | CKVAWS6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | | | 4 | CKVAWS7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | | | 5 | CKVAWS8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | | | 6 | CKVAWS16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | | | 7 | CKVAWS17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | | | 8 | CKVAWS18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | | | 9 | CKVAWS19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | | | 10 | CKVAWS20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | | | 11 | CKVAWS21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | | | 12 | CKVAWS23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | | | 13 | CKVAWS23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | | | 14 | CKVAWS23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | | | 15 | CKVAWS24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | | | 16 | CKVAWS24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | | | 17 | CKVAWS25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | | | 18 | CKVAWS25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from

to port 3389 | Cloudformation | | | 19 | CKVAWS26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | | | 20 | CKVAWS27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | | | 21 | CKVAWS28 | resource | AWS::DynamoDB::Table | Ensure DynamoDB point in time recovery (backup) is enabled | Cloudformation | | | 22 | CKVAWS29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest | Cloudformation | | | 23 | CKVAWS30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit | Cloudformation | | | 24 | CKVAWS31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token | Cloudformation | | | 25 | CKVAWS32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | | | 26 | CKVAWS33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | | | 27 | CKVAWS34 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | | | 28 | CKVAWS35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | | | 29 | CKVAWS36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | | | 30 | CKVAWS40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive

| Cloudformation | | | 31 | CKVAWS42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | | | 32 | CKVAWS43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | | | 33 | CKVAWS44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | | | 34 | CKVAWS45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | | | 35 | CKVAWS45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | | | 36 | CKVAWS46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | | | 37 | CKVAWS47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | | | 38 | CKVAWS51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | | | 39 | CKVAWS53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLs enabled | Cloudformation | | | 40 | CKVAWS54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | | | 41 | CKVAWS55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | | | 42 | CKVAWS56 | resource | AWS::S3::Bucket | Ensure S3 bucket has RestrictPublicBuckets enabled | Cloudformation | | | 43 | CKVAWS57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | | | 44 | CKVAWS58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | | | 45 | CKVAWS59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | | | 46 | CKVAWS60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | | | 47 | CKVAWS61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | | | 48 | CKVAWS62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "-" administrative privileges are not created | Cloudformation | | | 49 | CKVAWS62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "-" administrative privileges are not created | Cloudformation | | | 50 | CKVAWS62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "-" administrative privileges are not created | Cloudformation | | | 51 | CKVAWS62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "-" administrative privileges are not created | Cloudformation | | | 52 | CKVAWS63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | | | 53 | CKVAWS63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | | | 54 | CKVAWS63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | | | 55 | CKVAWS63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | | | 56 | CKVAWS64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | | | 57 | CKVAWS65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | | | 58 | CKVAWS66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | | | 59 | CKVAWS67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | | | 60 | CKVAWS68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | | | 61 | CKVAWS69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | | | 62 | CKVAWS71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | | | 63 | CKVAWS73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | | | 64 | CKVAWS73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | | | 65 | CKVAWS74 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB is encrypted at rest (default is unencrypted) | Cloudformation | | | 66 | CKVAWS76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | | | 67 | CKVAWS76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | | | 68 | CKVAWS78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | | | 69 | CKVAWS79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | | | 70 | CKVAWS80 | resource | AWS::MSK::Cluster | Ensure MSK Cluster logging is enabled | Cloudformation | | | 71 | CKVAWS81 | resource | AWS::MSK::Cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Cloudformation | | | 72 | CKVAWS82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | | | 73 | CKVAWS83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | | | 74 | CKVAWS84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | | | 75 | CKVAWS84 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | | | 76 | CKVAWS85 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB Logging is enabled | Cloudformation | | | 77 | CKVAWS86 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution has Access Logging enabled | Cloudformation | | | 78 | CKVAWS87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | | | 79 | CKVAWS88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | | | 80 | CKVAWS88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | | | 81 | CKVAWS89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | | | 82 | CKVAWS90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB TLS is not disabled | Cloudformation | | | 83 | CKVAWS91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | | | 84 | CKVAWS92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | | | 85 | CKVAWS94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | | | 86 | CKVAWS95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | | | 87 | CKVAWS95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | | | 88 | CKVAWS96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | | | 89 | CKVAWS97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | | | 90 | CKVAWS99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | | | 91 | CKVAWS100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | | | 92 | CKVAWS101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | | | 93 | CKVAWS103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS

| Cloudformation | | | 94 | CKVAWS104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB has audit logs enabled | Cloudformation | | | 95 | CKVAWS105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | | | 96 | CKVAWS107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 97 | CKVAWS107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 98 | CKVAWS107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 99 | CKVAWS107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 100 | CKVAWS107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 101 | CKVAWS108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 102 | CKVAWS108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 103 | CKVAWS108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 104 | CKVAWS108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 105 | CKVAWS108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 106 | CKVAWS109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 107 | CKVAWS109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 108 | CKVAWS109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 109 | CKVAWS109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 110 | CKVAWS109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 111 | CKVAWS110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 112 | CKVAWS110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 113 | CKVAWS110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 114 | CKVAWS110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 115 | CKVAWS110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 116 | CKVAWS111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 117 | CKVAWS111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 118 | CKVAWS111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 119 | CKVAWS111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 120 | CKVAWS111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 121 | CKVAWS115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | | | 122 | CKVAWS115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | | | 123 | CKVAWS116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | | | 124 | CKVAWS116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | | | 125 | CKVAWS117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | | | 126 | CKVAWS117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | | | 127 | CKVAWS118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | | | 128 | CKVAWS119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | | | 129 | CKVAWS120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | | | 130 | CKVAWS120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | | | 131 | CKVAWS123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | | | 132 | CKVAWS131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | | | 133 | CKVAWS136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | | | 134 | CKVAWS149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | | | 135 | CKVAWS154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | | | 136 | CKVAWS155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | | | 137 | CKVAWS156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | | | 138 | CKVAWS157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | | | 139 | CKVAWS158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | | | 140 | CKVAWS160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | | | 141 | CKVAWS161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | | | 142 | CKVAWS162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | | | 143 | CKVAWS163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | | | 144 | CKVAWS164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed

| Cloudformation | | | 145 | CKVAWS165 | resource | AWS::DynamoDB::GlobalTable | Ensure DynamoDB global table point in time recovery (backup) is enabled | Cloudformation | | | 146 | CKVAWS166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | | | 147 | CKVAWS170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | | | 148 | CKVAWS172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | | | 149 | CKVAWS173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environment variable | Cloudformation | | | 150 | CKVAWS173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environment variable | Cloudformation | | | 151 | CKVAWS174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Cloudformation | | | 152 | CKVAWS192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | | | 153 | CKVAWS193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | | | 154 | CKVAWS194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | | | 155 | CKVAWS195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | | | 156 | CKVAWS195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | | | 157 | CKVAWS195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | | | 158 | CKVAWS197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | | | 159 | CKVAWS258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | | | 160 | CKVAWS260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | | | 161 | CKVAWS260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | | | 162 | CKVAWS291 | resource | AWS::MSK::Cluster | Ensure MSK nodes are private | Cloudformation | | | 163 | CKVAWS317 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | | | 164 | CKVAWS317 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | | | 165 | CKVAWS360 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB has an adequate backup retention period | Cloudformation | | | 166 | CKVAWS361 | resource | AWS::Neptune::DBCluster | Ensure that Neptune DB cluster has automated backups enabled with adequate retention | Cloudformation | | | 167 | CKVAWS363 | resource | AWS::Lambda::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | | | 168 | CKVAWS363 | resource | AWS::Serverless::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | | | 169 | CKVAWS364 | resource | AWS::Lambda::Permission | Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount | Cloudformation | | | 170 | CKVAWS366 | resource | AWS::Cognito::IdentityPool | Ensure AWS Cognito identity pool does not allow unauthenticated guest access | Cloudformation | | | 171 | CKV2AWS33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | |