Project: Checkov (Provisioning / Security & Compliance)
File: all.md

layout: default title: all resource scans nav_order: 1 | | Id | Type | Entity | Policy | IaC | Resource Link | ||--|-|--|-|-|--| | 0 | CKV2ADO1 | resource | azuredevopsbranchpolicyminreviewers | Ensure at least two approving reviews for PRs | Terraform | | | 1 | CKV2ADO1 | resource | azuredevopsgitrepository | Ensure at least two approving reviews for PRs | Terraform | | | 2 | CKVALI1 | resource | alicloudossbucket | Alibaba Cloud OSS bucket accessible to public | Terraform | | | 3 | CKVALI2 | resource | alicloudsecuritygroup_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | | | 4 | CKVALI3 | resource | alicloudsecuritygroup_rule | Ensure no security groups allow ingress from

to port 3389 | Terraform | | | 5 | CKVALI4 | resource | alicloudactiontrailtrail | Ensure Action Trail Logging for all regions | Terraform | | | 6 | CKVALI5 | resource | alicloudactiontrailtrail | Ensure Action Trail Logging for all events | Terraform | | | 7 | CKVALI6 | resource | alicloudossbucket | Ensure OSS bucket is encrypted with Customer Master Key | Terraform | | | 8 | CKVALI7 | resource | alicloud_disk | Ensure disk is encrypted | Terraform | | | 9 | CKVALI8 | resource | alicloud_disk | Ensure Disk is encrypted with Customer Master Key | Terraform | | | 10 | CKVALI9 | resource | aliclouddbinstance | Ensure database instance is not public | Terraform | | | 11 | CKVALI10 | resource | alicloudossbucket | Ensure OSS bucket has versioning enabled | Terraform | | | 12 | CKVALI11 | resource | alicloudossbucket | Ensure OSS bucket has transfer Acceleration enabled | Terraform | | | 13 | CKVALI12 | resource | alicloudossbucket | Ensure the OSS bucket has access logging enabled | Terraform | | | 14 | CKVALI13 | resource | alicloudramaccountpasswordpolicy | Ensure RAM password policy requires minimum length of 14 or greater | Terraform | | | 15 | CKVALI14 | resource | alicloudramaccountpasswordpolicy | Ensure RAM password policy requires at least one number | Terraform | | | 16 | CKVALI15 | resource | alicloudramaccountpasswordpolicy | Ensure RAM password policy requires at least one symbol | Terraform | | | 17 | CKVALI16 | resource | alicloudramaccountpasswordpolicy | Ensure RAM password policy expires passwords within 90 days or less | Terraform | | | 18 | CKVALI17 | resource | alicloudramaccountpasswordpolicy | Ensure RAM password policy requires at least one lowercase letter | Terraform | | | 19 | CKVALI18 | resource | alicloudramaccountpasswordpolicy | Ensure RAM password policy prevents password reuse | Terraform | | | 20 | CKVALI19 | resource | alicloudramaccountpasswordpolicy | Ensure RAM password policy requires at least one uppercase letter | Terraform | | | 21 | CKVALI20 | resource | aliclouddbinstance | Ensure RDS instance uses SSL | Terraform | | | 22 | CKVALI21 | resource | alicloudapigateway_api | Ensure API Gateway API Protocol HTTPS | Terraform | | | 23 | CKVALI22 | resource | aliclouddbinstance | Ensure Transparent Data Encryption is Enabled on instance | Terraform | | | 24 | CKVALI23 | resource | alicloudramaccountpasswordpolicy | Ensure Ram Account Password Policy Max Login Attempts not > 5 | Terraform | | | 25 | CKVALI24 | resource | alicloudramsecurity_preference | Ensure RAM enforces MFA | Terraform | | | 26 | CKVALI25 | resource | aliclouddbinstance | Ensure RDS Instance SQL Collector Retention Period should be greater than 180 | Terraform | | | 27 | CKVALI26 | resource | alicloudcskubernetes | Ensure Kubernetes installs plugin Terway or Flannel to support standard policies | Terraform | | | 28 | CKVALI27 | resource | alicloudkmskey | Ensure KMS Key Rotation is enabled | Terraform | | | 29 | CKVALI28 | resource | alicloudkmskey | Ensure KMS Keys are enabled | Terraform | | | 30 | CKVALI29 | resource | alicloudalbaclentryattachment | Alibaba ALB ACL does not restrict Access | Terraform | | | 31 | CKVALI30 | resource | aliclouddbinstance | Ensure RDS instance auto upgrades for minor versions | Terraform | | | 32 | CKVALI31 | resource | alicloudcskubernetesnodepool | Ensure K8s nodepools are set to auto repair | Terraform | | | 33 | CKVALI32 | resource | alicloudecslaunch_template | Ensure launch template data disks are encrypted | Terraform | | | 34 | CKVALI33 | resource | alicloudslbtlscipherpolicy | Alibaba Cloud Cypher Policy are secure | Terraform | | | 35 | CKVALI35 | resource | aliclouddbinstance | Ensure RDS instance has log_duration enabled | Terraform | | | 36 | CKVALI36 | resource | aliclouddbinstance | Ensure RDS instance has log_disconnections enabled | Terraform | | | 37 | CKVALI37 | resource | aliclouddbinstance | Ensure RDS instance has log_connections enabled | Terraform | | | 38 | CKVALI38 | resource | alicloudlogaudit | Ensure log audit is enabled for RDS | Terraform | | | 39 | CKVALI41 | resource | alicloudmongodbinstance | Ensure MongoDB is deployed inside a VPC | Terraform | | | 40 | CKVALI42 | resource | alicloudmongodbinstance | Ensure Mongodb instance uses SSL | Terraform | | | 41 | CKVALI43 | resource | alicloudmongodbinstance | Ensure MongoDB instance is not public | Terraform | | | 42 | CKVALI44 | resource | alicloudmongodbinstance | Ensure MongoDB has Transparent Data Encryption Enabled | Terraform | | | 43 | CKVANSIBLE1 | resource | | | 44 | CKVANSIBLE1 | resource | | | 45 | CKVANSIBLE1 | resource | | | 46 | CKVANSIBLE1 | resource | | | 47 | CKVANSIBLE1 | resource | | | 48 | CKVANSIBLE1 | resource | | | 49 | CKVANSIBLE1 | resource | | | 50 | CKVANSIBLE1 | resource | | | 51 | CKVANSIBLE1 | resource | | | 52 | CKVANSIBLE1 | resource | | | 53 | CKVANSIBLE1 | resource | | | 54 | CKVANSIBLE1 | resource | | | 55 | CKVANSIBLE1 | resource | | | 56 | CKVANSIBLE1 | resource | | | 57 | CKVANSIBLE1 | resource | | | 58 | CKVANSIBLE1 | resource | | | 59 | CKVANSIBLE2 | resource | | | 60 | CKVANSIBLE2 | resource | | | 61 | CKVANSIBLE2 | resource | | | 62 | CKVANSIBLE2 | resource | | | 63 | CKVANSIBLE2 | resource | | | 64 | CKVANSIBLE2 | resource | | | 65 | CKVANSIBLE2 | resource | | | 66 | CKVANSIBLE2 | resource | | | 67 | CKVANSIBLE2 | resource | | | 68 | CKVANSIBLE2 | resource | | | 69 | CKVANSIBLE2 | resource | | | 70 | CKVANSIBLE2 | resource | | | 71 | CKVANSIBLE2 | resource | | | 72 | CKVANSIBLE2 | resource | | | 73 | CKVANSIBLE2 | resource | | | 74 | CKVANSIBLE2 | resource | | | 75 | CKVANSIBLE3 | resource | | | 76 | CKVANSIBLE3 | resource | | | 77 | CKVANSIBLE3 | resource | | | 78 | CKVANSIBLE3 | resource | | | 79 | CKVANSIBLE3 | resource | | | 80 | CKVANSIBLE3 | resource | | | 81 | CKVANSIBLE3 | resource | | | 82 | CKVANSIBLE3 | resource | | | 83 | CKVANSIBLE3 | resource | | | 84 | CKVANSIBLE3 | resource | | | 85 | CKVANSIBLE3 | resource | | | 86 | CKVANSIBLE3 | resource | | | 87 | CKVANSIBLE3 | resource | | | 88 | CKVANSIBLE3 | resource | | | 89 | CKVANSIBLE3 | resource | | | 90 | CKVANSIBLE3 | resource | | | 91 | CKVANSIBLE4 | resource | | | 92 | CKVANSIBLE4 | resource | | | 93 | CKVANSIBLE4 | resource | | | 94 | CKVANSIBLE4 | resource | | | 95 | CKVANSIBLE4 | resource | | | 96 | CKVANSIBLE4 | resource | | | 97 | CKVANSIBLE4 | resource | | | 98 | CKVANSIBLE4 | resource | | | 99 | CKVANSIBLE4 | resource | | | 100 | CKVANSIBLE4 | resource | | | 101 | CKVANSIBLE4 | resource | | | 102 | CKVANSIBLE4 | resource | | | 103 | CKVANSIBLE4 | resource | | | 104 | CKVANSIBLE4 | resource | | | 105 | CKVANSIBLE4 | resource | | | 106 | CKVANSIBLE4 | resource | | | 107 | CKVANSIBLE5 | resource | | | 108 | CKVANSIBLE5 | resource | | | 109 | CKVANSIBLE5 | resource | | | 110 | CKVANSIBLE5 | resource | | | 111 | CKVANSIBLE5 | resource | | | 112 | CKVANSIBLE5 | resource | | | 113 | CKVANSIBLE5 | resource | | | 114 | CKVANSIBLE5 | resource | | | 115 | CKVANSIBLE5 | resource | | | 116 | CKVANSIBLE5 | resource | | | 117 | CKVANSIBLE5 | resource | | | 118 | CKVANSIBLE5 | resource | | | 119 | CKVANSIBLE5 | resource | | | 120 | CKVANSIBLE5 | resource | | | 121 | CKVANSIBLE5 | resource | | | 122 | CKVANSIBLE5 | resource | | | 123 | CKVANSIBLE6 | resource | | | 124 | CKVANSIBLE6 | resource | | | 125 | CKVANSIBLE6 | resource | | | 126 | CKVANSIBLE6 | resource | | | 127 | CKVANSIBLE6 | resource | | | 128 | CKVANSIBLE6 | resource | | | 129 | CKVANSIBLE6 | resource | | | 130 | CKVANSIBLE6 | resource | | | 131 | CKVANSIBLE6 | resource | | | 132 | CKVANSIBLE6 | resource | | | 133 | CKVANSIBLE6 | resource | | | 134 | CKVANSIBLE6 | resource | | | 135 | CKVANSIBLE6 | resource | | | 136 | CKVANSIBLE6 | resource | | | 137 | CKVANSIBLE6 | resource | | | 138 | CKVANSIBLE6 | resource | | | 139 | CKV2ANSIBLE1 | resource | tasks.ansible.builtin.uri | Ensure that HTTPS url is used with uri | Ansible | | | 140 | CKV2ANSIBLE1 | resource | tasks.uri | Ensure that HTTPS url is used with uri | Ansible | | | 141 | CKV2ANSIBLE2 | resource | tasks.ansible.builtin.geturl | Ensure that HTTPS url is used with geturl | Ansible | | | 142 | CKV2ANSIBLE2 | resource | tasks.geturl | Ensure that HTTPS url is used with geturl | Ansible | | | 143 | CKV2ANSIBLE3 | resource | block | Ensure block is handling task errors properly | Ansible | | | 144 | CKV2ANSIBLE4 | resource |

| Ensure that packages with untrusted or missing GPG signatures are not used by dnf | Ansible | | | 145 | CKV2ANSIBLE4 | resource | tasks.dnf | Ensure that packages with untrusted or missing GPG signatures are not used by dnf | Ansible | | | 146 | CKV2ANSIBLE5 | resource | tasks.ansible.builtin.dnf | Ensure that SSL validation isn't disabled with dnf | Ansible | | | 147 | CKV2ANSIBLE5 | resource | tasks.dnf | Ensure that SSL validation isn't disabled with dnf | Ansible | | | 148 | CKV2ANSIBLE6 | resource | tasks.ansible.builtin.dnf | Ensure that certificate validation isn't disabled with dnf | Ansible | | | 149 | CKV2ANSIBLE6 | resource |

| Ensure that certificate validation isn't disabled with dnf | Ansible | | | 150 | CKVARGO1 | argo_workflows | spec | Ensure Workflow pods are not using the default ServiceAccount | Argo Workflows | | | 151 | CKVARGO2 | argo_workflows | spec | Ensure Workflow pods are running as non-root user | Argo Workflows | | | 152 | CKVAWS1 | data | awsiampolicy_document | Ensure IAM policies that allow full "-" administrative privileges are not created | Terraform | | | 153 | CKVAWS1 | resource | serverless_aws | Ensure IAM policies that allow full "-" administrative privileges are not created | serverless | | | 154 | CKVAWS2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | | | 155 | CKVAWS2 | resource | awsalblistener | Ensure ALB protocol is HTTPS | Terraform | | | 156 | CKVAWS2 | resource | awslblistener | Ensure ALB protocol is HTTPS | Terraform | | | 157 | CKVAWS3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | | | 158 | CKVAWS3 | resource | awsebsvolume | Ensure all data stored in the EBS is securely encrypted | Terraform | | | 159 | CKVAWS5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | | | 160 | CKVAWS5 | resource | awselasticsearchdomain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | | | 161 | CKVAWS5 | resource | awsopensearchdomain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | | | 162 | CKVAWS6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | | | 163 | CKVAWS6 | resource | awselasticsearchdomain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | | | 164 | CKVAWS6 | resource | awsopensearchdomain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | | | 165 | CKVAWS7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | | | 166 | CKVAWS7 | resource | awskmskey | Ensure rotation for customer created CMKs is enabled | Terraform | | | 167 | CKVAWS8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | | | 168 | CKVAWS8 | resource | aws_instance | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | | | 169 | CKVAWS8 | resource | awslaunchconfiguration | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | | | 170 | CKVAWS9 | resource | awsiamaccountpasswordpolicy | Ensure IAM password policy expires passwords within 90 days or less | Terraform | | | 171 | CKVAWS10 | resource | awsiamaccountpasswordpolicy | Ensure IAM password policy requires minimum length of 14 or greater | Terraform | | | 172 | CKVAWS11 | resource | awsiamaccountpasswordpolicy | Ensure IAM password policy requires at least one lowercase letter | Terraform | | | 173 | CKVAWS12 | resource | awsiamaccountpasswordpolicy | Ensure IAM password policy requires at least one number | Terraform | | | 174 | CKVAWS13 | resource | awsiamaccountpasswordpolicy | Ensure IAM password policy prevents password reuse | Terraform | | | 175 | CKVAWS14 | resource | awsiamaccountpasswordpolicy | Ensure IAM password policy requires at least one symbol | Terraform | | | 176 | CKVAWS15 | resource | awsiamaccountpasswordpolicy | Ensure IAM password policy requires at least one uppercase letter | Terraform | | | 177 | CKVAWS16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | | | 178 | CKVAWS16 | resource | awsdbinstance | Ensure all data stored in the RDS is securely encrypted at rest | Terraform | | | 179 | CKVAWS17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | | | 180 | CKVAWS17 | resource | awsdbinstance | Ensure all data stored in RDS is not publicly accessible | Terraform | | | 181 | CKVAWS17 | resource | awsrdscluster_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | | | 182 | CKVAWS18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | | | 183 | CKVAWS18 | resource | awss3bucket | Ensure the S3 bucket has access logging enabled | Terraform | | | 184 | CKVAWS19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | | | 185 | CKVAWS19 | resource | awss3bucket | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | | | 186 | CKVAWS19 | resource | awss3bucketserversideencryptionconfiguration | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | | | 187 | CKVAWS20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | | | 188 | CKVAWS20 | resource | awss3bucket | S3 Bucket has an ACL defined which allows public READ access. | Terraform | | | 189 | CKVAWS20 | resource | awss3bucket_acl | S3 Bucket has an ACL defined which allows public READ

| Terraform | | | 190 | CKVAWS21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | | | 191 | CKVAWS21 | resource | awss3bucket | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | | | 192 | CKVAWS21 | resource | awss3bucket_versioning | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | | | 193 | CKVAWS22 | resource | awssagemakernotebook_instance | Ensure SageMaker Notebook is encrypted at rest using KMS CMK | Terraform | | | 194 | CKVAWS23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | | | 195 | CKVAWS23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | | | 196 | CKVAWS23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | | | 197 | CKVAWS23 | resource | awsdbsecurity_group | Ensure every security group and rule has a description | Terraform | | | 198 | CKVAWS23 | resource | awselasticachesecurity_group | Ensure every security group and rule has a description | Terraform | | | 199 | CKVAWS23 | resource | awsredshiftsecurity_group | Ensure every security group and rule has a description | Terraform | | | 200 | CKVAWS23 | resource | awssecuritygroup | Ensure every security group and rule has a description | Terraform | | | 201 | CKVAWS23 | resource | awssecuritygroup_rule | Ensure every security group and rule has a description | Terraform | | | 202 | CKVAWS23 | resource | awsvpcsecuritygroupegress_rule | Ensure every security group and rule has a description | Terraform | | | 203 | CKVAWS23 | resource | awsvpcsecuritygroupingress_rule | Ensure every security group and rule has a description | Terraform | | | 204 | CKVAWS24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | | | 205 | CKVAWS24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | | | 206 | CKVAWS24 | resource | awssecuritygroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | | | 207 | CKVAWS24 | resource | awssecuritygroup_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | | | 208 | CKVAWS24 | resource | awsvpcsecuritygroupingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | | | 209 | CKVAWS25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | | | 210 | CKVAWS25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | | | 211 | CKVAWS25 | resource | awssecuritygroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | | | 212 | CKVAWS25 | resource | awssecuritygroup_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | | | 213 | CKVAWS25 | resource | awsvpcsecuritygroupingress_rule | Ensure no security groups allow ingress from

to port 3389 | Terraform | | | 214 | CKVAWS26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | | | 215 | CKVAWS26 | resource | awssnstopic | Ensure all data stored in the SNS topic is encrypted | Terraform | | | 216 | CKVAWS27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | | | 217 | CKVAWS27 | resource | awssqsqueue | Ensure all data stored in the SQS queue is encrypted | Terraform | | | 218 | CKVAWS28 | resource | AWS::DynamoDB::Table | Ensure DynamoDB point in time recovery (backup) is enabled | Cloudformation | | | 219 | CKVAWS28 | resource | awsdynamodbtable | Ensure DynamoDB point in time recovery (backup) is enabled | Terraform | | | 220 | CKVAWS29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest | Cloudformation | | | 221 | CKVAWS29 | resource | awselasticachereplication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest | Terraform | | | 222 | CKVAWS30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit | Cloudformation | | | 223 | CKVAWS30 | resource | awselasticachereplication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit | Terraform | | | 224 | CKVAWS31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token | Cloudformation | | | 225 | CKVAWS31 | resource | awselasticachereplication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token | Terraform | | | 226 | CKVAWS32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | | | 227 | CKVAWS32 | resource | awsecrrepository_policy | Ensure ECR policy is not set to public | Terraform | | | 228 | CKVAWS33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | | | 229 | CKVAWS33 | resource | awskmskey | Ensure KMS key policy does not contain wildcard (*) principal | Terraform | | | 230 | CKVAWS34 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | | | 231 | CKVAWS34 | resource | awscloudfrontdistribution | Ensure CloudFront distribution ViewerProtocolPolicy is set to HTTPS | Terraform | | | 232 | CKVAWS35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | | | 233 | CKVAWS35 | resource | aws_cloudtrail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Terraform | | | 234 | CKVAWS36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | | | 235 | CKVAWS36 | resource | aws_cloudtrail | Ensure CloudTrail log file validation is enabled | Terraform | | | 236 | CKVAWS37 | resource | awsekscluster | Ensure Amazon EKS control plane logging is enabled for all log types | Terraform | | | 237 | CKVAWS38 | resource | awsekscluster | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 | Terraform | | | 238 | CKVAWS39 | resource | awsekscluster | Ensure Amazon EKS public endpoint disabled | Terraform | | | 239 | CKVAWS40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | | | 240 | CKVAWS40 | resource | awsiampolicy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | | | 241 | CKVAWS40 | resource | awsiamuser_policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | | | 242 | CKVAWS40 | resource | awsiamuserpolicyattachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive

| Terraform | | | 243 | CKVAWS41 | provider | aws | Ensure no hard coded AWS access key and secret key exists in provider | Terraform | | | 244 | CKVAWS41 | resource | serverless_aws | Ensure no hard coded AWS access key and secret key exists in provider | serverless | | | 245 | CKVAWS42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | | | 246 | CKVAWS42 | resource | awsefsfile_system | Ensure EFS is securely encrypted | Terraform | | | 247 | CKVAWS43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | | | 248 | CKVAWS43 | resource | awskinesisstream | Ensure Kinesis Stream is securely encrypted | Terraform | | | 249 | CKVAWS44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | | | 250 | CKVAWS44 | resource | awsneptunecluster | Ensure Neptune storage is securely encrypted | Terraform | | | 251 | CKVAWS45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | | | 252 | CKVAWS45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | | | 253 | CKVAWS45 | resource | awslambdafunction | Ensure no hard-coded secrets exist in lambda environment | Terraform | | | 254 | CKVAWS46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | | | 255 | CKVAWS46 | resource | aws_instance | Ensure no hard-coded secrets exist in EC2 user data | Terraform | | | 256 | CKVAWS46 | resource | awslaunchconfiguration | Ensure no hard-coded secrets exist in EC2 user data | Terraform | | | 257 | CKVAWS46 | resource | awslaunchtemplate | Ensure no hard-coded secrets exist in EC2 user data | Terraform | | | 258 | CKVAWS47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | | | 259 | CKVAWS47 | resource | awsdaxcluster | Ensure DAX is encrypted at rest (default is unencrypted) | Terraform | | | 260 | CKVAWS48 | resource | awsmqbroker | Ensure MQ Broker logging is enabled | Terraform | | | 261 | CKVAWS49 | data | awsiampolicy_document | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | | | 262 | CKVAWS49 | resource | serverless_aws | Ensure no IAM policies documents allow "*" as a statement's actions | serverless | | | 263 | CKVAWS50 | resource | awslambdafunction | X-Ray tracing is enabled for Lambda | Terraform | | | 264 | CKVAWS51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | | | 265 | CKVAWS51 | resource | awsecrrepository | Ensure ECR Image Tags are immutable | Terraform | | | 266 | CKVAWS53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLs enabled | Cloudformation | | | 267 | CKVAWS53 | resource | awss3bucketpublicaccess_block | Ensure S3 bucket has block public ACLS enabled | Terraform | | | 268 | CKVAWS54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | | | 269 | CKVAWS54 | resource | awss3bucketpublicaccess_block | Ensure S3 bucket has block public policy enabled | Terraform | | | 270 | CKVAWS55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | | | 271 | CKVAWS55 | resource | awss3bucketpublicaccess_block | Ensure S3 bucket has ignore public ACLs enabled | Terraform | | | 272 | CKVAWS56 | resource | AWS::S3::Bucket | Ensure S3 bucket has RestrictPublicBuckets enabled | Cloudformation | | | 273 | CKVAWS56 | resource | awss3bucketpublicaccessblock | Ensure S3 bucket has 'restrictpublic_buckets' enabled | Terraform | | | 274 | CKVAWS57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | | | 275 | CKVAWS57 | resource | awss3bucket | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | | | 276 | CKVAWS57 | resource | awss3bucket_acl | S3 Bucket has an ACL defined which allows public WRITE

| Terraform | | | 277 | CKVAWS58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | | | 278 | CKVAWS58 | resource | awsekscluster | Ensure EKS Cluster has Secrets Encryption Enabled | Terraform | | | 279 | CKVAWS59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | | | 280 | CKVAWS59 | resource | awsapigateway_method | Ensure there is no open access to back-end resources through API | Terraform | | | 281 | CKVAWS60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | | | 282 | CKVAWS60 | resource | awsiamrole | Ensure IAM role allows only specific services or principals to assume it | Terraform | | | 283 | CKVAWS61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | | | 284 | CKVAWS61 | resource | awsiamrole | Ensure AWS IAM policy does not allow assume role permission across all services | Terraform | | | 285 | CKVAWS62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "-" administrative privileges are not created | Cloudformation | | | 286 | CKVAWS62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "-" administrative privileges are not created | Cloudformation | | | 287 | CKVAWS62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "-" administrative privileges are not created | Cloudformation | | | 288 | CKVAWS62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "-" administrative privileges are not created | Cloudformation | | | 289 | CKVAWS62 | resource | awsiamgroup_policy | Ensure IAM policies that allow full "-" administrative privileges are not created | Terraform | | | 290 | CKVAWS62 | resource | awsiampolicy | Ensure IAM policies that allow full "-" administrative privileges are not created | Terraform | | | 291 | CKVAWS62 | resource | awsiamrole_policy | Ensure IAM policies that allow full "-" administrative privileges are not created | Terraform | | | 292 | CKVAWS62 | resource | awsiamuser_policy | Ensure IAM policies that allow full "-" administrative privileges are not created | Terraform | | | 293 | CKVAWS62 | resource | awsssoadminpermissionsetinline_policy | Ensure IAM policies that allow full "-" administrative privileges are not created | Terraform | | | 294 | CKVAWS63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | | | 295 | CKVAWS63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | | | 296 | CKVAWS63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | | | 297 | CKVAWS63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | | | 298 | CKVAWS63 | resource | awsiamgroup_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | | | 299 | CKVAWS63 | resource | awsiampolicy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | | | 300 | CKVAWS63 | resource | awsiamrole_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | | | 301 | CKVAWS63 | resource | awsiamuser_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | | | 302 | CKVAWS63 | resource | awsssoadminpermissionsetinline_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | | | 303 | CKVAWS64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | | | 304 | CKVAWS64 | resource | awsredshiftcluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Terraform | | | 305 | CKVAWS65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | | | 306 | CKVAWS65 | resource | awsecscluster | Ensure container insights are enabled on ECS cluster | Terraform | | | 307 | CKVAWS66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | | | 308 | CKVAWS66 | resource | awscloudwatchlog_group | Ensure that CloudWatch Log Group specifies retention days | Terraform | | | 309 | CKVAWS67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | | | 310 | CKVAWS67 | resource | aws_cloudtrail | Ensure CloudTrail is enabled in all Regions | Terraform | | | 311 | CKVAWS68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | | | 312 | CKVAWS68 | resource | awscloudfrontdistribution | CloudFront Distribution should have WAF enabled | Terraform | | | 313 | CKVAWS69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | | | 314 | CKVAWS69 | resource | awsmqbroker | Ensure MQ Broker is not publicly exposed | Terraform | | | 315 | CKVAWS70 | resource | awss3bucket | Ensure S3 bucket does not allow an action with any Principal | Terraform | | | 316 | CKVAWS70 | resource | awss3bucket_policy | Ensure S3 bucket does not allow an action with any Principal | Terraform | | | 317 | CKVAWS71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | | | 318 | CKVAWS71 | resource | awsredshiftcluster | Ensure Redshift Cluster logging is enabled | Terraform | | | 319 | CKVAWS72 | resource | awssqsqueue_policy | Ensure SQS policy does not allow ALL (*)

| Terraform | | | 320 | CKVAWS73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | | | 321 | CKVAWS73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | | | 322 | CKVAWS73 | resource | awsapigateway_stage | Ensure API Gateway has X-Ray Tracing enabled | Terraform | | | 323 | CKVAWS74 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB is encrypted at rest (default is unencrypted) | Cloudformation | | | 324 | CKVAWS74 | resource | awsdocdbcluster | Ensure DocumentDB is encrypted at rest (default is unencrypted) | Terraform | | | 325 | CKVAWS75 | resource | awsglobalacceleratoraccelerator | Ensure Global Accelerator accelerator has flow logs enabled | Terraform | | | 326 | CKVAWS76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | | | 327 | CKVAWS76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | | | 328 | CKVAWS76 | resource | awsapigateway_stage | Ensure API Gateway has Access Logging enabled | Terraform | | | 329 | CKVAWS76 | resource | awsapigatewayv2stage | Ensure API Gateway has Access Logging enabled | Terraform | | | 330 | CKVAWS77 | resource | awsathenadatabase | Ensure Athena Database is encrypted at rest (default is unencrypted) | Terraform | | | 331 | CKVAWS78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | | | 332 | CKVAWS78 | resource | awscodebuildproject | Ensure that CodeBuild Project encryption is not disabled | Terraform | | | 333 | CKVAWS79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | | | 334 | CKVAWS79 | resource | aws_instance | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | | | 335 | CKVAWS79 | resource | awslaunchconfiguration | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | | | 336 | CKVAWS79 | resource | awslaunchtemplate | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | | | 337 | CKVAWS80 | resource | AWS::MSK::Cluster | Ensure MSK Cluster logging is enabled | Cloudformation | | | 338 | CKVAWS80 | resource | awsmskcluster | Ensure MSK Cluster logging is enabled | Terraform | | | 339 | CKVAWS81 | resource | AWS::MSK::Cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Cloudformation | | | 340 | CKVAWS81 | resource | awsmskcluster | Ensure MSK Cluster encryption in rest and transit is enabled | Terraform | | | 341 | CKVAWS82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | | | 342 | CKVAWS82 | resource | awsathenaworkgroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Terraform | | | 343 | CKVAWS83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | | | 344 | CKVAWS83 | resource | awselasticsearchdomain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | | | 345 | CKVAWS83 | resource | awsopensearchdomain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | | | 346 | CKVAWS84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | | | 347 | CKVAWS84 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | | | 348 | CKVAWS84 | resource | awselasticsearchdomain | Ensure Elasticsearch Domain Logging is enabled | Terraform | | | 349 | CKVAWS84 | resource | awsopensearchdomain | Ensure Elasticsearch Domain Logging is enabled | Terraform | | | 350 | CKVAWS85 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB Logging is enabled | Cloudformation | | | 351 | CKVAWS85 | resource | awsdocdbcluster | Ensure DocumentDB Logging is enabled | Terraform | | | 352 | CKVAWS86 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution has Access Logging enabled | Cloudformation | | | 353 | CKVAWS86 | resource | awscloudfrontdistribution | Ensure CloudFront distribution has Access Logging enabled | Terraform | | | 354 | CKVAWS87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | | | 355 | CKVAWS87 | resource | awsredshiftcluster | Redshift cluster should not be publicly accessible | Terraform | | | 356 | CKVAWS88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | | | 357 | CKVAWS88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | | | 358 | CKVAWS88 | resource | | | 359 | CKVAWS88 | resource | | | 360 | CKVAWS88 | resource | | | 361 | CKVAWS88 | resource | | | 362 | CKVAWS88 | resource | | | 363 | CKVAWS88 | resource | | | 364 | CKVAWS88 | resource | | | 365 | CKVAWS88 | resource | | | 366 | CKVAWS88 | resource | | | 367 | CKVAWS88 | resource | | | 368 | CKVAWS88 | resource | | | 369 | CKVAWS88 | resource | | | 370 | CKVAWS88 | resource | | | 371 | CKVAWS88 | resource | | | 372 | CKVAWS88 | resource | | | 373 | CKVAWS88 | resource | | | 374 | CKVAWS88 | resource | aws_instance | EC2 instance should not have public IP. | Terraform | | | 375 | CKVAWS88 | resource | awslaunchtemplate | EC2 instance should not have public IP. | Terraform | | | 376 | CKVAWS89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | | | 377 | CKVAWS89 | resource | awsdmsreplication_instance | DMS replication instance should not be publicly accessible | Terraform | | | 378 | CKVAWS90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB TLS is not disabled | Cloudformation | | | 379 | CKVAWS90 | resource | awsdocdbclusterparametergroup | Ensure DocumentDB TLS is not disabled | Terraform | | | 380 | CKVAWS91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | | | 381 | CKVAWS91 | resource | aws_alb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | | | 382 | CKVAWS91 | resource | aws_lb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | | | 383 | CKVAWS92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | | | 384 | CKVAWS92 | resource | aws_elb | Ensure the ELB has access logging enabled | Terraform | | | 385 | CKVAWS93 | resource | awss3bucket | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | | | 386 | CKVAWS93 | resource | awss3bucket_policy | Ensure S3 bucket policy does not lockout all but root

(Prevent lockouts needing root account fixes) | Terraform | | | 387 | CKVAWS94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | | | 388 | CKVAWS94 | resource | awsgluedatacatalogencryption_settings | Ensure Glue Data Catalog Encryption is enabled | Terraform | | | 389 | CKVAWS95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | | | 390 | CKVAWS95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | | | 391 | CKVAWS96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | | | 392 | CKVAWS96 | resource | awsrdscluster | Ensure all data stored in Aurora is securely encrypted at rest | Terraform | | | 393 | CKVAWS97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | | | 394 | CKVAWS97 | resource | awsecstask_definition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Terraform | | | 395 | CKVAWS98 | resource | awssagemakerendpoint_configuration | Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest | Terraform | | | 396 | CKVAWS99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | | | 397 | CKVAWS99 | resource | awsgluesecurity_configuration | Ensure Glue Security Configuration Encryption is enabled | Terraform | | | 398 | CKVAWS100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | | | 399 | CKVAWS100 | resource | awseksnode_group | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Terraform | | | 400 | CKVAWS101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | | | 401 | CKVAWS101 | resource | awsneptunecluster | Ensure Neptune logging is enabled | Terraform | | | 402 | CKVAWS102 | resource | awsneptunecluster_instance | Ensure Neptune Cluster instance is not publicly available | Terraform | | | 403 | CKVAWS103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | | | 404 | CKVAWS103 | resource | awsalblistener | Ensure that load balancer is using at least TLS 1.2 | Terraform | | | 405 | CKVAWS103 | resource | aws_lb | Ensure that load balancer is using at least TLS 1.2 | Terraform | | | 406 | CKVAWS103 | resource | awslblistener | Ensure that load balancer is using at least TLS

| Terraform | | | 407 | CKVAWS104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB has audit logs enabled | Cloudformation | | | 408 | CKVAWS104 | resource | awsdocdbclusterparametergroup | Ensure DocumentDB has audit logs enabled | Terraform | | | 409 | CKVAWS105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | | | 410 | CKVAWS105 | resource | awsredshiftparameter_group | Ensure Redshift uses SSL | Terraform | | | 411 | CKVAWS106 | resource | awsebsencryptionbydefault | Ensure EBS default encryption is enabled | Terraform | | | 412 | CKVAWS107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 413 | CKVAWS107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 414 | CKVAWS107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 415 | CKVAWS107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 416 | CKVAWS107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | | | 417 | CKVAWS107 | data | awsiampolicy_document | Ensure IAM policies does not allow credentials exposure | Terraform | | | 418 | CKVAWS108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 419 | CKVAWS108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 420 | CKVAWS108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 421 | CKVAWS108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 422 | CKVAWS108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | | | 423 | CKVAWS108 | data | awsiampolicy_document | Ensure IAM policies does not allow data exfiltration | Terraform | | | 424 | CKVAWS109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 425 | CKVAWS109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 426 | CKVAWS109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 427 | CKVAWS109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 428 | CKVAWS109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | | | 429 | CKVAWS109 | data | awsiampolicy_document | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | | | 430 | CKVAWS110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 431 | CKVAWS110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 432 | CKVAWS110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 433 | CKVAWS110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 434 | CKVAWS110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | | | 435 | CKVAWS110 | data | awsiampolicy_document | Ensure IAM policies does not allow privilege escalation | Terraform | | | 436 | CKVAWS111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 437 | CKVAWS111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 438 | CKVAWS111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 439 | CKVAWS111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 440 | CKVAWS111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | | | 441 | CKVAWS111 | data | awsiampolicy_document | Ensure IAM policies does not allow write access without constraints | Terraform | | | 442 | CKVAWS112 | resource | awsssmdocument | Ensure Session Manager data is encrypted in transit | Terraform | | | 443 | CKVAWS113 | resource | awsssmdocument | Ensure Session Manager logs are enabled and encrypted | Terraform | | | 444 | CKVAWS114 | resource | awsemrcluster | Ensure that EMR clusters with Kerberos have Kerberos Realm set | Terraform | | | 445 | CKVAWS115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | | | 446 | CKVAWS115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | | | 447 | CKVAWS115 | resource | awslambdafunction | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Terraform | | | 448 | CKVAWS116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | | | 449 | CKVAWS116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | | | 450 | CKVAWS116 | resource | awslambdafunction | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Terraform | | | 451 | CKVAWS117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | | | 452 | CKVAWS117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | | | 453 | CKVAWS117 | resource | awslambdafunction | Ensure that AWS Lambda function is configured inside a VPC | Terraform | | | 454 | CKVAWS118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | | | 455 | CKVAWS118 | resource | awsdbinstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | | | 456 | CKVAWS118 | resource | awsrdscluster_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | | | 457 | CKVAWS119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | | | 458 | CKVAWS119 | resource | awsdynamodbtable | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Terraform | | | 459 | CKVAWS120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | | | 460 | CKVAWS120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | | | 461 | CKVAWS120 | resource | awsapigateway_stage | Ensure API Gateway caching is enabled | Terraform | | | 462 | CKVAWS121 | resource | awsconfigconfiguration_aggregator | Ensure AWS Config is enabled in all regions | Terraform | | | 463 | CKVAWS122 | resource | awssagemakernotebook_instance | Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance | Terraform | | | 464 | CKVAWS123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | | | 465 | CKVAWS123 | resource | awsvpcendpoint_service | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Terraform | | | 466 | CKVAWS124 | resource | awscloudformationstack | Ensure that CloudFormation stacks are sending event notifications to an SNS topic | Terraform | | | 467 | CKVAWS126 | resource | aws_instance | Ensure that detailed monitoring is enabled for EC2 instances | Terraform | | | 468 | CKVAWS127 | resource | aws_elb | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager | Terraform | | | 469 | CKVAWS129 | resource | awsdbinstance | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled | Terraform | | | 470 | CKVAWS130 | resource | aws_subnet | Ensure VPC subnets do not assign public IP by default | Terraform | | | 471 | CKVAWS131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | | | 472 | CKVAWS131 | resource | aws_alb | Ensure that ALB drops HTTP headers | Terraform | | | 473 | CKVAWS131 | resource | aws_lb | Ensure that ALB drops HTTP headers | Terraform | | | 474 | CKVAWS133 | resource | awsdbinstance | Ensure that RDS instances has backup policy | Terraform | | | 475 | CKVAWS133 | resource | awsrdscluster | Ensure that RDS instances has backup policy | Terraform | | | 476 | CKVAWS134 | resource | awselasticachecluster | Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on | Terraform | | | 477 | CKVAWS135 | resource | | | 478 | CKVAWS135 | resource | | | 479 | CKVAWS135 | resource | | | 480 | CKVAWS135 | resource | | | 481 | CKVAWS135 | resource | | | 482 | CKVAWS135 | resource | | | 483 | CKVAWS135 | resource | | | 484 | CKVAWS135 | resource | | | 485 | CKVAWS135 | resource | | | 486 | CKVAWS135 | resource | | | 487 | CKVAWS135 | resource | | | 488 | CKVAWS135 | resource | | | 489 | CKVAWS135 | resource | | | 490 | CKVAWS135 | resource | | | 491 | CKVAWS135 | resource | | | 492 | CKVAWS135 | resource | | | 493 | CKVAWS135 | resource | aws_instance | Ensure that EC2 is EBS optimized | Terraform | | | 494 | CKVAWS136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | | | 495 | CKVAWS136 | resource | awsecrrepository | Ensure that ECR repositories are encrypted using KMS | Terraform | | | 496 | CKVAWS137 | resource | awselasticsearchdomain | Ensure that Elasticsearch is configured inside a VPC | Terraform | | | 497 | CKVAWS137 | resource | awsopensearchdomain | Ensure that Elasticsearch is configured inside a VPC | Terraform | | | 498 | CKVAWS138 | resource | aws_elb | Ensure that ELB is cross-zone-load-balancing enabled | Terraform | | | 499 | CKVAWS139 | resource | awsrdscluster | Ensure that RDS clusters have deletion protection enabled | Terraform | | | 500 | CKVAWS140 | resource | awsrdsglobal_cluster | Ensure that RDS global clusters are encrypted | Terraform | | | 501 | CKVAWS141 | resource | awsredshiftcluster | Ensured that Redshift cluster allowing version upgrade by default | Terraform | | | 502 | CKVAWS142 | resource | awsredshiftcluster | Ensure that Redshift cluster is encrypted by KMS | Terraform | | | 503 | CKVAWS143 | resource | awss3bucket | Ensure that S3 bucket has lock configuration enabled by default | Terraform | | | 504 | CKVAWS144 | resource | awss3bucket | Ensure that S3 bucket has cross-region replication enabled | Terraform | | | 505 | CKVAWS144 | resource | awss3bucketreplicationconfiguration | Ensure that S3 bucket has cross-region replication enabled | Terraform | | | 506 | CKVAWS145 | resource | awss3bucket | Ensure that S3 buckets are encrypted with KMS by default | Terraform | | | 507 | CKVAWS145 | resource | awss3bucketserversideencryptionconfiguration | Ensure that S3 buckets are encrypted with KMS by default | Terraform | | | 508 | CKVAWS146 | resource | awsdbcluster_snapshot | Ensure that RDS database cluster snapshot is encrypted | Terraform | | | 509 | CKVAWS147 | resource | awscodebuildproject | Ensure that CodeBuild projects are encrypted using CMK | Terraform | | | 510 | CKVAWS148 | resource | awsdefaultvpc | Ensure no default VPC is planned to be provisioned | Terraform | | | 511 | CKVAWS149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | | | 512 | CKVAWS149 | resource | awssecretsmanagersecret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Terraform | | | 513 | CKVAWS150 | resource | aws_alb | Ensure that Load Balancer has deletion protection enabled | Terraform | | | 514 | CKVAWS150 | resource | aws_lb | Ensure that Load Balancer has deletion protection enabled | Terraform | | | 515 | CKVAWS152 | resource | aws_alb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | | | 516 | CKVAWS152 | resource | aws_lb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | | | 517 | CKVAWS153 | resource | awsautoscalinggroup | Autoscaling groups should supply tags to launch configurations | Terraform | | | 518 | CKVAWS154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | | | 519 | CKVAWS154 | resource | awsredshiftcluster | Ensure Redshift is not deployed outside of a VPC | Terraform | | | 520 | CKVAWS155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | | | 521 | CKVAWS155 | resource | awsworkspacesworkspace | Ensure that Workspace user volumes are encrypted | Terraform | | | 522 | CKVAWS156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | | | 523 | CKVAWS156 | resource | awsworkspacesworkspace | Ensure that Workspace root volumes are encrypted | Terraform | | | 524 | CKVAWS157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | | | 525 | CKVAWS157 | resource | awsdbinstance | Ensure that RDS instances have Multi-AZ enabled | Terraform | | | 526 | CKVAWS158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | | | 527 | CKVAWS158 | resource | awscloudwatchlog_group | Ensure that CloudWatch Log Group is encrypted by KMS | Terraform | | | 528 | CKVAWS159 | resource | awsathenaworkgroup | Ensure that Athena Workgroup is encrypted | Terraform | | | 529 | CKVAWS160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | | | 530 | CKVAWS160 | resource | awstimestreamwritedatabase | Ensure that Timestream database is encrypted with KMS CMK | Terraform | | | 531 | CKVAWS161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | | | 532 | CKVAWS161 | resource | awsdbinstance | Ensure RDS database has IAM authentication enabled | Terraform | | | 533 | CKVAWS162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | | | 534 | CKVAWS162 | resource | awsrdscluster | Ensure RDS cluster has IAM authentication enabled | Terraform | | | 535 | CKVAWS163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | | | 536 | CKVAWS163 | resource | awsecrrepository | Ensure ECR image scanning on push is enabled | Terraform | | | 537 | CKVAWS164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | | | 538 | CKVAWS164 | resource | awstransferserver | Ensure Transfer Server is not exposed

| Terraform | | | 539 | CKVAWS165 | resource | AWS::DynamoDB::GlobalTable | Ensure DynamoDB global table point in time recovery (backup) is enabled | Cloudformation | | | 540 | CKVAWS165 | resource | awsdynamodbglobal_table | Ensure DynamoDB point in time recovery (backup) is enabled for global tables | Terraform | | | 541 | CKVAWS166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | | | 542 | CKVAWS166 | resource | awsbackupvault | Ensure Backup Vault is encrypted at rest using KMS CMK | Terraform | | | 543 | CKVAWS167 | resource | awsglaciervault | Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it | Terraform | | | 544 | CKVAWS168 | resource | awssqsqueue | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | | | 545 | CKVAWS168 | resource | awssqsqueue_policy | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | | | 546 | CKVAWS169 | resource | awssnstopic_policy | Ensure SNS topic policy is not public by only allowing specific services or principals to access it | Terraform | | | 547 | CKVAWS170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | | | 548 | CKVAWS170 | resource | awsqldbledger | Ensure QLDB ledger permissions mode is set to STANDARD | Terraform | | | 549 | CKVAWS171 | resource | awsemrsecurity_configuration | Ensure EMR Cluster security configuration encryption is using SSE-KMS | Terraform | | | 550 | CKVAWS172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | | | 551 | CKVAWS172 | resource | awsqldbledger | Ensure QLDB ledger has deletion protection enabled | Terraform | | | 552 | CKVAWS173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environment variable | Cloudformation | | | 553 | CKVAWS173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environment variable | Cloudformation | | | 554 | CKVAWS173 | resource | awslambdafunction | Check encryption settings for Lambda environmental variable | Terraform | | | 555 | CKVAWS174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Cloudformation | | | 556 | CKVAWS174 | resource | awscloudfrontdistribution | Verify CloudFront Distribution Viewer Certificate is using TLS

| Terraform | | | 557 | CKVAWS175 | resource | awswafweb_acl | Ensure WAF has associated rules | Terraform | | | 558 | CKVAWS175 | resource | awswafregionalweb_acl | Ensure WAF has associated rules | Terraform | | | 559 | CKVAWS175 | resource | awswafv2web_acl | Ensure WAF has associated rules | Terraform | | | 560 | CKVAWS176 | resource | awswafweb_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | | | 561 | CKVAWS176 | resource | awswafregionalweb_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | | | 562 | CKVAWS177 | resource | awskinesisvideo_stream | Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 563 | CKVAWS178 | resource | awsfsxontapfilesystem | Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 564 | CKVAWS179 | resource | awsfsxwindowsfilesystem | Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 565 | CKVAWS180 | resource | awsimagebuildercomponent | Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 566 | CKVAWS181 | resource | awss3object_copy | Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 567 | CKVAWS182 | resource | awsdocdbcluster | Ensure DocumentDB is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 568 | CKVAWS183 | resource | awsebssnapshot_copy | Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 569 | CKVAWS184 | resource | awsefsfile_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 570 | CKVAWS185 | resource | awskinesisstream | Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 571 | CKVAWS186 | resource | awss3bucket_object | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 572 | CKVAWS187 | resource | awssagemakerdomain | Ensure Sagemaker domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 573 | CKVAWS189 | resource | awsebsvolume | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 574 | CKVAWS190 | resource | awsfsxlustrefilesystem | Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 575 | CKVAWS191 | resource | awselasticachereplication_group | Ensure ElastiCache replication group is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 576 | CKVAWS192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | | | 577 | CKVAWS192 | resource | awswafv2web_acl | Ensure WAF prevents message lookup in

See CVE-2021-44228 aka log4jshell | Terraform | | | 578 | CKVAWS193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | | | 579 | CKVAWS193 | resource | awsappsyncgraphql_api | Ensure AppSync has Logging enabled | Terraform | | | 580 | CKVAWS194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | | | 581 | CKVAWS194 | resource | awsappsyncgraphql_api | Ensure AppSync has Field-Level logs enabled | Terraform | | | 582 | CKVAWS195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | | | 583 | CKVAWS195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | | | 584 | CKVAWS195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | | | 585 | CKVAWS195 | resource | awsgluecrawler | Ensure Glue component has a security configuration associated | Terraform | | | 586 | CKVAWS195 | resource | awsgluedev_endpoint | Ensure Glue component has a security configuration associated | Terraform | | | 587 | CKVAWS195 | resource | awsgluejob | Ensure Glue component has a security configuration associated | Terraform | | | 588 | CKVAWS196 | resource | awselasticachesecuritygroup | Ensure no awselasticachesecuritygroup resources exist | Terraform | | | 589 | CKVAWS197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | | | 590 | CKVAWS197 | resource | awsmqbroker | Ensure MQ Broker Audit logging is enabled | Terraform | | | 591 | CKVAWS198 | resource | awsdbsecuritygroup | Ensure no awsdbsecuritygroup resources exist | Terraform | | | 592 | CKVAWS199 | resource | awsimagebuilderdistribution_configuration | Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK) | Terraform | | | 593 | CKVAWS200 | resource | awsimagebuilderimage_recipe | Ensure that Image Recipe EBS Disk are encrypted with CMK | Terraform | | | 594 | CKVAWS201 | resource | awsmemorydbcluster | Ensure MemoryDB is encrypted at rest using KMS CMKs | Terraform | | | 595 | CKVAWS202 | resource | awsmemorydbcluster | Ensure MemoryDB data is encrypted in transit | Terraform | | | 596 | CKVAWS203 | resource | awsfsxopenzfsfilesystem | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 597 | CKVAWS204 | resource | aws_ami | Ensure AMIs are encrypted using KMS CMKs | Terraform | | | 598 | CKVAWS205 | resource | awsamilaunch_permission | Ensure to Limit AMI launch Permissions | Terraform | | | 599 | CKVAWS206 | resource | awsapigatewaydomainname | Ensure API Gateway Domain uses a modern security Policy | Terraform | | | 600 | CKVAWS207 | resource | awsmqbroker | Ensure MQ Broker minor version updates are enabled | Terraform | | | 601 | CKVAWS208 | resource | awsmqbroker | Ensure MQ Broker version is current | Terraform | | | 602 | CKVAWS208 | resource | awsmqconfiguration | Ensure MQ Broker version is current | Terraform | | | 603 | CKVAWS209 | resource | awsmqbroker | Ensure MQ broker encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 604 | CKVAWS210 | resource | awsbatchjob_definition | Batch job does not define a privileged container | Terraform | | | 605 | CKVAWS211 | resource | awsdbinstance | Ensure RDS uses a modern CaCert | Terraform | | | 606 | CKVAWS212 | resource | awsdmsreplication_instance | Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 607 | CKVAWS213 | resource | awsloadbalancer_policy | Ensure ELB Policy uses only secure protocols | Terraform | | | 608 | CKVAWS214 | resource | awsappsyncapi_cache | Ensure AppSync API Cache is encrypted at rest | Terraform | | | 609 | CKVAWS215 | resource | awsappsyncapi_cache | Ensure AppSync API Cache is encrypted in transit | Terraform | | | 610 | CKVAWS216 | resource | awscloudfrontdistribution | Ensure CloudFront distribution is enabled | Terraform | | | 611 | CKVAWS217 | resource | awsapigateway_deployment | Ensure Create before destroy for API deployments | Terraform | | | 612 | CKVAWS218 | resource | awscloudsearchdomain | Ensure that CloudSearch is using latest TLS | Terraform | | | 613 | CKVAWS219 | resource | aws_codepipeline | Ensure CodePipeline Artifact store is using a KMS CMK | Terraform | | | 614 | CKVAWS220 | resource | awscloudsearchdomain | Ensure that CloudSearch is using https | Terraform | | | 615 | CKVAWS221 | resource | awscodeartifactdomain | Ensure CodeArtifact Domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 616 | CKVAWS222 | resource | awsdmsreplication_instance | Ensure DMS replication instance gets all minor upgrade automatically | Terraform | | | 617 | CKVAWS223 | resource | awsecscluster | Ensure ECS Cluster enables logging of ECS Exec | Terraform | | | 618 | CKVAWS224 | resource | awsecscluster | Ensure ECS Cluster logging uses CMK | Terraform | | | 619 | CKVAWS225 | resource | awsapigatewaymethodsettings | Ensure API Gateway method setting caching is enabled | Terraform | | | 620 | CKVAWS226 | resource | awsdbinstance | Ensure DB instance gets all minor upgrades automatically | Terraform | | | 621 | CKVAWS226 | resource | awsrdscluster_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | | | 622 | CKVAWS227 | resource | awskmskey | Ensure KMS key is enabled | Terraform | | | 623 | CKVAWS228 | resource | awselasticsearchdomain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | | | 624 | CKVAWS228 | resource | awsopensearchdomain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | | | 625 | CKVAWS229 | resource | awsnetworkacl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | | | 626 | CKVAWS229 | resource | awsnetworkacl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | | | 627 | CKVAWS230 | resource | awsnetworkacl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | | | 628 | CKVAWS230 | resource | awsnetworkacl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | | | 629 | CKVAWS231 | resource | awsnetworkacl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | | | 630 | CKVAWS231 | resource | awsnetworkacl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | | | 631 | CKVAWS232 | resource | awsnetworkacl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | | | 632 | CKVAWS232 | resource | awsnetworkacl_rule | Ensure no NACL allow ingress from

to port 22 | Terraform | | | 633 | CKVAWS233 | resource | awsacmcertificate | Ensure Create before destroy for ACM certificates | Terraform | | | 634 | CKVAWS234 | resource | awsacmcertificate | Verify logging preference for ACM certificates | Terraform | | | 635 | CKVAWS235 | resource | awsamicopy | Ensure that copied AMIs are encrypted | Terraform | | | 636 | CKVAWS236 | resource | awsamicopy | Ensure AMI copying uses a CMK | Terraform | | | 637 | CKVAWS237 | resource | awsapigatewayrestapi | Ensure Create before destroy for API Gateway | Terraform | | | 638 | CKVAWS238 | resource | awsguarddutydetector | Ensure that GuardDuty detector is enabled | Terraform | | | 639 | CKVAWS239 | resource | awsdaxcluster | Ensure DAX cluster endpoint is using TLS | Terraform | | | 640 | CKVAWS240 | resource | awskinesisfirehosedeliverystream | Ensure Kinesis Firehose delivery stream is encrypted | Terraform | | | 641 | CKVAWS241 | resource | awskinesisfirehosedeliverystream | Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK | Terraform | | | 642 | CKVAWS242 | resource | awsmwaaenvironment | Ensure MWAA environment has scheduler logs enabled | Terraform | | | 643 | CKVAWS243 | resource | awsmwaaenvironment | Ensure MWAA environment has worker logs enabled | Terraform | | | 644 | CKVAWS244 | resource | awsmwaaenvironment | Ensure MWAA environment has webserver logs enabled | Terraform | | | 645 | CKVAWS245 | resource | awsdbinstanceautomatedbackups_replication | Ensure replicated backups are encrypted at rest using KMS CMKs | Terraform | | | 646 | CKVAWS246 | resource | awsrdsclusteractivitystream | Ensure RDS Cluster activity streams are encrypted using KMS CMKs | Terraform | | | 647 | CKVAWS247 | resource | awselasticsearchdomain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | | | 648 | CKVAWS247 | resource | awsopensearchdomain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | | | 649 | CKVAWS248 | resource | awselasticsearchdomain | Ensure that Elasticsearch is not using the default Security Group | Terraform | | | 650 | CKVAWS248 | resource | awsopensearchdomain | Ensure that Elasticsearch is not using the default Security Group | Terraform | | | 651 | CKVAWS249 | resource | awsecstask_definition | Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions | Terraform | | | 652 | CKVAWS250 | resource | awsdbinstance | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | | | 653 | CKVAWS250 | resource | awsrdscluster | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | | | 654 | CKVAWS251 | resource | aws_cloudtrail | Ensure CloudTrail logging is enabled | Terraform | | | 655 | CKVAWS252 | resource | aws_cloudtrail | Ensure CloudTrail defines an SNS Topic | Terraform | | | 656 | CKVAWS253 | resource | awsdlmlifecycle_policy | Ensure DLM cross region events are encrypted | Terraform | | | 657 | CKVAWS254 | resource | awsdlmlifecycle_policy | Ensure DLM cross region events are encrypted with Customer Managed Key | Terraform | | | 658 | CKVAWS255 | resource | awsdlmlifecycle_policy | Ensure DLM cross region schedules are encrypted | Terraform | | | 659 | CKVAWS256 | resource | awsdlmlifecycle_policy | Ensure DLM cross region schedules are encrypted using a Customer Managed Key | Terraform | | | 660 | CKVAWS257 | resource | awscodecommitapprovalruletemplate | Ensure CodeCommit branch changes have at least 2 approvals | Terraform | | | 661 | CKVAWS258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | | | 662 | CKVAWS258 | resource | awslambdafunction_url | Ensure that Lambda function URLs AuthType is not None | Terraform | | | 663 | CKVAWS259 | resource | awscloudfrontresponseheaderspolicy | Ensure CloudFront response header policy enforces Strict Transport Security | Terraform | | | 664 | CKVAWS260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | | | 665 | CKVAWS260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | | | 666 | CKVAWS260 | resource | awssecuritygroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | | | 667 | CKVAWS260 | resource | awssecuritygroup_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | | | 668 | CKVAWS260 | resource | awsvpcsecuritygroupingress_rule | Ensure no security groups allow ingress from

to port 80 | Terraform | | | 669 | CKVAWS261 | resource | awsalbtarget_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | | | 670 | CKVAWS261 | resource | awslbtarget_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | | | 671 | CKVAWS262 | resource | awskendraindex | Ensure Kendra index Server side encryption uses CMK | Terraform | | | 672 | CKVAWS263 | resource | awsappflowflow | Ensure AppFlow flow uses CMK | Terraform | | | 673 | CKVAWS264 | resource | awsappflowconnector_profile | Ensure AppFlow connector profile uses CMK | Terraform | | | 674 | CKVAWS265 | resource | awskeyspacestable | Ensure Keyspaces Table uses CMK | Terraform | | | 675 | CKVAWS266 | resource | awsdbsnapshot_copy | Ensure DB Snapshot copy uses CMK | Terraform | | | 676 | CKVAWS267 | resource | awscomprehendentity_recognizer | Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 677 | CKVAWS268 | resource | awscomprehendentity_recognizer | Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 678 | CKVAWS269 | resource | awsconnectinstancestorageconfig | Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK | Terraform | | | 679 | CKVAWS270 | resource | awsconnectinstancestorageconfig | Ensure Connect Instance S3 Storage Config uses CMK | Terraform | | | 680 | CKVAWS271 | resource | awsdynamodbtable_replica | Ensure DynamoDB table replica KMS encryption uses CMK | Terraform | | | 681 | CKVAWS272 | resource | awslambdafunction | Ensure AWS Lambda function is configured to validate code-signing | Terraform | | | 682 | CKVAWS273 | resource | awsiamuser | Ensure access is controlled through SSO and not AWS IAM defined users | Terraform | | | 683 | CKVAWS274 | resource | awsiamgrouppolicyattachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | | | 684 | CKVAWS274 | resource | awsiampolicy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | | | 685 | CKVAWS274 | resource | awsiamrole | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | | | 686 | CKVAWS274 | resource | awsiamrolepolicyattachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | | | 687 | CKVAWS274 | resource | awsiamuserpolicyattachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | | | 688 | CKVAWS274 | resource | awsssoadminmanagedpolicyattachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | | | 689 | CKVAWS275 | data | awsiampolicy | Disallow policies from using the AWS AdministratorAccess policy | Terraform | | | 690 | CKVAWS276 | resource | awsapigatewaymethodsettings | Ensure Data Trace is not enabled in API Gateway Method Settings | Terraform | | | 691 | CKVAWS277 | resource | awssecuritygroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | | | 692 | CKVAWS277 | resource | awssecuritygroup_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | | | 693 | CKVAWS277 | resource | awsvpcsecuritygroupingress_rule | Ensure no security groups allow ingress from

to port -1 | Terraform | | | 694 | CKVAWS278 | resource | awsmemorydbsnapshot | Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 695 | CKVAWS279 | resource | awsneptunecluster_snapshot | Ensure Neptune snapshot is securely encrypted | Terraform | | | 696 | CKVAWS280 | resource | awsneptunecluster_snapshot | Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 697 | CKVAWS281 | resource | awsredshiftsnapshotcopygrant | Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 698 | CKVAWS282 | resource | awsredshiftserverlessnamespace | Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK) | Terraform | | | 699 | CKVAWS283 | data | awsiampolicy_document | Ensure no IAM policies documents allow ALL or any AWS principal permissions to the resource | Terraform | | | 700 | CKVAWS284 | resource | awssfnstate_machine | Ensure State Machine has X-Ray tracing enabled | Terraform | | | 701 | CKVAWS285 | resource | awssfnstate_machine | Ensure State Machine has execution history logging enabled | Terraform | | | 702 | CKVAWS286 | resource | awsiamgroup_policy | Ensure IAM policies does not allow privilege escalation | Terraform | | | 703 | CKVAWS286 | resource | awsiampolicy | Ensure IAM policies does not allow privilege escalation | Terraform | | | 704 | CKVAWS286 | resource | awsiamrole_policy | Ensure IAM policies does not allow privilege escalation | Terraform | | | 705 | CKVAWS286 | resource | awsiamuser_policy | Ensure IAM policies does not allow privilege escalation | Terraform | | | 706 | CKVAWS286 | resource | awsssoadminpermissionsetinline_policy | Ensure IAM policies does not allow privilege escalation | Terraform | | | 707 | CKVAWS287 | resource | awsiamgroup_policy | Ensure IAM policies does not allow credentials exposure | Terraform | | | 708 | CKVAWS287 | resource | awsiampolicy | Ensure IAM policies does not allow credentials exposure | Terraform | | | 709 | CKVAWS287 | resource | awsiamrole_policy | Ensure IAM policies does not allow credentials exposure | Terraform | | | 710 | CKVAWS287 | resource | awsiamuser_policy | Ensure IAM policies does not allow credentials exposure | Terraform | | | 711 | CKVAWS287 | resource | awsssoadminpermissionsetinline_policy | Ensure IAM policies does not allow credentials exposure | Terraform | | | 712 | CKVAWS288 | resource | awsiamgroup_policy | Ensure IAM policies does not allow data exfiltration | Terraform | | | 713 | CKVAWS288 | resource | awsiampolicy | Ensure IAM policies does not allow data exfiltration | Terraform | | | 714 | CKVAWS288 | resource | awsiamrole_policy | Ensure IAM policies does not allow data exfiltration | Terraform | | | 715 | CKVAWS288 | resource | awsiamuser_policy | Ensure IAM policies does not allow data exfiltration | Terraform | | | 716 | CKVAWS288 | resource | awsssoadminpermissionsetinline_policy | Ensure IAM policies does not allow data exfiltration | Terraform | | | 717 | CKVAWS289 | resource | awsiamgroup_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | | | 718 | CKVAWS289 | resource | awsiampolicy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | | | 719 | CKVAWS289 | resource | awsiamrole_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | | | 720 | CKVAWS289 | resource | awsiamuser_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | | | 721 | CKVAWS289 | resource | awsssoadminpermissionsetinline_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | | | 722 | CKVAWS290 | resource | awsiamgroup_policy | Ensure IAM policies does not allow write access without constraints | Terraform | | | 723 | CKVAWS290 | resource | awsiampolicy | Ensure IAM policies does not allow write access without constraints | Terraform | | | 724 | CKVAWS290 | resource | awsiamrole_policy | Ensure IAM policies does not allow write access without constraints | Terraform | | | 725 | CKVAWS290 | resource | awsiamuser_policy | Ensure IAM policies does not allow write access without constraints | Terraform | | | 726 | CKVAWS290 | resource | awsssoadminpermissionsetinline_policy | Ensure IAM policies does not allow write access without constraints | Terraform | | | 727 | CKVAWS291 | resource | AWS::MSK::Cluster | Ensure MSK nodes are private | Cloudformation | | | 728 | CKVAWS291 | resource | awsmskcluster | Ensure MSK nodes are private | Terraform | | | 729 | CKVAWS292 | resource | awsdocdbglobal_cluster | Ensure DocumentDB Global Cluster is encrypted at rest (default is unencrypted) | Terraform | | | 730 | CKVAWS293 | resource | awsdbinstance | Ensure that AWS database instances have deletion protection enabled | Terraform | | | 731 | CKVAWS294 | resource | awscloudtraileventdatastore | Ensure CloudTrail Event Data Store uses CMK | Terraform | | | 732 | CKVAWS295 | resource | awsdatasynclocationobjectstorage | Ensure DataSync Location Object Storage doesn't expose secrets | Terraform | | | 733 | CKVAWS296 | resource | awsdmsendpoint | Ensure DMS endpoint uses Customer Managed Key (CMK) | Terraform | | | 734 | CKVAWS297 | resource | awsschedulerschedule | Ensure EventBridge Scheduler Schedule uses Customer Managed Key (CMK) | Terraform | | | 735 | CKVAWS298 | resource | awsdmss3_endpoint | Ensure DMS S3 uses Customer Managed Key (CMK) | Terraform | | | 736 | CKVAWS300 | resource | awss3bucketlifecycleconfiguration | Ensure S3 lifecycle configuration sets period for aborting failed uploads | Terraform | | | 737 | CKVAWS301 | resource | awslambdapermission | Ensure that AWS Lambda function is not publicly accessible | Terraform | | | 738 | CKVAWS302 | resource | awsdbsnapshot | Ensure DB Snapshots are not Public | Terraform | | | 739 | CKVAWS303 | resource | awsssmdocument | Ensure SSM documents are not Public | Terraform | | | 740 | CKVAWS304 | resource | awssecretsmanagersecret_rotation | Ensure Secrets Manager secrets should be rotated within 90 days | Terraform | | | 741 | CKVAWS305 | resource | awscloudfrontdistribution | Ensure CloudFront distribution has a default root object configured | Terraform | | | 742 | CKVAWS306 | resource | awssagemakernotebook_instance | Ensure SageMaker notebook instances should be launched into a custom VPC | Terraform | | | 743 | CKVAWS307 | resource | awssagemakernotebook_instance | Ensure SageMaker Users should not have root access to SageMaker notebook instances | Terraform | | | 744 | CKVAWS308 | resource | awsapigatewaymethodsettings | Ensure API Gateway method setting caching is set to encrypted | Terraform | | | 745 | CKVAWS309 | resource | awsapigatewayv2route | Ensure API GatewayV2 routes specify an authorization type | Terraform | | | 746 | CKVAWS310 | resource | awscloudfrontdistribution | Ensure CloudFront distributions should have origin failover configured | Terraform | | | 747 | CKVAWS311 | resource | awscodebuildproject | Ensure that CodeBuild S3 logs are encrypted | Terraform | | | 748 | CKVAWS312 | resource | awselasticbeanstalk_environment | Ensure Elastic Beanstalk environments have enhanced health reporting enabled | Terraform | | | 749 | CKVAWS313 | resource | awsrdscluster | Ensure RDS cluster configured to copy tags to snapshots | Terraform | | | 750 | CKVAWS314 | resource | awscodebuildproject | Ensure CodeBuild project environments have a logging configuration | Terraform | | | 751 | CKVAWS315 | resource | awsautoscalinggroup | Ensure EC2 Auto Scaling groups use EC2 launch templates | Terraform | | | 752 | CKVAWS316 | resource | awscodebuildproject | Ensure CodeBuild project environments do not have privileged mode enabled | Terraform | | | 753 | CKVAWS317 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | | | 754 | CKVAWS317 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | | | 755 | CKVAWS317 | resource | awselasticsearchdomain | Ensure Elasticsearch Domain Audit Logging is enabled | Terraform | | | 756 | CKVAWS317 | resource | awsopensearchdomain | Ensure Elasticsearch Domain Audit Logging is enabled | Terraform | | | 757 | CKVAWS318 | resource | awselasticsearchdomain | Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA | Terraform | | | 758 | CKVAWS318 | resource | awsopensearchdomain | Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA | Terraform | | | 759 | CKVAWS319 | resource | awscloudwatchmetric_alarm | Ensure that CloudWatch alarm actions are enabled | Terraform | | | 760 | CKVAWS320 | resource | awsredshiftcluster | Ensure Redshift clusters do not use the default database name | Terraform | | | 761 | CKVAWS321 | resource | awsredshiftcluster | Ensure Redshift clusters use enhanced VPC routing | Terraform | | | 762 | CKVAWS322 | resource | awselasticachecluster | Ensure ElastiCache for Redis cache clusters have auto minor version upgrades enabled | Terraform | | | 763 | CKVAWS323 | resource | awselasticachecluster | Ensure ElastiCache clusters do not use the default subnet group | Terraform | | | 764 | CKVAWS324 | resource | awsrdscluster | Ensure that RDS Cluster log capture is enabled | Terraform | | | 765 | CKVAWS325 | resource | awsrdscluster | Ensure that RDS Cluster audit logging is enabled for MySQL engine | Terraform | | | 766 | CKVAWS326 | resource | awsrdscluster | Ensure that RDS Aurora Clusters have backtracking enabled | Terraform | | | 767 | CKVAWS327 | resource | awsrdscluster | Ensure RDS Clusters are encrypted using KMS CMKs | Terraform | | | 768 | CKVAWS328 | resource | aws_alb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | | | 769 | CKVAWS328 | resource | aws_elb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | | | 770 | CKVAWS328 | resource | aws_lb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | | | 771 | CKVAWS329 | resource | awsefsaccess_point | EFS access points should enforce a root directory | Terraform | | | 772 | CKVAWS330 | resource | awsefsaccess_point | EFS access points should enforce a user identity | Terraform | | | 773 | CKVAWS331 | resource | awsec2transit_gateway | Ensure Transit Gateways do not automatically accept VPC attachment requests | Terraform | | | 774 | CKVAWS332 | resource | awsecsservice | Ensure ECS Fargate services run on the latest Fargate platform version | Terraform | | | 775 | CKVAWS333 | resource | awsecsservice | Ensure ECS services do not have public IP addresses assigned to them automatically | Terraform | | | 776 | CKVAWS334 | resource | awsecstask_definition | Ensure ECS containers should run as non-privileged | Terraform | | | 777 | CKVAWS335 | resource | awsecstask_definition | Ensure ECS task definitions should not share the host's process namespace | Terraform | | | 778 | CKVAWS336 | resource | awsecstask_definition | Ensure ECS containers are limited to read-only access to root filesystems | Terraform | | | 779 | CKVAWS337 | resource | awsssmparameter | Ensure SSM parameters are using KMS CMK | Terraform | | | 780 | CKVAWS338 | resource | awscloudwatchlog_group | Ensure CloudWatch log groups retains logs for at least 1 year | Terraform | | | 781 | CKVAWS339 | resource | awsekscluster | Ensure EKS clusters run on a supported Kubernetes version | Terraform | | | 782 | CKVAWS340 | resource | awselasticbeanstalk_environment | Ensure Elastic Beanstalk managed platform updates are enabled | Terraform | | | 783 | CKVAWS341 | resource | awslaunchconfiguration | Ensure Launch template should not have a metadata response hop limit greater than 1 | Terraform | | | 784 | CKVAWS341 | resource | awslaunchtemplate | Ensure Launch template should not have a metadata response hop limit greater than 1 | Terraform | | | 785 | CKVAWS342 | resource | awswafrule_group | Ensure WAF rule has any actions | Terraform | | | 786 | CKVAWS342 | resource | awswafweb_acl | Ensure WAF rule has any actions | Terraform | | | 787 | CKVAWS342 | resource | awswafregionalrule_group | Ensure WAF rule has any actions | Terraform | | | 788 | CKVAWS342 | resource | awswafregionalweb_acl | Ensure WAF rule has any actions | Terraform | | | 789 | CKVAWS342 | resource | awswafv2rule_group | Ensure WAF rule has any actions | Terraform | | | 790 | CKVAWS342 | resource | awswafv2web_acl | Ensure WAF rule has any actions | Terraform | | | 791 | CKVAWS343 | resource | awsredshiftcluster | Ensure Amazon Redshift clusters should have automatic snapshots enabled | Terraform | | | 792 | CKVAWS344 | resource | awsnetworkfirewallfirewall | Ensure that Network firewalls have deletion protection enabled | Terraform | | | 793 | CKVAWS345 | resource | awsnetworkfirewallfirewall | Ensure that Network firewall encryption is via a CMK | Terraform | | | 794 | CKVAWS345 | resource | awsnetworkfirewallrule_group | Ensure that Network firewall encryption is via a CMK | Terraform | | | 795 | CKVAWS346 | resource | awsnetworkfirewallfirewall_policy | Ensure Network Firewall Policy defines an encryption configuration that uses a customer managed Key (CMK) | Terraform | | | 796 | CKVAWS347 | resource | awsneptunecluster | Ensure Neptune is encrypted by KMS using a customer managed Key (CMK) | Terraform | | | 797 | CKVAWS348 | resource | awsiamaccess_key | Ensure IAM root user doesnt have Access keys | Terraform | | | 798 | CKVAWS349 | resource | awsemrsecurity_configuration | Ensure EMR Cluster security configuration encrypts local disks | Terraform | | | 799 | CKVAWS350 | resource | awsemrsecurity_configuration | Ensure EMR Cluster security configuration encrypts EBS disks | Terraform | | | 800 | CKVAWS351 | resource | awsemrsecurity_configuration | Ensure EMR Cluster security configuration encrypts InTransit | Terraform | | | 801 | CKVAWS352 | resource | awsnetworkacl_rule | Ensure NACL ingress does not allow all Ports | Terraform | | | 802 | CKVAWS353 | resource | awsdbinstance | Ensure that RDS instances have performance insights enabled | Terraform | | | 803 | CKVAWS353 | resource | awsrdscluster_instance | Ensure that RDS instances have performance insights enabled | Terraform | | | 804 | CKVAWS354 | resource | awsdbinstance | Ensure RDS Performance Insights are encrypted using KMS CMKs | Terraform | | | 805 | CKVAWS354 | resource | awsrdscluster_instance | Ensure RDS Performance Insights are encrypted using KMS CMKs | Terraform | | | 806 | CKVAWS355 | resource | awsiamgroup_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | | | 807 | CKVAWS355 | resource | awsiampolicy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | | | 808 | CKVAWS355 | resource | awsiamrole_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | | | 809 | CKVAWS355 | resource | awsiamuser_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | | | 810 | CKVAWS355 | resource | awsssoadminpermissionsetinline_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | | | 811 | CKVAWS356 | data | awsiampolicy_document | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | | | 812 | CKVAWS357 | resource | awstransferserver | Ensure Transfer Server allows only secure protocols | Terraform | | | 813 | CKVAWS358 | data | awsiampolicy_document | Ensure GitHub Actions OIDC trust policies only allows actions from a specific known organization | Terraform | | | 814 | CKVAWS359 | resource | awsneptunecluster | Neptune DB clusters should have IAM database authentication enabled | Terraform | | | 815 | CKVAWS360 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB has an adequate backup retention period | Cloudformation | | | 816 | CKVAWS360 | resource | awsdocdbcluster | Ensure DocumentDB has an adequate backup retention period | Terraform | | | 817 | CKVAWS361 | resource | AWS::Neptune::DBCluster | Ensure that Neptune DB cluster has automated backups enabled with adequate retention | Cloudformation | | | 818 | CKVAWS361 | resource | awsneptunecluster | Ensure that Neptune DB cluster has automated backups enabled with adequate retention | Terraform | | | 819 | CKVAWS362 | resource | awsneptunecluster | Neptune DB clusters should be configured to copy tags to snapshots | Terraform | | | 820 | CKVAWS363 | resource | AWS::Lambda::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | | | 821 | CKVAWS363 | resource | AWS::Serverless::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | | | 822 | CKVAWS363 | resource | awslambdafunction | Ensure Lambda Runtime is not deprecated | Terraform | | | 823 | CKVAWS364 | resource | AWS::Lambda::Permission | Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount | Cloudformation | | | 824 | CKVAWS364 | resource | awslambdapermission | Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount | Terraform | | | 825 | CKVAWS365 | resource | awssesconfiguration_set | Ensure SES Configuration Set enforces TLS usage | Terraform | | | 826 | CKVAWS366 | resource | AWS::Cognito::IdentityPool | Ensure AWS Cognito identity pool does not allow unauthenticated guest access | Cloudformation | | | 827 | CKVAWS366 | resource | awscognitoidentity_pool | Ensure AWS Cognito identity pool does not allow unauthenticated guest access | Terraform | | | 828 | CKV2AWS1 | resource | awsnetworkacl | Ensure that all NACL are attached to subnets | Terraform | | | 829 | CKV2AWS1 | resource | aws_subnet | Ensure that all NACL are attached to subnets | Terraform | | | 830 | CKV2AWS2 | resource | awsebsvolume | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | | | 831 | CKV2AWS2 | resource | awsvolumeattachment | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | | | 832 | CKV2AWS3 | resource | awsguarddutydetector | Ensure GuardDuty is enabled to specific org/region | Terraform | | | 833 | CKV2AWS3 | resource | awsguarddutyorganization_configuration | Ensure GuardDuty is enabled to specific org/region | Terraform | | | 834 | CKV2AWS4 | resource | awsapigatewaymethodsettings | Ensure API Gateway stage have logging level defined as appropriate | Terraform | | | 835 | CKV2AWS4 | resource | awsapigateway_stage | Ensure API Gateway stage have logging level defined as appropriate | Terraform | | | 836 | CKV2AWS5 | resource | awssecuritygroup | Ensure that Security Groups are attached to another resource | Terraform | | | 837 | CKV2AWS6 | resource | awss3bucket | Ensure that S3 bucket has a Public Access block | Terraform | | | 838 | CKV2AWS6 | resource | awss3bucketpublicaccess_block | Ensure that S3 bucket has a Public Access block | Terraform | | | 839 | CKV2AWS7 | resource | awsemrcluster | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | | | 840 | CKV2AWS7 | resource | awssecuritygroup | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | | | 841 | CKV2AWS8 | resource | awsrdscluster | Ensure that RDS clusters has backup plan of AWS Backup | Terraform | | | 842 | CKV2AWS9 | resource | awsbackupselection | Ensure that EBS are added in the backup plans of AWS Backup | Terraform | | | 843 | CKV2AWS10 | resource | aws_cloudtrail | Ensure CloudTrail trails are integrated with CloudWatch Logs | Terraform | | | 844 | CKV2AWS11 | resource | aws_vpc | Ensure VPC flow logging is enabled in all VPCs | Terraform | | | 845 | CKV2AWS12 | resource | awsdefaultsecurity_group | Ensure the default security group of every VPC restricts all traffic | Terraform | | | 846 | CKV2AWS12 | resource | aws_vpc | Ensure the default security group of every VPC restricts all traffic | Terraform | | | 847 | CKV2AWS14 | resource | awsiamgroup | Ensure that IAM groups includes at least one IAM user | Terraform | | | 848 | CKV2AWS14 | resource | awsiamgroup_membership | Ensure that IAM groups includes at least one IAM user | Terraform | | | 849 | CKV2AWS15 | resource | awsautoscalinggroup | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. | Terraform | | | 850 | CKV2AWS15 | resource | aws_elb | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. | Terraform | | | 851 | CKV2AWS15 | resource | awslbtarget_group | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health

| Terraform | | | 852 | CKV2AWS16 | resource | awsappautoscalingtarget | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | | | 853 | CKV2AWS16 | resource | awsdynamodbtable | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | | | 854 | CKV2AWS18 | resource | awsbackupselection | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup | Terraform | | | 855 | CKV2AWS19 | resource | aws_eip | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | | | 856 | CKV2AWS19 | resource | awseipassociation | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | | | 857 | CKV2AWS20 | resource | aws_alb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | | | 858 | CKV2AWS20 | resource | awsalblistener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | | | 859 | CKV2AWS20 | resource | aws_lb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | | | 860 | CKV2AWS20 | resource | awslblistener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | | | 861 | CKV2AWS21 | resource | awsiamgroup_membership | Ensure that all IAM users are members of at least one IAM group. | Terraform | | | 862 | CKV2AWS22 | resource | awsiamuser | Ensure an IAM User does not have access to the console | Terraform | | | 863 | CKV2AWS23 | resource | awsroute53record | Route53 A Record has Attached Resource | Terraform | | | 864 | CKV2AWS27 | resource | awsrdscluster | Ensure Postgres RDS as awsrdscluster has Query Logging enabled | Terraform | | | 865 | CKV2AWS27 | resource | awsrdsclusterparametergroup | Ensure Postgres RDS as awsrdscluster has Query Logging enabled | Terraform | | | 866 | CKV2AWS28 | resource | aws_alb | Ensure public facing ALB are protected by WAF | Terraform | | | 867 | CKV2AWS28 | resource | aws_lb | Ensure public facing ALB are protected by WAF | Terraform | | | 868 | CKV2AWS29 | resource | awsapigatewayrestapi | Ensure public API gateway are protected by WAF | Terraform | | | 869 | CKV2AWS29 | resource | awsapigateway_stage | Ensure public API gateway are protected by WAF | Terraform | | | 870 | CKV2AWS30 | resource | awsdbinstance | Ensure Postgres RDS as awsdbinstance has Query Logging enabled | Terraform | | | 871 | CKV2AWS30 | resource | awsdbparametergroup | Ensure Postgres RDS as awsdb_instance has Query Logging enabled | Terraform | | | 872 | CKV2AWS31 | resource | awswafv2web_acl | Ensure WAF2 has a Logging Configuration | Terraform | | | 873 | CKV2AWS32 | resource | awscloudfrontdistribution | Ensure CloudFront distribution has a response headers policy attached | Terraform | | | 874 | CKV2AWS33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | | | 875 | CKV2AWS33 | resource | awsappsyncgraphql_api | Ensure AppSync is protected by WAF | Terraform | | | 876 | CKV2AWS34 | resource | awsssmparameter | AWS SSM Parameter should be Encrypted | Terraform | | | 877 | CKV2AWS35 | resource | aws_route | AWS NAT Gateways should be utilized for the default route | Terraform | | | 878 | CKV2AWS35 | resource | awsroutetable | AWS NAT Gateways should be utilized for the default route | Terraform | | | 879 | CKV2AWS36 | resource | awsssmparameter | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | | | 880 | CKV2AWS36 | resource |

| Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | | | 881 | CKV2AWS37 | resource | aws | Ensure CodeCommit associates an approval rule | Terraform | | | 882 | CKV2AWS37 | resource | awsaccessanalyzeranalyzer | Ensure CodeCommit associates an approval rule | Terraform | | | 883 | CKV2AWS37 | resource | awsacmcertificate | Ensure CodeCommit associates an approval rule | Terraform | | | 884 | CKV2AWS37 | resource | awsacmcertificate_validation | Ensure CodeCommit associates an approval rule | Terraform | | | 885 | CKV2AWS37 | resource | awsacmpcacertificate_authority | Ensure CodeCommit associates an approval rule | Terraform | | | 886 | CKV2AWS37 | resource | aws_ami | Ensure CodeCommit associates an approval rule | Terraform | | | 887 | CKV2AWS37 | resource | awsamicopy | Ensure CodeCommit associates an approval rule | Terraform | | | 888 | CKV2AWS37 | resource | awsamifrom_instance | Ensure CodeCommit associates an approval rule | Terraform | | | 889 | CKV2AWS37 | resource | awsamilaunch_permission | Ensure CodeCommit associates an approval rule | Terraform | | | 890 | CKV2AWS37 | resource | awsapigateway_account | Ensure CodeCommit associates an approval rule | Terraform | | | 891 | CKV2AWS37 | resource | awsapigatewayapikey | Ensure CodeCommit associates an approval rule | Terraform | | | 892 | CKV2AWS37 | resource | awsapigateway_authorizer | Ensure CodeCommit associates an approval rule | Terraform | | | 893 | CKV2AWS37 | resource | awsapigatewaybasepath_mapping | Ensure CodeCommit associates an approval rule | Terraform | | | 894 | CKV2AWS37 | resource | awsapigatewayclientcertificate | Ensure CodeCommit associates an approval rule | Terraform | | | 895 | CKV2AWS37 | resource | awsapigateway_deployment | Ensure CodeCommit associates an approval rule | Terraform | | | 896 | CKV2AWS37 | resource | awsapigatewaydocumentationpart | Ensure CodeCommit associates an approval rule | Terraform | | | 897 | CKV2AWS37 | resource | awsapigatewaydocumentationversion | Ensure CodeCommit associates an approval rule | Terraform | | | 898 | CKV2AWS37 | resource | awsapigatewaydomainname | Ensure CodeCommit associates an approval rule | Terraform | | | 899 | CKV2AWS37 | resource | awsapigatewaygatewayresponse | Ensure CodeCommit associates an approval rule | Terraform | | | 900 | CKV2AWS37 | resource | awsapigateway_integration | Ensure CodeCommit associates an approval rule | Terraform | | | 901 | CKV2AWS37 | resource | awsapigatewayintegrationresponse | Ensure CodeCommit associates an approval rule | Terraform | | | 902 | CKV2AWS37 | resource | awsapigateway_method | Ensure CodeCommit associates an approval rule | Terraform | | | 903 | CKV2AWS37 | resource | awsapigatewaymethodresponse | Ensure CodeCommit associates an approval rule | Terraform | | | 904 | CKV2AWS37 | resource | awsapigatewaymethodsettings | Ensure CodeCommit associates an approval rule | Terraform | | | 905 | CKV2AWS37 | resource | awsapigateway_model | Ensure CodeCommit associates an approval rule | Terraform | | | 906 | CKV2AWS37 | resource | awsapigatewayrequestvalidator | Ensure CodeCommit associates an approval rule | Terraform | | | 907 | CKV2AWS37 | resource | awsapigateway_resource | Ensure CodeCommit associates an approval rule | Terraform | | | 908 | CKV2AWS37 | resource | awsapigatewayrestapi | Ensure CodeCommit associates an approval rule | Terraform | | | 909 | CKV2AWS37 | resource | awsapigateway_stage | Ensure CodeCommit associates an approval rule | Terraform | | | 910 | CKV2AWS37 | resource | awsapigatewayusageplan | Ensure CodeCommit associates an approval rule | Terraform | | | 911 | CKV2AWS37 | resource | awsapigatewayusageplan_key | Ensure CodeCommit associates an approval rule | Terraform | | | 912 | CKV2AWS37 | resource | awsapigatewayvpclink | Ensure CodeCommit associates an approval rule | Terraform | | | 913 | CKV2AWS37 | resource | awsapigatewayv2api | Ensure CodeCommit associates an approval rule | Terraform | | | 914 | CKV2AWS37 | resource | awsapigatewayv2api_mapping | Ensure CodeCommit associates an approval rule | Terraform | | | 915 | CKV2AWS37 | resource | awsapigatewayv2authorizer | Ensure CodeCommit associates an approval rule | Terraform | | | 916 | CKV2AWS37 | resource | awsapigatewayv2deployment | Ensure CodeCommit associates an approval rule | Terraform | | | 917 | CKV2AWS37 | resource | awsapigatewayv2domain_name | Ensure CodeCommit associates an approval rule | Terraform | | | 918 | CKV2AWS37 | resource | awsapigatewayv2integration | Ensure CodeCommit associates an approval rule | Terraform | | | 919 | CKV2AWS37 | resource | awsapigatewayv2integration_response | Ensure CodeCommit associates an approval rule | Terraform | | | 920 | CKV2AWS37 | resource | awsapigatewayv2model | Ensure CodeCommit associates an approval rule | Terraform | | | 921 | CKV2AWS37 | resource | awsapigatewayv2route | Ensure CodeCommit associates an approval rule | Terraform | | | 922 | CKV2AWS37 | resource | awsapigatewayv2route_response | Ensure CodeCommit associates an approval rule | Terraform | | | 923 | CKV2AWS37 | resource | awsapigatewayv2stage | Ensure CodeCommit associates an approval rule | Terraform | | | 924 | CKV2AWS37 | resource | awsapigatewayv2vpc_link | Ensure CodeCommit associates an approval rule | Terraform | | | 925 | CKV2AWS37 | resource | awsappcookiestickinesspolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 926 | CKV2AWS37 | resource | awsappautoscalingpolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 927 | CKV2AWS37 | resource | awsappautoscalingscheduled_action | Ensure CodeCommit associates an approval rule | Terraform | | | 928 | CKV2AWS37 | resource | awsappautoscalingtarget | Ensure CodeCommit associates an approval rule | Terraform | | | 929 | CKV2AWS37 | resource | awsappmeshmesh | Ensure CodeCommit associates an approval rule | Terraform | | | 930 | CKV2AWS37 | resource | awsappmeshroute | Ensure CodeCommit associates an approval rule | Terraform | | | 931 | CKV2AWS37 | resource | awsappmeshvirtual_node | Ensure CodeCommit associates an approval rule | Terraform | | | 932 | CKV2AWS37 | resource | awsappmeshvirtual_router | Ensure CodeCommit associates an approval rule | Terraform | | | 933 | CKV2AWS37 | resource | awsappmeshvirtual_service | Ensure CodeCommit associates an approval rule | Terraform | | | 934 | CKV2AWS37 | resource | awsappsyncapi_key | Ensure CodeCommit associates an approval rule | Terraform | | | 935 | CKV2AWS37 | resource | awsappsyncdatasource | Ensure CodeCommit associates an approval rule | Terraform | | | 936 | CKV2AWS37 | resource | awsappsyncfunction | Ensure CodeCommit associates an approval rule | Terraform | | | 937 | CKV2AWS37 | resource | awsappsyncgraphql_api | Ensure CodeCommit associates an approval rule | Terraform | | | 938 | CKV2AWS37 | resource | awsappsyncresolver | Ensure CodeCommit associates an approval rule | Terraform | | | 939 | CKV2AWS37 | resource | awsathenadatabase | Ensure CodeCommit associates an approval rule | Terraform | | | 940 | CKV2AWS37 | resource | awsathenanamed_query | Ensure CodeCommit associates an approval rule | Terraform | | | 941 | CKV2AWS37 | resource | awsathenaworkgroup | Ensure CodeCommit associates an approval rule | Terraform | | | 942 | CKV2AWS37 | resource | awsautoscalingattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 943 | CKV2AWS37 | resource | awsautoscalinggroup | Ensure CodeCommit associates an approval rule | Terraform | | | 944 | CKV2AWS37 | resource | awsautoscalinglifecycle_hook | Ensure CodeCommit associates an approval rule | Terraform | | | 945 | CKV2AWS37 | resource | awsautoscalingnotification | Ensure CodeCommit associates an approval rule | Terraform | | | 946 | CKV2AWS37 | resource | awsautoscalingpolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 947 | CKV2AWS37 | resource | awsautoscalingschedule | Ensure CodeCommit associates an approval rule | Terraform | | | 948 | CKV2AWS37 | resource | awsbackupplan | Ensure CodeCommit associates an approval rule | Terraform | | | 949 | CKV2AWS37 | resource | awsbackupselection | Ensure CodeCommit associates an approval rule | Terraform | | | 950 | CKV2AWS37 | resource | awsbackupvault | Ensure CodeCommit associates an approval rule | Terraform | | | 951 | CKV2AWS37 | resource | awsbatchcompute_environment | Ensure CodeCommit associates an approval rule | Terraform | | | 952 | CKV2AWS37 | resource | awsbatchjob_definition | Ensure CodeCommit associates an approval rule | Terraform | | | 953 | CKV2AWS37 | resource | awsbatchjob_queue | Ensure CodeCommit associates an approval rule | Terraform | | | 954 | CKV2AWS37 | resource | awsbudgetsbudget | Ensure CodeCommit associates an approval rule | Terraform | | | 955 | CKV2AWS37 | resource | awscloud9environment_ec2 | Ensure CodeCommit associates an approval rule | Terraform | | | 956 | CKV2AWS37 | resource | awscloudformationstack | Ensure CodeCommit associates an approval rule | Terraform | | | 957 | CKV2AWS37 | resource | awscloudformationstack_set | Ensure CodeCommit associates an approval rule | Terraform | | | 958 | CKV2AWS37 | resource | awscloudformationstacksetinstance | Ensure CodeCommit associates an approval rule | Terraform | | | 959 | CKV2AWS37 | resource | awscloudfrontdistribution | Ensure CodeCommit associates an approval rule | Terraform | | | 960 | CKV2AWS37 | resource | awscloudfrontoriginaccessidentity | Ensure CodeCommit associates an approval rule | Terraform | | | 961 | CKV2AWS37 | resource | awscloudfrontpublic_key | Ensure CodeCommit associates an approval rule | Terraform | | | 962 | CKV2AWS37 | resource | awscloudhsmv2_cluster | Ensure CodeCommit associates an approval rule | Terraform | | | 963 | CKV2AWS37 | resource | awscloudhsmv2_hsm | Ensure CodeCommit associates an approval rule | Terraform | | | 964 | CKV2AWS37 | resource | aws_cloudtrail | Ensure CodeCommit associates an approval rule | Terraform | | | 965 | CKV2AWS37 | resource | awscloudwatchdashboard | Ensure CodeCommit associates an approval rule | Terraform | | | 966 | CKV2AWS37 | resource | awscloudwatchevent_permission | Ensure CodeCommit associates an approval rule | Terraform | | | 967 | CKV2AWS37 | resource | awscloudwatchevent_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 968 | CKV2AWS37 | resource | awscloudwatchevent_target | Ensure CodeCommit associates an approval rule | Terraform | | | 969 | CKV2AWS37 | resource | awscloudwatchlog_destination | Ensure CodeCommit associates an approval rule | Terraform | | | 970 | CKV2AWS37 | resource | awscloudwatchlogdestinationpolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 971 | CKV2AWS37 | resource | awscloudwatchlog_group | Ensure CodeCommit associates an approval rule | Terraform | | | 972 | CKV2AWS37 | resource | awscloudwatchlogmetricfilter | Ensure CodeCommit associates an approval rule | Terraform | | | 973 | CKV2AWS37 | resource | awscloudwatchlogresourcepolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 974 | CKV2AWS37 | resource | awscloudwatchlog_stream | Ensure CodeCommit associates an approval rule | Terraform | | | 975 | CKV2AWS37 | resource | awscloudwatchlogsubscriptionfilter | Ensure CodeCommit associates an approval rule | Terraform | | | 976 | CKV2AWS37 | resource | awscloudwatchmetric_alarm | Ensure CodeCommit associates an approval rule | Terraform | | | 977 | CKV2AWS37 | resource | awscodebuildproject | Ensure CodeCommit associates an approval rule | Terraform | | | 978 | CKV2AWS37 | resource | awscodebuildsource_credential | Ensure CodeCommit associates an approval rule | Terraform | | | 979 | CKV2AWS37 | resource | awscodebuildwebhook | Ensure CodeCommit associates an approval rule | Terraform | | | 980 | CKV2AWS37 | resource | awscodecommitrepository | Ensure CodeCommit associates an approval rule | Terraform | | | 981 | CKV2AWS37 | resource | awscodecommittrigger | Ensure CodeCommit associates an approval rule | Terraform | | | 982 | CKV2AWS37 | resource | awscodedeployapp | Ensure CodeCommit associates an approval rule | Terraform | | | 983 | CKV2AWS37 | resource | awscodedeploydeployment_config | Ensure CodeCommit associates an approval rule | Terraform | | | 984 | CKV2AWS37 | resource | awscodedeploydeployment_group | Ensure CodeCommit associates an approval rule | Terraform | | | 985 | CKV2AWS37 | resource | aws_codepipeline | Ensure CodeCommit associates an approval rule | Terraform | | | 986 | CKV2AWS37 | resource | awscodepipelinewebhook | Ensure CodeCommit associates an approval rule | Terraform | | | 987 | CKV2AWS37 | resource | awscodestarnotificationsnotification_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 988 | CKV2AWS37 | resource | awscognitoidentity_pool | Ensure CodeCommit associates an approval rule | Terraform | | | 989 | CKV2AWS37 | resource | awscognitoidentitypoolroles_attachment | Ensure CodeCommit associates an approval rule | Terraform | | | 990 | CKV2AWS37 | resource | awscognitoidentity_provider | Ensure CodeCommit associates an approval rule | Terraform | | | 991 | CKV2AWS37 | resource | awscognitoresource_server | Ensure CodeCommit associates an approval rule | Terraform | | | 992 | CKV2AWS37 | resource | awscognitouser_group | Ensure CodeCommit associates an approval rule | Terraform | | | 993 | CKV2AWS37 | resource | awscognitouser_pool | Ensure CodeCommit associates an approval rule | Terraform | | | 994 | CKV2AWS37 | resource | awscognitouserpoolclient | Ensure CodeCommit associates an approval rule | Terraform | | | 995 | CKV2AWS37 | resource | awscognitouserpooldomain | Ensure CodeCommit associates an approval rule | Terraform | | | 996 | CKV2AWS37 | resource | awsconfigaggregate_authorization | Ensure CodeCommit associates an approval rule | Terraform | | | 997 | CKV2AWS37 | resource | awsconfigconfig_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 998 | CKV2AWS37 | resource | awsconfigconfiguration_aggregator | Ensure CodeCommit associates an approval rule | Terraform | | | 999 | CKV2AWS37 | resource | awsconfigconfiguration_recorder | Ensure CodeCommit associates an approval rule | Terraform | | | 1000 | CKV2AWS37 | resource | awsconfigconfigurationrecorderstatus | Ensure CodeCommit associates an approval rule | Terraform | | | 1001 | CKV2AWS37 | resource | awsconfigdelivery_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1002 | CKV2AWS37 | resource | awsconfigorganizationcustomrule | Ensure CodeCommit associates an approval rule | Terraform | | | 1003 | CKV2AWS37 | resource | awsconfigorganizationmanagedrule | Ensure CodeCommit associates an approval rule | Terraform | | | 1004 | CKV2AWS37 | resource | awscurreport_definition | Ensure CodeCommit associates an approval rule | Terraform | | | 1005 | CKV2AWS37 | resource | awscustomergateway | Ensure CodeCommit associates an approval rule | Terraform | | | 1006 | CKV2AWS37 | resource | awsdatapipelinepipeline | Ensure CodeCommit associates an approval rule | Terraform | | | 1007 | CKV2AWS37 | resource | awsdatasyncagent | Ensure CodeCommit associates an approval rule | Terraform | | | 1008 | CKV2AWS37 | resource | awsdatasynclocation_efs | Ensure CodeCommit associates an approval rule | Terraform | | | 1009 | CKV2AWS37 | resource | awsdatasynclocation_nfs | Ensure CodeCommit associates an approval rule | Terraform | | | 1010 | CKV2AWS37 | resource | awsdatasynclocation_s3 | Ensure CodeCommit associates an approval rule | Terraform | | | 1011 | CKV2AWS37 | resource | awsdatasynclocation_smb | Ensure CodeCommit associates an approval rule | Terraform | | | 1012 | CKV2AWS37 | resource | awsdatasynctask | Ensure CodeCommit associates an approval rule | Terraform | | | 1013 | CKV2AWS37 | resource | awsdaxcluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1014 | CKV2AWS37 | resource | awsdaxparameter_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1015 | CKV2AWS37 | resource | awsdaxsubnet_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1016 | CKV2AWS37 | resource | awsdbcluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | | | 1017 | CKV2AWS37 | resource | awsdbevent_subscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1018 | CKV2AWS37 | resource | awsdbinstance | Ensure CodeCommit associates an approval rule | Terraform | | | 1019 | CKV2AWS37 | resource | awsdbinstanceroleassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1020 | CKV2AWS37 | resource | awsdboption_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1021 | CKV2AWS37 | resource | awsdbparameter_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1022 | CKV2AWS37 | resource | awsdbsecurity_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1023 | CKV2AWS37 | resource | awsdbsnapshot | Ensure CodeCommit associates an approval rule | Terraform | | | 1024 | CKV2AWS37 | resource | awsdbsubnet_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1025 | CKV2AWS37 | resource | awsdefaultnetwork_acl | Ensure CodeCommit associates an approval rule | Terraform | | | 1026 | CKV2AWS37 | resource | awsdefaultroute_table | Ensure CodeCommit associates an approval rule | Terraform | | | 1027 | CKV2AWS37 | resource | awsdefaultsecurity_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1028 | CKV2AWS37 | resource | awsdefaultsubnet | Ensure CodeCommit associates an approval rule | Terraform | | | 1029 | CKV2AWS37 | resource | awsdefaultvpc | Ensure CodeCommit associates an approval rule | Terraform | | | 1030 | CKV2AWS37 | resource | awsdefaultvpcdhcpoptions | Ensure CodeCommit associates an approval rule | Terraform | | | 1031 | CKV2AWS37 | resource | awsdevicefarmproject | Ensure CodeCommit associates an approval rule | Terraform | | | 1032 | CKV2AWS37 | resource | awsdirectoryserviceconditionalforwarder | Ensure CodeCommit associates an approval rule | Terraform | | | 1033 | CKV2AWS37 | resource | awsdirectoryservice_directory | Ensure CodeCommit associates an approval rule | Terraform | | | 1034 | CKV2AWS37 | resource | awsdirectoryservicelogsubscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1035 | CKV2AWS37 | resource | awsdlmlifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1036 | CKV2AWS37 | resource | awsdmscertificate | Ensure CodeCommit associates an approval rule | Terraform | | | 1037 | CKV2AWS37 | resource | awsdmsendpoint | Ensure CodeCommit associates an approval rule | Terraform | | | 1038 | CKV2AWS37 | resource | awsdmsevent_subscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1039 | CKV2AWS37 | resource | awsdmsreplication_instance | Ensure CodeCommit associates an approval rule | Terraform | | | 1040 | CKV2AWS37 | resource | awsdmsreplicationsubnetgroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1041 | CKV2AWS37 | resource | awsdmsreplication_task | Ensure CodeCommit associates an approval rule | Terraform | | | 1042 | CKV2AWS37 | resource | awsdocdbcluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1043 | CKV2AWS37 | resource | awsdocdbcluster_instance | Ensure CodeCommit associates an approval rule | Terraform | | | 1044 | CKV2AWS37 | resource | awsdocdbclusterparametergroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1045 | CKV2AWS37 | resource | awsdocdbcluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | | | 1046 | CKV2AWS37 | resource | awsdocdbsubnet_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1047 | CKV2AWS37 | resource | awsdxbgp_peer | Ensure CodeCommit associates an approval rule | Terraform | | | 1048 | CKV2AWS37 | resource | awsdxconnection | Ensure CodeCommit associates an approval rule | Terraform | | | 1049 | CKV2AWS37 | resource | awsdxconnection_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1050 | CKV2AWS37 | resource | awsdxgateway | Ensure CodeCommit associates an approval rule | Terraform | | | 1051 | CKV2AWS37 | resource | awsdxgateway_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1052 | CKV2AWS37 | resource | awsdxgatewayassociationproposal | Ensure CodeCommit associates an approval rule | Terraform | | | 1053 | CKV2AWS37 | resource | awsdxhostedprivatevirtual_interface | Ensure CodeCommit associates an approval rule | Terraform | | | 1054 | CKV2AWS37 | resource | awsdxhostedprivatevirtualinterfaceaccepter | Ensure CodeCommit associates an approval rule | Terraform | | | 1055 | CKV2AWS37 | resource | awsdxhostedpublicvirtual_interface | Ensure CodeCommit associates an approval rule | Terraform | | | 1056 | CKV2AWS37 | resource | awsdxhostedpublicvirtualinterfaceaccepter | Ensure CodeCommit associates an approval rule | Terraform | | | 1057 | CKV2AWS37 | resource | awsdxhostedtransitvirtual_interface | Ensure CodeCommit associates an approval rule | Terraform | | | 1058 | CKV2AWS37 | resource | awsdxhostedtransitvirtualinterfaceaccepter | Ensure CodeCommit associates an approval rule | Terraform | | | 1059 | CKV2AWS37 | resource | awsdxlag | Ensure CodeCommit associates an approval rule | Terraform | | | 1060 | CKV2AWS37 | resource | awsdxprivatevirtualinterface | Ensure CodeCommit associates an approval rule | Terraform | | | 1061 | CKV2AWS37 | resource | awsdxpublicvirtualinterface | Ensure CodeCommit associates an approval rule | Terraform | | | 1062 | CKV2AWS37 | resource | awsdxtransitvirtualinterface | Ensure CodeCommit associates an approval rule | Terraform | | | 1063 | CKV2AWS37 | resource | awsdynamodbglobal_table | Ensure CodeCommit associates an approval rule | Terraform | | | 1064 | CKV2AWS37 | resource | awsdynamodbtable | Ensure CodeCommit associates an approval rule | Terraform | | | 1065 | CKV2AWS37 | resource | awsdynamodbtable_item | Ensure CodeCommit associates an approval rule | Terraform | | | 1066 | CKV2AWS37 | resource | awsebsdefaultkmskey | Ensure CodeCommit associates an approval rule | Terraform | | | 1067 | CKV2AWS37 | resource | awsebsencryptionbydefault | Ensure CodeCommit associates an approval rule | Terraform | | | 1068 | CKV2AWS37 | resource | awsebssnapshot | Ensure CodeCommit associates an approval rule | Terraform | | | 1069 | CKV2AWS37 | resource | awsebssnapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | | | 1070 | CKV2AWS37 | resource | awsebsvolume | Ensure CodeCommit associates an approval rule | Terraform | | | 1071 | CKV2AWS37 | resource | awsec2availabilityzonegroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1072 | CKV2AWS37 | resource | awsec2capacity_reservation | Ensure CodeCommit associates an approval rule | Terraform | | | 1073 | CKV2AWS37 | resource | awsec2clientvpnauthorization_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1074 | CKV2AWS37 | resource | awsec2clientvpnendpoint | Ensure CodeCommit associates an approval rule | Terraform | | | 1075 | CKV2AWS37 | resource | awsec2clientvpnnetwork_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1076 | CKV2AWS37 | resource | awsec2clientvpnroute | Ensure CodeCommit associates an approval rule | Terraform | | | 1077 | CKV2AWS37 | resource | awsec2fleet | Ensure CodeCommit associates an approval rule | Terraform | | | 1078 | CKV2AWS37 | resource | awsec2localgatewayroute | Ensure CodeCommit associates an approval rule | Terraform | | | 1079 | CKV2AWS37 | resource | awsec2localgatewayroutetablevpc_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1080 | CKV2AWS37 | resource | awsec2tag | Ensure CodeCommit associates an approval rule | Terraform | | | 1081 | CKV2AWS37 | resource | awsec2trafficmirrorfilter | Ensure CodeCommit associates an approval rule | Terraform | | | 1082 | CKV2AWS37 | resource | awsec2trafficmirrorfilter_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1083 | CKV2AWS37 | resource | awsec2trafficmirrorsession | Ensure CodeCommit associates an approval rule | Terraform | | | 1084 | CKV2AWS37 | resource | awsec2trafficmirrortarget | Ensure CodeCommit associates an approval rule | Terraform | | | 1085 | CKV2AWS37 | resource | awsec2transit_gateway | Ensure CodeCommit associates an approval rule | Terraform | | | 1086 | CKV2AWS37 | resource | awsec2transitgatewaypeering_attachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1087 | CKV2AWS37 | resource | awsec2transitgatewaypeeringattachmentaccepter | Ensure CodeCommit associates an approval rule | Terraform | | | 1088 | CKV2AWS37 | resource | awsec2transitgatewayroute | Ensure CodeCommit associates an approval rule | Terraform | | | 1089 | CKV2AWS37 | resource | awsec2transitgatewayroute_table | Ensure CodeCommit associates an approval rule | Terraform | | | 1090 | CKV2AWS37 | resource | awsec2transitgatewayroutetableassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1091 | CKV2AWS37 | resource | awsec2transitgatewayroutetablepropagation | Ensure CodeCommit associates an approval rule | Terraform | | | 1092 | CKV2AWS37 | resource | awsec2transitgatewayvpc_attachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1093 | CKV2AWS37 | resource | awsec2transitgatewayvpcattachmentaccepter | Ensure CodeCommit associates an approval rule | Terraform | | | 1094 | CKV2AWS37 | resource | awsecrlifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1095 | CKV2AWS37 | resource | awsecrrepository | Ensure CodeCommit associates an approval rule | Terraform | | | 1096 | CKV2AWS37 | resource | awsecrrepository_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1097 | CKV2AWS37 | resource | awsecscapacity_provider | Ensure CodeCommit associates an approval rule | Terraform | | | 1098 | CKV2AWS37 | resource | awsecscluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1099 | CKV2AWS37 | resource | awsecsservice | Ensure CodeCommit associates an approval rule | Terraform | | | 1100 | CKV2AWS37 | resource | awsecstask_definition | Ensure CodeCommit associates an approval rule | Terraform | | | 1101 | CKV2AWS37 | resource | awsefsaccess_point | Ensure CodeCommit associates an approval rule | Terraform | | | 1102 | CKV2AWS37 | resource | awsefsfile_system | Ensure CodeCommit associates an approval rule | Terraform | | | 1103 | CKV2AWS37 | resource | awsefsfilesystempolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1104 | CKV2AWS37 | resource | awsefsmount_target | Ensure CodeCommit associates an approval rule | Terraform | | | 1105 | CKV2AWS37 | resource | awsegressonlyinternetgateway | Ensure CodeCommit associates an approval rule | Terraform | | | 1106 | CKV2AWS37 | resource | aws_eip | Ensure CodeCommit associates an approval rule | Terraform | | | 1107 | CKV2AWS37 | resource | awseipassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1108 | CKV2AWS37 | resource | awsekscluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1109 | CKV2AWS37 | resource | awseksfargate_profile | Ensure CodeCommit associates an approval rule | Terraform | | | 1110 | CKV2AWS37 | resource | awseksnode_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1111 | CKV2AWS37 | resource | awselasticbeanstalk_application | Ensure CodeCommit associates an approval rule | Terraform | | | 1112 | CKV2AWS37 | resource | awselasticbeanstalkapplicationversion | Ensure CodeCommit associates an approval rule | Terraform | | | 1113 | CKV2AWS37 | resource | awselasticbeanstalkconfigurationtemplate | Ensure CodeCommit associates an approval rule | Terraform | | | 1114 | CKV2AWS37 | resource | awselasticbeanstalk_environment | Ensure CodeCommit associates an approval rule | Terraform | | | 1115 | CKV2AWS37 | resource | awselasticachecluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1116 | CKV2AWS37 | resource | awselasticacheparameter_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1117 | CKV2AWS37 | resource | awselasticachereplication_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1118 | CKV2AWS37 | resource | awselasticachesecurity_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1119 | CKV2AWS37 | resource | awselasticachesubnet_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1120 | CKV2AWS37 | resource | awselasticsearchdomain | Ensure CodeCommit associates an approval rule | Terraform | | | 1121 | CKV2AWS37 | resource | awselasticsearchdomain_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1122 | CKV2AWS37 | resource | awselastictranscoderpipeline | Ensure CodeCommit associates an approval rule | Terraform | | | 1123 | CKV2AWS37 | resource | awselastictranscoderpreset | Ensure CodeCommit associates an approval rule | Terraform | | | 1124 | CKV2AWS37 | resource | aws_elb | Ensure CodeCommit associates an approval rule | Terraform | | | 1125 | CKV2AWS37 | resource | awselbattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1126 | CKV2AWS37 | resource | awsemrcluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1127 | CKV2AWS37 | resource | awsemrinstance_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1128 | CKV2AWS37 | resource | awsemrsecurity_configuration | Ensure CodeCommit associates an approval rule | Terraform | | | 1129 | CKV2AWS37 | resource | awsflowlog | Ensure CodeCommit associates an approval rule | Terraform | | | 1130 | CKV2AWS37 | resource | awsfmsadmin_account | Ensure CodeCommit associates an approval rule | Terraform | | | 1131 | CKV2AWS37 | resource | awsfsxlustrefilesystem | Ensure CodeCommit associates an approval rule | Terraform | | | 1132 | CKV2AWS37 | resource | awsfsxwindowsfilesystem | Ensure CodeCommit associates an approval rule | Terraform | | | 1133 | CKV2AWS37 | resource | awsgameliftalias | Ensure CodeCommit associates an approval rule | Terraform | | | 1134 | CKV2AWS37 | resource | awsgameliftbuild | Ensure CodeCommit associates an approval rule | Terraform | | | 1135 | CKV2AWS37 | resource | awsgameliftfleet | Ensure CodeCommit associates an approval rule | Terraform | | | 1136 | CKV2AWS37 | resource | awsgameliftgamesessionqueue | Ensure CodeCommit associates an approval rule | Terraform | | | 1137 | CKV2AWS37 | resource | awsglaciervault | Ensure CodeCommit associates an approval rule | Terraform | | | 1138 | CKV2AWS37 | resource | awsglaciervault_lock | Ensure CodeCommit associates an approval rule | Terraform | | | 1139 | CKV2AWS37 | resource | awsglobalacceleratoraccelerator | Ensure CodeCommit associates an approval rule | Terraform | | | 1140 | CKV2AWS37 | resource | awsglobalacceleratorendpoint_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1141 | CKV2AWS37 | resource | awsglobalacceleratorlistener | Ensure CodeCommit associates an approval rule | Terraform | | | 1142 | CKV2AWS37 | resource | awsgluecatalog_database | Ensure CodeCommit associates an approval rule | Terraform | | | 1143 | CKV2AWS37 | resource | awsgluecatalog_table | Ensure CodeCommit associates an approval rule | Terraform | | | 1144 | CKV2AWS37 | resource | awsglueclassifier | Ensure CodeCommit associates an approval rule | Terraform | | | 1145 | CKV2AWS37 | resource | awsglueconnection | Ensure CodeCommit associates an approval rule | Terraform | | | 1146 | CKV2AWS37 | resource | awsgluecrawler | Ensure CodeCommit associates an approval rule | Terraform | | | 1147 | CKV2AWS37 | resource | awsgluejob | Ensure CodeCommit associates an approval rule | Terraform | | | 1148 | CKV2AWS37 | resource | awsgluesecurity_configuration | Ensure CodeCommit associates an approval rule | Terraform | | | 1149 | CKV2AWS37 | resource | awsgluetrigger | Ensure CodeCommit associates an approval rule | Terraform | | | 1150 | CKV2AWS37 | resource | awsglueworkflow | Ensure CodeCommit associates an approval rule | Terraform | | | 1151 | CKV2AWS37 | resource | awsguarddutydetector | Ensure CodeCommit associates an approval rule | Terraform | | | 1152 | CKV2AWS37 | resource | awsguarddutyinvite_accepter | Ensure CodeCommit associates an approval rule | Terraform | | | 1153 | CKV2AWS37 | resource | awsguarddutyipset | Ensure CodeCommit associates an approval rule | Terraform | | | 1154 | CKV2AWS37 | resource | awsguarddutymember | Ensure CodeCommit associates an approval rule | Terraform | | | 1155 | CKV2AWS37 | resource | awsguarddutyorganizationadminaccount | Ensure CodeCommit associates an approval rule | Terraform | | | 1156 | CKV2AWS37 | resource | awsguarddutyorganization_configuration | Ensure CodeCommit associates an approval rule | Terraform | | | 1157 | CKV2AWS37 | resource | awsguarddutythreatintelset | Ensure CodeCommit associates an approval rule | Terraform | | | 1158 | CKV2AWS37 | resource | awsiamaccess_key | Ensure CodeCommit associates an approval rule | Terraform | | | 1159 | CKV2AWS37 | resource | awsiamaccount_alias | Ensure CodeCommit associates an approval rule | Terraform | | | 1160 | CKV2AWS37 | resource | awsiamaccountpasswordpolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1161 | CKV2AWS37 | resource | awsiamgroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1162 | CKV2AWS37 | resource | awsiamgroup_membership | Ensure CodeCommit associates an approval rule | Terraform | | | 1163 | CKV2AWS37 | resource | awsiamgroup_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1164 | CKV2AWS37 | resource | awsiamgrouppolicyattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1165 | CKV2AWS37 | resource | awsiaminstance_profile | Ensure CodeCommit associates an approval rule | Terraform | | | 1166 | CKV2AWS37 | resource | awsiamopenidconnectprovider | Ensure CodeCommit associates an approval rule | Terraform | | | 1167 | CKV2AWS37 | resource | awsiampolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1168 | CKV2AWS37 | resource | awsiampolicy_attachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1169 | CKV2AWS37 | resource | awsiampolicy_document | Ensure CodeCommit associates an approval rule | Terraform | | | 1170 | CKV2AWS37 | resource | awsiamrole | Ensure CodeCommit associates an approval rule | Terraform | | | 1171 | CKV2AWS37 | resource | awsiamrole_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1172 | CKV2AWS37 | resource | awsiamrolepolicyattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1173 | CKV2AWS37 | resource | awsiamsaml_provider | Ensure CodeCommit associates an approval rule | Terraform | | | 1174 | CKV2AWS37 | resource | awsiamserver_certificate | Ensure CodeCommit associates an approval rule | Terraform | | | 1175 | CKV2AWS37 | resource | awsiamservicelinkedrole | Ensure CodeCommit associates an approval rule | Terraform | | | 1176 | CKV2AWS37 | resource | awsiamuser | Ensure CodeCommit associates an approval rule | Terraform | | | 1177 | CKV2AWS37 | resource | awsiamusergroupmembership | Ensure CodeCommit associates an approval rule | Terraform | | | 1178 | CKV2AWS37 | resource | awsiamuserloginprofile | Ensure CodeCommit associates an approval rule | Terraform | | | 1179 | CKV2AWS37 | resource | awsiamuser_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1180 | CKV2AWS37 | resource | awsiamuserpolicyattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1181 | CKV2AWS37 | resource | awsiamusersshkey | Ensure CodeCommit associates an approval rule | Terraform | | | 1182 | CKV2AWS37 | resource | awsinspectorassessment_target | Ensure CodeCommit associates an approval rule | Terraform | | | 1183 | CKV2AWS37 | resource | awsinspectorassessment_template | Ensure CodeCommit associates an approval rule | Terraform | | | 1184 | CKV2AWS37 | resource | awsinspectorresource_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1185 | CKV2AWS37 | resource | aws_instance | Ensure CodeCommit associates an approval rule | Terraform | | | 1186 | CKV2AWS37 | resource | awsinternetgateway | Ensure CodeCommit associates an approval rule | Terraform | | | 1187 | CKV2AWS37 | resource | awsiotcertificate | Ensure CodeCommit associates an approval rule | Terraform | | | 1188 | CKV2AWS37 | resource | awsiotpolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1189 | CKV2AWS37 | resource | awsiotpolicy_attachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1190 | CKV2AWS37 | resource | awsiotrole_alias | Ensure CodeCommit associates an approval rule | Terraform | | | 1191 | CKV2AWS37 | resource | awsiotthing | Ensure CodeCommit associates an approval rule | Terraform | | | 1192 | CKV2AWS37 | resource | awsiotthingprincipalattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1193 | CKV2AWS37 | resource | awsiotthing_type | Ensure CodeCommit associates an approval rule | Terraform | | | 1194 | CKV2AWS37 | resource | awsiottopic_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1195 | CKV2AWS37 | resource | awskeypair | Ensure CodeCommit associates an approval rule | Terraform | | | 1196 | CKV2AWS37 | resource | awskinesisanalytics_application | Ensure CodeCommit associates an approval rule | Terraform | | | 1197 | CKV2AWS37 | resource | awskinesisfirehosedeliverystream | Ensure CodeCommit associates an approval rule | Terraform | | | 1198 | CKV2AWS37 | resource | awskinesisstream | Ensure CodeCommit associates an approval rule | Terraform | | | 1199 | CKV2AWS37 | resource | awskinesisvideo_stream | Ensure CodeCommit associates an approval rule | Terraform | | | 1200 | CKV2AWS37 | resource | awskmsalias | Ensure CodeCommit associates an approval rule | Terraform | | | 1201 | CKV2AWS37 | resource | awskmsciphertext | Ensure CodeCommit associates an approval rule | Terraform | | | 1202 | CKV2AWS37 | resource | awskmsexternal_key | Ensure CodeCommit associates an approval rule | Terraform | | | 1203 | CKV2AWS37 | resource | awskmsgrant | Ensure CodeCommit associates an approval rule | Terraform | | | 1204 | CKV2AWS37 | resource | awskmskey | Ensure CodeCommit associates an approval rule | Terraform | | | 1205 | CKV2AWS37 | resource | awslambdaalias | Ensure CodeCommit associates an approval rule | Terraform | | | 1206 | CKV2AWS37 | resource | awslambdaeventsourcemapping | Ensure CodeCommit associates an approval rule | Terraform | | | 1207 | CKV2AWS37 | resource | awslambdafunction | Ensure CodeCommit associates an approval rule | Terraform | | | 1208 | CKV2AWS37 | resource | awslambdafunctioneventinvoke_config | Ensure CodeCommit associates an approval rule | Terraform | | | 1209 | CKV2AWS37 | resource | awslambdalayer_version | Ensure CodeCommit associates an approval rule | Terraform | | | 1210 | CKV2AWS37 | resource | awslambdapermission | Ensure CodeCommit associates an approval rule | Terraform | | | 1211 | CKV2AWS37 | resource | awslambdaprovisionedconcurrencyconfig | Ensure CodeCommit associates an approval rule | Terraform | | | 1212 | CKV2AWS37 | resource | awslaunchconfiguration | Ensure CodeCommit associates an approval rule | Terraform | | | 1213 | CKV2AWS37 | resource | awslaunchtemplate | Ensure CodeCommit associates an approval rule | Terraform | | | 1214 | CKV2AWS37 | resource | aws_lb | Ensure CodeCommit associates an approval rule | Terraform | | | 1215 | CKV2AWS37 | resource | awslbcookiestickinesspolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1216 | CKV2AWS37 | resource | awslblistener | Ensure CodeCommit associates an approval rule | Terraform | | | 1217 | CKV2AWS37 | resource | awslblistener_certificate | Ensure CodeCommit associates an approval rule | Terraform | | | 1218 | CKV2AWS37 | resource | awslblistener_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1219 | CKV2AWS37 | resource | awslbsslnegotiationpolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1220 | CKV2AWS37 | resource | awslbtarget_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1221 | CKV2AWS37 | resource | awslbtargetgroupattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1222 | CKV2AWS37 | resource | awslicensemanagerassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1223 | CKV2AWS37 | resource | awslicensemanagerlicense_configuration | Ensure CodeCommit associates an approval rule | Terraform | | | 1224 | CKV2AWS37 | resource | awslightsaildomain | Ensure CodeCommit associates an approval rule | Terraform | | | 1225 | CKV2AWS37 | resource | awslightsailinstance | Ensure CodeCommit associates an approval rule | Terraform | | | 1226 | CKV2AWS37 | resource | awslightsailkey_pair | Ensure CodeCommit associates an approval rule | Terraform | | | 1227 | CKV2AWS37 | resource | awslightsailstatic_ip | Ensure CodeCommit associates an approval rule | Terraform | | | 1228 | CKV2AWS37 | resource | awslightsailstaticipattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1229 | CKV2AWS37 | resource | awsloadbalancerbackendserver_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1230 | CKV2AWS37 | resource | awsloadbalancerlistenerpolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1231 | CKV2AWS37 | resource | awsloadbalancer_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1232 | CKV2AWS37 | resource | awsmaciememberaccountassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1233 | CKV2AWS37 | resource | awsmacies3bucketassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1234 | CKV2AWS37 | resource | awsmainroutetableassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1235 | CKV2AWS37 | resource | awsmediaconvert_queue | Ensure CodeCommit associates an approval rule | Terraform | | | 1236 | CKV2AWS37 | resource | awsmediapackage_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1237 | CKV2AWS37 | resource | awsmediastore_container | Ensure CodeCommit associates an approval rule | Terraform | | | 1238 | CKV2AWS37 | resource | awsmediastorecontainerpolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1239 | CKV2AWS37 | resource | awsmqbroker | Ensure CodeCommit associates an approval rule | Terraform | | | 1240 | CKV2AWS37 | resource | awsmqconfiguration | Ensure CodeCommit associates an approval rule | Terraform | | | 1241 | CKV2AWS37 | resource | awsmskcluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1242 | CKV2AWS37 | resource | awsmskconfiguration | Ensure CodeCommit associates an approval rule | Terraform | | | 1243 | CKV2AWS37 | resource | awsnatgateway | Ensure CodeCommit associates an approval rule | Terraform | | | 1244 | CKV2AWS37 | resource | awsneptunecluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1245 | CKV2AWS37 | resource | awsneptunecluster_instance | Ensure CodeCommit associates an approval rule | Terraform | | | 1246 | CKV2AWS37 | resource | awsneptuneclusterparametergroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1247 | CKV2AWS37 | resource | awsneptunecluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | | | 1248 | CKV2AWS37 | resource | awsneptuneevent_subscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1249 | CKV2AWS37 | resource | awsneptuneparameter_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1250 | CKV2AWS37 | resource | awsneptunesubnet_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1251 | CKV2AWS37 | resource | awsnetworkacl | Ensure CodeCommit associates an approval rule | Terraform | | | 1252 | CKV2AWS37 | resource | awsnetworkacl_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1253 | CKV2AWS37 | resource | awsnetworkinterface | Ensure CodeCommit associates an approval rule | Terraform | | | 1254 | CKV2AWS37 | resource | awsnetworkinterface_attachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1255 | CKV2AWS37 | resource | awsnetworkinterfacesgattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1256 | CKV2AWS37 | resource | awsopsworksapplication | Ensure CodeCommit associates an approval rule | Terraform | | | 1257 | CKV2AWS37 | resource | awsopsworkscustom_layer | Ensure CodeCommit associates an approval rule | Terraform | | | 1258 | CKV2AWS37 | resource | awsopsworksganglia_layer | Ensure CodeCommit associates an approval rule | Terraform | | | 1259 | CKV2AWS37 | resource | awsopsworkshaproxy_layer | Ensure CodeCommit associates an approval rule | Terraform | | | 1260 | CKV2AWS37 | resource | awsopsworksinstance | Ensure CodeCommit associates an approval rule | Terraform | | | 1261 | CKV2AWS37 | resource | awsopsworksjavaapplayer | Ensure CodeCommit associates an approval rule | Terraform | | | 1262 | CKV2AWS37 | resource | awsopsworksmemcached_layer | Ensure CodeCommit associates an approval rule | Terraform | | | 1263 | CKV2AWS37 | resource | awsopsworksmysql_layer | Ensure CodeCommit associates an approval rule | Terraform | | | 1264 | CKV2AWS37 | resource | awsopsworksnodejsapplayer | Ensure CodeCommit associates an approval rule | Terraform | | | 1265 | CKV2AWS37 | resource | awsopsworkspermission | Ensure CodeCommit associates an approval rule | Terraform | | | 1266 | CKV2AWS37 | resource | awsopsworksphpapplayer | Ensure CodeCommit associates an approval rule | Terraform | | | 1267 | CKV2AWS37 | resource | awsopsworksrailsapplayer | Ensure CodeCommit associates an approval rule | Terraform | | | 1268 | CKV2AWS37 | resource | awsopsworksrdsdbinstance | Ensure CodeCommit associates an approval rule | Terraform | | | 1269 | CKV2AWS37 | resource | awsopsworksstack | Ensure CodeCommit associates an approval rule | Terraform | | | 1270 | CKV2AWS37 | resource | awsopsworksstaticweblayer | Ensure CodeCommit associates an approval rule | Terraform | | | 1271 | CKV2AWS37 | resource | awsopsworksuser_profile | Ensure CodeCommit associates an approval rule | Terraform | | | 1272 | CKV2AWS37 | resource | awsorganizationsaccount | Ensure CodeCommit associates an approval rule | Terraform | | | 1273 | CKV2AWS37 | resource | awsorganizationsorganization | Ensure CodeCommit associates an approval rule | Terraform | | | 1274 | CKV2AWS37 | resource | awsorganizationsorganizational_unit | Ensure CodeCommit associates an approval rule | Terraform | | | 1275 | CKV2AWS37 | resource | awsorganizationspolicy | Ensure CodeCommit associates an approval rule | Terraform | | | 1276 | CKV2AWS37 | resource | awsorganizationspolicy_attachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1277 | CKV2AWS37 | resource | awspinpointadm_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1278 | CKV2AWS37 | resource | awspinpointapns_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1279 | CKV2AWS37 | resource | awspinpointapnssandboxchannel | Ensure CodeCommit associates an approval rule | Terraform | | | 1280 | CKV2AWS37 | resource | awspinpointapnsvoipchannel | Ensure CodeCommit associates an approval rule | Terraform | | | 1281 | CKV2AWS37 | resource | awspinpointapnsvoipsandbox_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1282 | CKV2AWS37 | resource | awspinpointapp | Ensure CodeCommit associates an approval rule | Terraform | | | 1283 | CKV2AWS37 | resource | awspinpointbaidu_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1284 | CKV2AWS37 | resource | awspinpointemail_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1285 | CKV2AWS37 | resource | awspinpointevent_stream | Ensure CodeCommit associates an approval rule | Terraform | | | 1286 | CKV2AWS37 | resource | awspinpointgcm_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1287 | CKV2AWS37 | resource | awspinpointsms_channel | Ensure CodeCommit associates an approval rule | Terraform | | | 1288 | CKV2AWS37 | resource | awsplacementgroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1289 | CKV2AWS37 | resource | awsproxyprotocol_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1290 | CKV2AWS37 | resource | awsqldbledger | Ensure CodeCommit associates an approval rule | Terraform | | | 1291 | CKV2AWS37 | resource | awsquicksightgroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1292 | CKV2AWS37 | resource | awsquicksightuser | Ensure CodeCommit associates an approval rule | Terraform | | | 1293 | CKV2AWS37 | resource | awsramprincipal_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1294 | CKV2AWS37 | resource | awsramresource_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1295 | CKV2AWS37 | resource | awsramresource_share | Ensure CodeCommit associates an approval rule | Terraform | | | 1296 | CKV2AWS37 | resource | awsramresourceshareaccepter | Ensure CodeCommit associates an approval rule | Terraform | | | 1297 | CKV2AWS37 | resource | awsrdscluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1298 | CKV2AWS37 | resource | awsrdscluster_endpoint | Ensure CodeCommit associates an approval rule | Terraform | | | 1299 | CKV2AWS37 | resource | awsrdscluster_instance | Ensure CodeCommit associates an approval rule | Terraform | | | 1300 | CKV2AWS37 | resource | awsrdsclusterparametergroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1301 | CKV2AWS37 | resource | awsrdsglobal_cluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1302 | CKV2AWS37 | resource | awsredshiftcluster | Ensure CodeCommit associates an approval rule | Terraform | | | 1303 | CKV2AWS37 | resource | awsredshiftevent_subscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1304 | CKV2AWS37 | resource | awsredshiftparameter_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1305 | CKV2AWS37 | resource | awsredshiftsecurity_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1306 | CKV2AWS37 | resource | awsredshiftsnapshotcopygrant | Ensure CodeCommit associates an approval rule | Terraform | | | 1307 | CKV2AWS37 | resource | awsredshiftsnapshot_schedule | Ensure CodeCommit associates an approval rule | Terraform | | | 1308 | CKV2AWS37 | resource | awsredshiftsnapshotscheduleassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1309 | CKV2AWS37 | resource | awsredshiftsubnet_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1310 | CKV2AWS37 | resource | awsresourcegroupsgroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1311 | CKV2AWS37 | resource | aws_root | Ensure CodeCommit associates an approval rule | Terraform | | | 1312 | CKV2AWS37 | resource | awsrootaccess_key | Ensure CodeCommit associates an approval rule | Terraform | | | 1313 | CKV2AWS37 | resource | aws_route | Ensure CodeCommit associates an approval rule | Terraform | | | 1314 | CKV2AWS37 | resource | awsroute53delegation_set | Ensure CodeCommit associates an approval rule | Terraform | | | 1315 | CKV2AWS37 | resource | awsroute53health_check | Ensure CodeCommit associates an approval rule | Terraform | | | 1316 | CKV2AWS37 | resource | awsroute53query_log | Ensure CodeCommit associates an approval rule | Terraform | | | 1317 | CKV2AWS37 | resource | awsroute53record | Ensure CodeCommit associates an approval rule | Terraform | | | 1318 | CKV2AWS37 | resource | awsroute53resolver_endpoint | Ensure CodeCommit associates an approval rule | Terraform | | | 1319 | CKV2AWS37 | resource | awsroute53resolver_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1320 | CKV2AWS37 | resource | awsroute53resolverruleassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1321 | CKV2AWS37 | resource | awsroute53vpcassociationauthorization | Ensure CodeCommit associates an approval rule | Terraform | | | 1322 | CKV2AWS37 | resource | awsroute53zone | Ensure CodeCommit associates an approval rule | Terraform | | | 1323 | CKV2AWS37 | resource | awsroute53zone_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1324 | CKV2AWS37 | resource | awsroutetable | Ensure CodeCommit associates an approval rule | Terraform | | | 1325 | CKV2AWS37 | resource | awsroutetable_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1326 | CKV2AWS37 | resource | awss3access_point | Ensure CodeCommit associates an approval rule | Terraform | | | 1327 | CKV2AWS37 | resource | awss3accountpublicaccess_block | Ensure CodeCommit associates an approval rule | Terraform | | | 1328 | CKV2AWS37 | resource | awss3bucket | Ensure CodeCommit associates an approval rule | Terraform | | | 1329 | CKV2AWS37 | resource | awss3bucketanalyticsconfiguration | Ensure CodeCommit associates an approval rule | Terraform | | | 1330 | CKV2AWS37 | resource | awss3bucket_inventory | Ensure CodeCommit associates an approval rule | Terraform | | | 1331 | CKV2AWS37 | resource | awss3bucket_metric | Ensure CodeCommit associates an approval rule | Terraform | | | 1332 | CKV2AWS37 | resource | awss3bucket_notification | Ensure CodeCommit associates an approval rule | Terraform | | | 1333 | CKV2AWS37 | resource | awss3bucket_object | Ensure CodeCommit associates an approval rule | Terraform | | | 1334 | CKV2AWS37 | resource | awss3bucket_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1335 | CKV2AWS37 | resource | awss3bucketpublicaccess_block | Ensure CodeCommit associates an approval rule | Terraform | | | 1336 | CKV2AWS37 | resource | awssagemakerendpoint | Ensure CodeCommit associates an approval rule | Terraform | | | 1337 | CKV2AWS37 | resource | awssagemakerendpoint_configuration | Ensure CodeCommit associates an approval rule | Terraform | | | 1338 | CKV2AWS37 | resource | awssagemakermodel | Ensure CodeCommit associates an approval rule | Terraform | | | 1339 | CKV2AWS37 | resource | awssagemakernotebook_instance | Ensure CodeCommit associates an approval rule | Terraform | | | 1340 | CKV2AWS37 | resource | awssagemakernotebookinstancelifecycle_configuration | Ensure CodeCommit associates an approval rule | Terraform | | | 1341 | CKV2AWS37 | resource | awssecretsmanagersecret | Ensure CodeCommit associates an approval rule | Terraform | | | 1342 | CKV2AWS37 | resource | awssecretsmanagersecret_rotation | Ensure CodeCommit associates an approval rule | Terraform | | | 1343 | CKV2AWS37 | resource | awssecretsmanagersecret_version | Ensure CodeCommit associates an approval rule | Terraform | | | 1344 | CKV2AWS37 | resource | awssecuritygroup | Ensure CodeCommit associates an approval rule | Terraform | | | 1345 | CKV2AWS37 | resource | awssecuritygroup_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1346 | CKV2AWS37 | resource | awssecurityhubaccount | Ensure CodeCommit associates an approval rule | Terraform | | | 1347 | CKV2AWS37 | resource | awssecurityhubmember | Ensure CodeCommit associates an approval rule | Terraform | | | 1348 | CKV2AWS37 | resource | awssecurityhubproduct_subscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1349 | CKV2AWS37 | resource | awssecurityhubstandards_subscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1350 | CKV2AWS37 | resource | awsservicediscoveryhttpnamespace | Ensure CodeCommit associates an approval rule | Terraform | | | 1351 | CKV2AWS37 | resource | awsservicediscoveryprivatedns_namespace | Ensure CodeCommit associates an approval rule | Terraform | | | 1352 | CKV2AWS37 | resource | awsservicediscoverypublicdns_namespace | Ensure CodeCommit associates an approval rule | Terraform | | | 1353 | CKV2AWS37 | resource | awsservicediscovery_service | Ensure CodeCommit associates an approval rule | Terraform | | | 1354 | CKV2AWS37 | resource | awsservicecatalogportfolio | Ensure CodeCommit associates an approval rule | Terraform | | | 1355 | CKV2AWS37 | resource | awsservicequotasservice_quota | Ensure CodeCommit associates an approval rule | Terraform | | | 1356 | CKV2AWS37 | resource | awssesactivereceiptrule_set | Ensure CodeCommit associates an approval rule | Terraform | | | 1357 | CKV2AWS37 | resource | awssesconfiguration_set | Ensure CodeCommit associates an approval rule | Terraform | | | 1358 | CKV2AWS37 | resource | awssesdomain_dkim | Ensure CodeCommit associates an approval rule | Terraform | | | 1359 | CKV2AWS37 | resource | awssesdomain_identity | Ensure CodeCommit associates an approval rule | Terraform | | | 1360 | CKV2AWS37 | resource | awssesdomainidentityverification | Ensure CodeCommit associates an approval rule | Terraform | | | 1361 | CKV2AWS37 | resource | awssesdomainmailfrom | Ensure CodeCommit associates an approval rule | Terraform | | | 1362 | CKV2AWS37 | resource | awssesemail_identity | Ensure CodeCommit associates an approval rule | Terraform | | | 1363 | CKV2AWS37 | resource | awssesevent_destination | Ensure CodeCommit associates an approval rule | Terraform | | | 1364 | CKV2AWS37 | resource | awssesidentitynotificationtopic | Ensure CodeCommit associates an approval rule | Terraform | | | 1365 | CKV2AWS37 | resource | awssesidentity_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1366 | CKV2AWS37 | resource | awssesreceipt_filter | Ensure CodeCommit associates an approval rule | Terraform | | | 1367 | CKV2AWS37 | resource | awssesreceipt_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1368 | CKV2AWS37 | resource | awssesreceiptruleset | Ensure CodeCommit associates an approval rule | Terraform | | | 1369 | CKV2AWS37 | resource | awssestemplate | Ensure CodeCommit associates an approval rule | Terraform | | | 1370 | CKV2AWS37 | resource | awssfnactivity | Ensure CodeCommit associates an approval rule | Terraform | | | 1371 | CKV2AWS37 | resource | awssfnstate_machine | Ensure CodeCommit associates an approval rule | Terraform | | | 1372 | CKV2AWS37 | resource | awsshieldprotection | Ensure CodeCommit associates an approval rule | Terraform | | | 1373 | CKV2AWS37 | resource | awssimpledbdomain | Ensure CodeCommit associates an approval rule | Terraform | | | 1374 | CKV2AWS37 | resource | awssnapshotcreatevolumepermission | Ensure CodeCommit associates an approval rule | Terraform | | | 1375 | CKV2AWS37 | resource | awssnsplatform_application | Ensure CodeCommit associates an approval rule | Terraform | | | 1376 | CKV2AWS37 | resource | awssnssms_preferences | Ensure CodeCommit associates an approval rule | Terraform | | | 1377 | CKV2AWS37 | resource | awssnstopic | Ensure CodeCommit associates an approval rule | Terraform | | | 1378 | CKV2AWS37 | resource | awssnstopic_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1379 | CKV2AWS37 | resource | awssnstopic_subscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1380 | CKV2AWS37 | resource | awsspotdatafeed_subscription | Ensure CodeCommit associates an approval rule | Terraform | | | 1381 | CKV2AWS37 | resource | awsspotfleet_request | Ensure CodeCommit associates an approval rule | Terraform | | | 1382 | CKV2AWS37 | resource | awsspotinstance_request | Ensure CodeCommit associates an approval rule | Terraform | | | 1383 | CKV2AWS37 | resource | awssqsqueue | Ensure CodeCommit associates an approval rule | Terraform | | | 1384 | CKV2AWS37 | resource | awssqsqueue_policy | Ensure CodeCommit associates an approval rule | Terraform | | | 1385 | CKV2AWS37 | resource | awsssmactivation | Ensure CodeCommit associates an approval rule | Terraform | | | 1386 | CKV2AWS37 | resource | awsssmassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1387 | CKV2AWS37 | resource | awsssmdocument | Ensure CodeCommit associates an approval rule | Terraform | | | 1388 | CKV2AWS37 | resource | awsssmmaintenance_window | Ensure CodeCommit associates an approval rule | Terraform | | | 1389 | CKV2AWS37 | resource | awsssmmaintenancewindowtarget | Ensure CodeCommit associates an approval rule | Terraform | | | 1390 | CKV2AWS37 | resource | awsssmmaintenancewindowtask | Ensure CodeCommit associates an approval rule | Terraform | | | 1391 | CKV2AWS37 | resource | awsssmparameter | Ensure CodeCommit associates an approval rule | Terraform | | | 1392 | CKV2AWS37 | resource | awsssmpatch_baseline | Ensure CodeCommit associates an approval rule | Terraform | | | 1393 | CKV2AWS37 | resource | awsssmpatch_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1394 | CKV2AWS37 | resource | awsssmresourcedatasync | Ensure CodeCommit associates an approval rule | Terraform | | | 1395 | CKV2AWS37 | resource | awsstoragegatewaycache | Ensure CodeCommit associates an approval rule | Terraform | | | 1396 | CKV2AWS37 | resource | awsstoragegatewaycachediscsivolume | Ensure CodeCommit associates an approval rule | Terraform | | | 1397 | CKV2AWS37 | resource | awsstoragegatewaygateway | Ensure CodeCommit associates an approval rule | Terraform | | | 1398 | CKV2AWS37 | resource | awsstoragegatewaynfsfileshare | Ensure CodeCommit associates an approval rule | Terraform | | | 1399 | CKV2AWS37 | resource | awsstoragegatewaysmbfileshare | Ensure CodeCommit associates an approval rule | Terraform | | | 1400 | CKV2AWS37 | resource | awsstoragegatewayupload_buffer | Ensure CodeCommit associates an approval rule | Terraform | | | 1401 | CKV2AWS37 | resource | awsstoragegatewayworking_storage | Ensure CodeCommit associates an approval rule | Terraform | | | 1402 | CKV2AWS37 | resource | aws_subnet | Ensure CodeCommit associates an approval rule | Terraform | | | 1403 | CKV2AWS37 | resource | awsswfdomain | Ensure CodeCommit associates an approval rule | Terraform | | | 1404 | CKV2AWS37 | resource | awstransferserver | Ensure CodeCommit associates an approval rule | Terraform | | | 1405 | CKV2AWS37 | resource | awstransferssh_key | Ensure CodeCommit associates an approval rule | Terraform | | | 1406 | CKV2AWS37 | resource | awstransferuser | Ensure CodeCommit associates an approval rule | Terraform | | | 1407 | CKV2AWS37 | resource | awsvolumeattachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1408 | CKV2AWS37 | resource | aws_vpc | Ensure CodeCommit associates an approval rule | Terraform | | | 1409 | CKV2AWS37 | resource | awsvpcdhcp_options | Ensure CodeCommit associates an approval rule | Terraform | | | 1410 | CKV2AWS37 | resource | awsvpcdhcpoptionsassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1411 | CKV2AWS37 | resource | awsvpcendpoint | Ensure CodeCommit associates an approval rule | Terraform | | | 1412 | CKV2AWS37 | resource | awsvpcendpointconnectionnotification | Ensure CodeCommit associates an approval rule | Terraform | | | 1413 | CKV2AWS37 | resource | awsvpcendpointroutetable_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1414 | CKV2AWS37 | resource | awsvpcendpoint_service | Ensure CodeCommit associates an approval rule | Terraform | | | 1415 | CKV2AWS37 | resource | awsvpcendpointserviceallowed_principal | Ensure CodeCommit associates an approval rule | Terraform | | | 1416 | CKV2AWS37 | resource | awsvpcendpointsubnetassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1417 | CKV2AWS37 | resource | awsvpcipv4cidrblock_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1418 | CKV2AWS37 | resource | awsvpcpeering_connection | Ensure CodeCommit associates an approval rule | Terraform | | | 1419 | CKV2AWS37 | resource | awsvpcpeeringconnectionaccepter | Ensure CodeCommit associates an approval rule | Terraform | | | 1420 | CKV2AWS37 | resource | awsvpcpeeringconnectionoptions | Ensure CodeCommit associates an approval rule | Terraform | | | 1421 | CKV2AWS37 | resource | awsvpnconnection | Ensure CodeCommit associates an approval rule | Terraform | | | 1422 | CKV2AWS37 | resource | awsvpnconnection_route | Ensure CodeCommit associates an approval rule | Terraform | | | 1423 | CKV2AWS37 | resource | awsvpngateway | Ensure CodeCommit associates an approval rule | Terraform | | | 1424 | CKV2AWS37 | resource | awsvpngateway_attachment | Ensure CodeCommit associates an approval rule | Terraform | | | 1425 | CKV2AWS37 | resource | awsvpngatewayroutepropagation | Ensure CodeCommit associates an approval rule | Terraform | | | 1426 | CKV2AWS37 | resource | awswafbytematchset | Ensure CodeCommit associates an approval rule | Terraform | | | 1427 | CKV2AWS37 | resource | awswafgeomatchset | Ensure CodeCommit associates an approval rule | Terraform | | | 1428 | CKV2AWS37 | resource | awswafipset | Ensure CodeCommit associates an approval rule | Terraform | | | 1429 | CKV2AWS37 | resource | awswafratebasedrule | Ensure CodeCommit associates an approval rule | Terraform | | | 1430 | CKV2AWS37 | resource | awswafregexmatchset | Ensure CodeCommit associates an approval rule | Terraform | | | 1431 | CKV2AWS37 | resource | awswafregexpatternset | Ensure CodeCommit associates an approval rule | Terraform | | | 1432 | CKV2AWS37 | resource | awswafrule | Ensure CodeCommit associates an approval rule | Terraform | | | 1433 | CKV2AWS37 | resource | awswafrule_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1434 | CKV2AWS37 | resource | awswafsizeconstraintset | Ensure CodeCommit associates an approval rule | Terraform | | | 1435 | CKV2AWS37 | resource | awswafsqlinjectionmatch_set | Ensure CodeCommit associates an approval rule | Terraform | | | 1436 | CKV2AWS37 | resource | awswafweb_acl | Ensure CodeCommit associates an approval rule | Terraform | | | 1437 | CKV2AWS37 | resource | awswafxssmatchset | Ensure CodeCommit associates an approval rule | Terraform | | | 1438 | CKV2AWS37 | resource | awswafregionalbytematchset | Ensure CodeCommit associates an approval rule | Terraform | | | 1439 | CKV2AWS37 | resource | awswafregionalgeomatchset | Ensure CodeCommit associates an approval rule | Terraform | | | 1440 | CKV2AWS37 | resource | awswafregionalipset | Ensure CodeCommit associates an approval rule | Terraform | | | 1441 | CKV2AWS37 | resource | awswafregionalratebasedrule | Ensure CodeCommit associates an approval rule | Terraform | | | 1442 | CKV2AWS37 | resource | awswafregionalregexmatchset | Ensure CodeCommit associates an approval rule | Terraform | | | 1443 | CKV2AWS37 | resource | awswafregionalregexpatternset | Ensure CodeCommit associates an approval rule | Terraform | | | 1444 | CKV2AWS37 | resource | awswafregionalrule | Ensure CodeCommit associates an approval rule | Terraform | | | 1445 | CKV2AWS37 | resource | awswafregionalrule_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1446 | CKV2AWS37 | resource | awswafregionalsizeconstraintset | Ensure CodeCommit associates an approval rule | Terraform | | | 1447 | CKV2AWS37 | resource | awswafregionalsqlinjectionmatch_set | Ensure CodeCommit associates an approval rule | Terraform | | | 1448 | CKV2AWS37 | resource | awswafregionalweb_acl | Ensure CodeCommit associates an approval rule | Terraform | | | 1449 | CKV2AWS37 | resource | awswafregionalwebaclassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1450 | CKV2AWS37 | resource | awswafregionalxssmatchset | Ensure CodeCommit associates an approval rule | Terraform | | | 1451 | CKV2AWS37 | resource | awswafv2ip_set | Ensure CodeCommit associates an approval rule | Terraform | | | 1452 | CKV2AWS37 | resource | awswafv2regexpatternset | Ensure CodeCommit associates an approval rule | Terraform | | | 1453 | CKV2AWS37 | resource | awswafv2rule_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1454 | CKV2AWS37 | resource | awswafv2web_acl | Ensure CodeCommit associates an approval rule | Terraform | | | 1455 | CKV2AWS37 | resource | awswafv2webaclassociation | Ensure CodeCommit associates an approval rule | Terraform | | | 1456 | CKV2AWS37 | resource | awswafv2webacllogging_configuration | Ensure CodeCommit associates an approval rule | Terraform | | | 1457 | CKV2AWS37 | resource | awsworklinkfleet | Ensure CodeCommit associates an approval rule | Terraform | | | 1458 | CKV2AWS37 | resource | awsworklinkwebsitecertificateauthority_association | Ensure CodeCommit associates an approval rule | Terraform | | | 1459 | CKV2AWS37 | resource | awsworkspacesdirectory | Ensure CodeCommit associates an approval rule | Terraform | | | 1460 | CKV2AWS37 | resource | awsworkspacesip_group | Ensure CodeCommit associates an approval rule | Terraform | | | 1461 | CKV2AWS37 | resource | awsworkspacesworkspace | Ensure CodeCommit associates an approval rule | Terraform | | | 1462 | CKV2AWS37 | resource | awsxraysampling_rule | Ensure CodeCommit associates an approval rule | Terraform | | | 1463 | CKV2AWS38 | resource | awsroute53zone | Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones | Terraform | | | 1464 | CKV2AWS39 | resource | awsroute53zone | Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones | Terraform | | | 1465 | CKV2AWS40 | resource | awsiamgroup_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | | | 1466 | CKV2AWS40 | resource | awsiampolicy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | | | 1467 | CKV2AWS40 | resource | awsiamrole_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | | | 1468 | CKV2AWS40 | resource | awsiamuser_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | | | 1469 | CKV2AWS40 | resource | awsssoadminpermissionsetinline_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | | | 1470 | CKV2AWS40 | resource |

| Ensure AWS IAM policy does not allow full IAM privileges | Terraform | | | 1471 | CKV2AWS41 | resource | aws_instance | Ensure an IAM role is attached to EC2 instance | Terraform | | | 1472 | CKV2AWS42 | resource | awscloudfrontdistribution | Ensure AWS CloudFront distribution uses custom SSL certificate | Terraform | | | 1473 | CKV2AWS43 | resource | awss3bucket_acl | Ensure S3 Bucket does not allow access to all Authenticated users | Terraform | | | 1474 | CKV2AWS44 | resource | aws_route | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | | | 1475 | CKV2AWS44 | resource | awsroutetable | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | | | 1476 | CKV2AWS45 | resource | awsconfigconfiguration_recorder | Ensure AWS Config recorder is enabled to record all supported resources | Terraform | | | 1477 | CKV2AWS45 | resource | awsconfigconfigurationrecorderstatus | Ensure AWS Config recorder is enabled to record all supported resources | Terraform | | | 1478 | CKV2AWS46 | resource | awscloudfrontdistribution | Ensure AWS CloudFront Distribution with S3 have Origin Access set to enabled | Terraform | | | 1479 | CKV2AWS47 | resource | awscloudfrontdistribution | Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | | | 1480 | CKV2AWS47 | resource | awswafv2web_acl | Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | | | 1481 | CKV2AWS48 | resource | awsconfigconfiguration_recorder | Ensure AWS Config must record all possible resources | Terraform | | | 1482 | CKV2AWS49 | resource | awsdmsendpoint | Ensure AWS Database Migration Service endpoints have SSL configured | Terraform | | | 1483 | CKV2AWS50 | resource | awselasticachereplication_group | Ensure AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to enabled | Terraform | | | 1484 | CKV2AWS51 | resource | awsapigateway_stage | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | | | 1485 | CKV2AWS51 | resource | awsapigatewayv2api | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | | | 1486 | CKV2AWS51 | resource | awsapigatewayv2stage | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | | | 1487 | CKV2AWS52 | resource | awselasticsearchdomain | Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled | Terraform | | | 1488 | CKV2AWS52 | resource | awsopensearchdomain | Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled | Terraform | | | 1489 | CKV2AWS53 | resource | awsapigateway_method | Ensure AWS API gateway request is validated | Terraform | | | 1490 | CKV2AWS54 | resource | awscloudfrontdistribution | Ensure AWS CloudFront distribution is using secure SSL protocols for HTTPS communication | Terraform | | | 1491 | CKV2AWS55 | resource | awsemrcluster | Ensure AWS EMR cluster is configured with security configuration | Terraform | | | 1492 | CKV2AWS56 | resource | awsiamgrouppolicyattachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | | | 1493 | CKV2AWS56 | resource | awsiampolicy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | | | 1494 | CKV2AWS56 | resource | awsiamrole | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | | | 1495 | CKV2AWS56 | resource | awsiamrolepolicyattachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | | | 1496 | CKV2AWS56 | resource | awsiamuserpolicyattachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | | | 1497 | CKV2AWS56 | resource | awsssoadminmanagedpolicyattachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | | | 1498 | CKV2AWS56 | resource | data.awsiampolicy | Ensure AWS Managed IAMFullAccess IAM policy is not

| Terraform | | | 1499 | CKV2AWS57 | resource | awssecretsmanagersecret | Ensure Secrets Manager secrets should have automatic rotation enabled | Terraform | | | 1500 | CKV2AWS58 | resource | awsneptunecluster | Ensure AWS Neptune cluster deletion protection is enabled | Terraform | | | 1501 | CKV2AWS59 | resource | awselasticsearchdomain | Ensure ElasticSearch/OpenSearch has dedicated master node enabled | Terraform | | | 1502 | CKV2AWS59 | resource | awsopensearchdomain | Ensure ElasticSearch/OpenSearch has dedicated master node enabled | Terraform | | | 1503 | CKV2AWS60 | resource | awsdbinstance | Ensure RDS instance with copy tags to snapshots is enabled | Terraform | | | 1504 | CKV2AWS61 | resource | awss3bucket | Ensure that an S3 bucket has a lifecycle configuration | Terraform | | | 1505 | CKV2AWS62 | resource | awss3bucket | Ensure S3 buckets should have event notifications enabled | Terraform | | | 1506 | CKV2AWS63 | resource | awsnetworkfirewallfirewall | Ensure Network firewall has logging configuration defined | Terraform | | | 1507 | CKV2AWS64 | resource | awskmskey | Ensure KMS key Policy is defined | Terraform | | | 1508 | CKV2AWS65 | resource | awss3bucketownershipcontrols | Ensure access control lists for S3 buckets are disabled | Terraform | | | 1509 | CKV2AWS66 | resource | awsmwaaenvironment | Ensure MWAA environment is not publicly accessible | Terraform | | | 1510 | CKV2AWS67 | resource | awskmskey | Ensure AWS S3 bucket encrypted with Customer Managed Key (CMK) has regular rotation | Terraform | | | 1511 | CKV2AWS67 | resource | awss3bucket | Ensure AWS S3 bucket encrypted with Customer Managed Key (CMK) has regular rotation | Terraform | | | 1512 | CKV2AWS67 | resource | awss3bucketserversideencryptionconfiguration | Ensure AWS S3 bucket encrypted with Customer Managed Key (CMK) has regular rotation | Terraform | | | 1513 | CKVAZURE1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | arm | | | 1514 | CKVAZURE1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Bicep | | | 1515 | CKVAZURE1 | resource | azurermlinuxvirtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | | | 1516 | CKVAZURE1 | resource | azurermvirtualmachine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | | | 1517 | CKVAZURE2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | arm | | | 1518 | CKVAZURE2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | Bicep | | | 1519 | CKVAZURE2 | resource | azurermmanageddisk | Ensure Azure managed disk has encryption enabled | Terraform | | | 1520 | CKVAZURE3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | arm | | | 1521 | CKVAZURE3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | Bicep | | | 1522 | CKVAZURE3 | resource | azurermstorageaccount | Ensure that 'enablehttpstraffic_only' is enabled | Terraform | | | 1523 | CKVAZURE4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | arm | | | 1524 | CKVAZURE4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | Bicep | | | 1525 | CKVAZURE4 | resource | azurermkubernetescluster | Ensure AKS logging to Azure Monitoring is Configured | Terraform | | | 1526 | CKVAZURE5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | arm | | | 1527 | CKVAZURE5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | Bicep | | | 1528 | CKVAZURE5 | resource | azurermkubernetescluster | Ensure RBAC is enabled on AKS clusters | Terraform | | | 1529 | CKVAZURE6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | arm | | | 1530 | CKVAZURE6 | resource |

| Ensure AKS has an API Server Authorized IP Ranges enabled | Bicep | | | 1531 | CKVAZURE6 | resource | azurermkubernetescluster | Ensure AKS has an API Server Authorized IP Ranges enabled | Terraform | | | 1532 | CKVAZURE7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | arm | | | 1533 | CKVAZURE7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | Bicep | | | 1534 | CKVAZURE7 | resource | azurermkubernetescluster | Ensure AKS cluster has Network Policy configured | Terraform | | | 1535 | CKVAZURE8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | arm | | | 1536 | CKVAZURE8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | Bicep | | | 1537 | CKVAZURE8 | resource | azurermkubernetescluster | Ensure Kubernetes Dashboard is disabled | Terraform | | | 1538 | CKVAZURE9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | arm | | | 1539 | CKVAZURE9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | Bicep | | | 1540 | CKVAZURE9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | arm | | | 1541 | CKVAZURE9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | Bicep | | | 1542 | CKVAZURE9 | resource | azurermnetworksecurity_group | Ensure that RDP access is restricted from the internet | Terraform | | | 1543 | CKVAZURE9 | resource | azurermnetworksecurity_rule | Ensure that RDP access is restricted from the internet | Terraform | | | 1544 | CKVAZURE10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | arm | | | 1545 | CKVAZURE10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | Bicep | | | 1546 | CKVAZURE10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | arm | | | 1547 | CKVAZURE10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | Bicep | | | 1548 | CKVAZURE10 | resource | azurermnetworksecurity_group | Ensure that SSH access is restricted from the internet | Terraform | | | 1549 | CKVAZURE10 | resource | azurermnetworksecurity_rule | Ensure that SSH access is restricted from the internet | Terraform | | | 1550 | CKVAZURE11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | arm | | | 1551 | CKVAZURE11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Bicep | | | 1552 | CKVAZURE11 | resource | azurermmariadbfirewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | | | 1553 | CKVAZURE11 | resource | azurermmysqlfirewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | | | 1554 | CKVAZURE11 | resource | azurermpostgresqlfirewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | | | 1555 | CKVAZURE11 | resource | azurermsqlfirewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | | | 1556 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | | | 1557 | CKVAZURE12 | resource |

| Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | | | 1558 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | | | 1559 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | | | 1560 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | | | 1561 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | | | 1562 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | | | 1563 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | | | 1564 | CKVAZURE12 | resource | azurermnetworkwatcherflowlog | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Terraform | | | 1565 | CKVAZURE13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | arm | | | 1566 | CKVAZURE13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | Bicep | | | 1567 | CKVAZURE13 | resource | azurermappservice | Ensure App Service Authentication is set on Azure App Service | Terraform | | | 1568 | CKVAZURE13 | resource | azurermlinuxweb_app | Ensure App Service Authentication is set on Azure App Service | Terraform | | | 1569 | CKVAZURE13 | resource | azurermwindowsweb_app | Ensure App Service Authentication is set on Azure App Service | Terraform | | | 1570 | CKVAZURE13 | resource | config | Ensure App Service Authentication is set on Azure App Service | arm | | | 1571 | CKVAZURE13 | resource | config | Ensure App Service Authentication is set on Azure App Service | Bicep | | | 1572 | CKVAZURE14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | arm | | | 1573 | CKVAZURE14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Bicep | | | 1574 | CKVAZURE14 | resource | azurermappservice | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | | | 1575 | CKVAZURE14 | resource | azurermlinuxweb_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | | | 1576 | CKVAZURE14 | resource | azurermwindowsweb_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | | | 1577 | CKVAZURE15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | arm | | | 1578 | CKVAZURE15 | resource |

| Ensure web app is using the latest version of TLS encryption | Bicep | | | 1579 | CKVAZURE15 | resource | azurermappservice | Ensure web app is using the latest version of TLS encryption | Terraform | | | 1580 | CKVAZURE15 | resource | azurermlinuxweb_app | Ensure web app is using the latest version of TLS encryption | Terraform | | | 1581 | CKVAZURE15 | resource | azurermwindowsweb_app | Ensure web app is using the latest version of TLS encryption | Terraform | | | 1582 | CKVAZURE16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | arm | | | 1583 | CKVAZURE16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | Bicep | | | 1584 | CKVAZURE16 | resource | azurermappservice | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | | | 1585 | CKVAZURE16 | resource | azurermlinuxweb_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | | | 1586 | CKVAZURE16 | resource | azurermwindowsweb_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | | | 1587 | CKVAZURE17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | arm | | | 1588 | CKVAZURE17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Bicep | | | 1589 | CKVAZURE17 | resource | azurermappservice | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | | | 1590 | CKVAZURE17 | resource | azurermlinuxweb_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | | | 1591 | CKVAZURE17 | resource | azurermwindowsweb_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | | | 1592 | CKVAZURE18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | arm | | | 1593 | CKVAZURE18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | Bicep | | | 1594 | CKVAZURE18 | resource | azurermappservice | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | | | 1595 | CKVAZURE18 | resource | azurermlinuxweb_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | | | 1596 | CKVAZURE18 | resource | azurermwindowsweb_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | | | 1597 | CKVAZURE19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | arm | | | 1598 | CKVAZURE19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | Bicep | | | 1599 | CKVAZURE19 | resource | azurermsecuritycentersubscriptionpricing | Ensure that standard pricing tier is selected | Terraform | | | 1600 | CKVAZURE20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | arm | | | 1601 | CKVAZURE20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | Bicep | | | 1602 | CKVAZURE20 | resource | azurermsecuritycenter_contact | Ensure that security contact 'Phone number' is set | Terraform | | | 1603 | CKVAZURE21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | | | 1604 | CKVAZURE21 | resource |

| Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | | | 1605 | CKVAZURE21 | resource | azurermsecuritycenter_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | | | 1606 | CKVAZURE22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | | | 1607 | CKVAZURE22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | | | 1608 | CKVAZURE22 | resource | azurermsecuritycenter_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | | | 1609 | CKVAZURE23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | | | 1610 | CKVAZURE23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | | | 1611 | CKVAZURE23 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | | | 1612 | CKVAZURE23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | | | 1613 | CKVAZURE23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | | | 1614 | CKVAZURE23 | resource | Microsoft.Sql/servers/databases/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | | | 1615 | CKVAZURE23 | resource | azurermmssqlserver | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | | | 1616 | CKVAZURE23 | resource | azurermmssqlserverextendedauditing_policy | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | | | 1617 | CKVAZURE23 | resource | azurermsqlserver | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | | | 1618 | CKVAZURE24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | arm | | | 1619 | CKVAZURE24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | | | 1620 | CKVAZURE24 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | | | 1621 | CKVAZURE24 | resource | azurermmssqlserver | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | | | 1622 | CKVAZURE24 | resource | azurermmssqlserverextendedauditing_policy | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | | | 1623 | CKVAZURE24 | resource | azurermsqlserver | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | | | 1624 | CKVAZURE25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | arm | | | 1625 | CKVAZURE25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | Bicep | | | 1626 | CKVAZURE25 | resource | azurermmssqlserversecurityalert_policy | Ensure that 'Threat Detection types' is set to 'All' | Terraform | | | 1627 | CKVAZURE26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | arm | | | 1628 | CKVAZURE26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Bicep | | | 1629 | CKVAZURE26 | resource | azurermmssqlserversecurityalert_policy | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Terraform | | | 1630 | CKVAZURE27 | resource |

| Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | arm | | | 1631 | CKVAZURE27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Bicep | | | 1632 | CKVAZURE27 | resource | azurermmssqlserversecurityalert_policy | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Terraform | | | 1633 | CKVAZURE28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | arm | | | 1634 | CKVAZURE28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Bicep | | | 1635 | CKVAZURE28 | resource | azurermmysqlserver | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Terraform | | | 1636 | CKVAZURE29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | arm | | | 1637 | CKVAZURE29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Bicep | | | 1638 | CKVAZURE29 | resource | azurermpostgresqlserver | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Terraform | | | 1639 | CKVAZURE30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | | | 1640 | CKVAZURE30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | | | 1641 | CKVAZURE30 | resource | azurermpostgresqlconfiguration | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Terraform | | | 1642 | CKVAZURE30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | | | 1643 | CKVAZURE30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | | | 1644 | CKVAZURE31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | | | 1645 | CKVAZURE31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | | | 1646 | CKVAZURE31 | resource | azurermpostgresqlconfiguration | Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server | Terraform | | | 1647 | CKVAZURE31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | | | 1648 | CKVAZURE31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | | | 1649 | CKVAZURE32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | | | 1650 | CKVAZURE32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | | | 1651 | CKVAZURE32 | resource | azurermpostgresqlconfiguration | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Terraform | | | 1652 | CKVAZURE32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | | | 1653 | CKVAZURE32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | | | 1654 | CKVAZURE33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | arm | | | 1655 | CKVAZURE33 | resource |

| Ensure Storage logging is enabled for Queue service for read, write and delete requests | Bicep | | | 1656 | CKVAZURE33 | resource | azurermstorageaccount | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Terraform | | | 1657 | CKVAZURE34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | | | 1658 | CKVAZURE34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | | | 1659 | CKVAZURE34 | resource | azurermstoragecontainer | Ensure that 'Public access level' is set to Private for blob containers | Terraform | | | 1660 | CKVAZURE34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | | | 1661 | CKVAZURE34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | | | 1662 | CKVAZURE34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | arm | | | 1663 | CKVAZURE34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | | | 1664 | CKVAZURE35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | arm | | | 1665 | CKVAZURE35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | Bicep | | | 1666 | CKVAZURE35 | resource | azurermstorageaccount | Ensure default network access rule for Storage Accounts is set to deny | Terraform | | | 1667 | CKVAZURE35 | resource | azurermstorageaccountnetworkrules | Ensure default network access rule for Storage Accounts is set to deny | Terraform | | | 1668 | CKVAZURE36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | arm | | | 1669 | CKVAZURE36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Bicep | | | 1670 | CKVAZURE36 | resource | azurermstorageaccount | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | | | 1671 | CKVAZURE36 | resource | azurermstorageaccountnetworkrules | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | | | 1672 | CKVAZURE37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | arm | | | 1673 | CKVAZURE37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | Bicep | | | 1674 | CKVAZURE37 | resource | azurermmonitorlog_profile | Ensure that Activity Log Retention is set 365 days or greater | Terraform | | | 1675 | CKVAZURE38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | arm | | | 1676 | CKVAZURE38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | Bicep | | | 1677 | CKVAZURE38 | resource | azurermmonitorlog_profile | Ensure audit profile captures all the activities | Terraform | | | 1678 | CKVAZURE39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | arm | | | 1679 | CKVAZURE39 | resource |

| Ensure that no custom subscription owner roles are created | Bicep | | | 1680 | CKVAZURE39 | resource | azurermroledefinition | Ensure that no custom subscription owner roles are created | Terraform | | | 1681 | CKVAZURE40 | resource | Microsoft.KeyVault/vaults/keys | Ensure that the expiration date is set on all keys | arm | | | 1682 | CKVAZURE40 | resource | Microsoft.KeyVault/vaults/keys | Ensure that the expiration date is set on all keys | Bicep | | | 1683 | CKVAZURE40 | resource | azurermkeyvault_key | Ensure that the expiration date is set on all keys | Terraform | | | 1684 | CKVAZURE41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | arm | | | 1685 | CKVAZURE41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | Bicep | | | 1686 | CKVAZURE41 | resource | azurermkeyvault_secret | Ensure that the expiration date is set on all secrets | Terraform | | | 1687 | CKVAZURE42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | arm | | | 1688 | CKVAZURE42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | Bicep | | | 1689 | CKVAZURE42 | resource | azurermkeyvault | Ensure the key vault is recoverable | Terraform | | | 1690 | CKVAZURE43 | resource | azurermstorageaccount | Ensure Storage Accounts adhere to the naming rules | Terraform | | | 1691 | CKVAZURE44 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Account is using the latest version of TLS encryption | arm | | | 1692 | CKVAZURE44 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Account is using the latest version of TLS encryption | Bicep | | | 1693 | CKVAZURE44 | resource | azurermstorageaccount | Ensure Storage Account is using the latest version of TLS encryption | Terraform | | | 1694 | CKVAZURE45 | resource | azurermvirtualmachine | Ensure that no sensitive credentials are exposed in VM custom_data | Terraform | | | 1695 | CKVAZURE47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | arm | | | 1696 | CKVAZURE47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Bicep | | | 1697 | CKVAZURE47 | resource | azurermmariadbserver | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Terraform | | | 1698 | CKVAZURE48 | resource | azurermmariadbserver | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Terraform | | | 1699 | CKVAZURE49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | arm | | | 1700 | CKVAZURE49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Bicep | | | 1701 | CKVAZURE49 | resource | azurermlinuxvirtualmachinescale_set | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Terraform | | | 1702 | CKVAZURE50 | resource | Microsoft.Compute/virtualMachines | Ensure Virtual Machine Extensions are not Installed | arm | | | 1703 | CKVAZURE50 | resource |

| Ensure Virtual Machine Extensions are not Installed | Bicep | | | 1704 | CKVAZURE50 | resource | azurermlinuxvirtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | | | 1705 | CKVAZURE50 | resource | azurermwindowsvirtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | | | 1706 | CKVAZURE52 | resource | azurermmssqlserver | Ensure MSSQL is using the latest version of TLS encryption | Terraform | | | 1707 | CKVAZURE53 | resource | azurermmysqlserver | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Terraform | | | 1708 | CKVAZURE54 | resource | azurermmysqlserver | Ensure MySQL is using the latest version of TLS encryption | Terraform | | | 1709 | CKVAZURE55 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender is set to On for Servers | Terraform | | | 1710 | CKVAZURE56 | resource | azurermfunctionapp | Ensure that function apps enables Authentication | Terraform | | | 1711 | CKVAZURE57 | resource | azurermappservice | Ensure that CORS disallows every resource to access app services | Terraform | | | 1712 | CKVAZURE57 | resource | azurermlinuxweb_app | Ensure that CORS disallows every resource to access app services | Terraform | | | 1713 | CKVAZURE57 | resource | azurermwindowsweb_app | Ensure that CORS disallows every resource to access app services | Terraform | | | 1714 | CKVAZURE58 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces enables managed virtual networks | arm | | | 1715 | CKVAZURE58 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces enables managed virtual networks | Bicep | | | 1716 | CKVAZURE58 | resource | azurermsynapseworkspace | Ensure that Azure Synapse workspaces enables managed virtual networks | Terraform | | | 1717 | CKVAZURE59 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage accounts disallow public access | arm | | | 1718 | CKVAZURE59 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage accounts disallow public access | Bicep | | | 1719 | CKVAZURE59 | resource | azurermstorageaccount | Ensure that Storage accounts disallow public access | Terraform | | | 1720 | CKVAZURE61 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender is set to On for App Service | Terraform | | | 1721 | CKVAZURE62 | resource | azurermfunctionapp | Ensure function apps are not accessible from all regions | Terraform | | | 1722 | CKVAZURE63 | resource | Microsoft.Web/sites/config | Ensure that App service enables HTTP logging | arm | | | 1723 | CKVAZURE63 | resource | Microsoft.Web/sites/config | Ensure that App service enables HTTP logging | Bicep | | | 1724 | CKVAZURE63 | resource | azurermappservice | Ensure that App service enables HTTP logging | Terraform | | | 1725 | CKVAZURE63 | resource | azurermlinuxweb_app | Ensure that App service enables HTTP logging | Terraform | | | 1726 | CKVAZURE63 | resource | azurermwindowsweb_app | Ensure that App service enables HTTP logging | Terraform | | | 1727 | CKVAZURE64 | resource | azurermstoragesync | Ensure that Azure File Sync disables public network access | Terraform | | | 1728 | CKVAZURE65 | resource | Microsoft.Web/sites/config | Ensure that App service enables detailed error messages | arm | | | 1729 | CKVAZURE65 | resource | Microsoft.Web/sites/config | Ensure that App service enables detailed error messages | Bicep | | | 1730 | CKVAZURE65 | resource | azurermappservice | Ensure that App service enables detailed error messages | Terraform | | | 1731 | CKVAZURE65 | resource | azurermlinuxweb_app | Ensure that App service enables detailed error messages | Terraform | | | 1732 | CKVAZURE65 | resource | azurermwindowsweb_app | Ensure that App service enables detailed error messages | Terraform | | | 1733 | CKVAZURE66 | resource | Microsoft.Web/sites/config | Ensure that App service enables failed request tracing | arm | | | 1734 | CKVAZURE66 | resource |

| Ensure that App service enables failed request tracing | Bicep | | | 1735 | CKVAZURE66 | resource | azurermappservice | Ensure that App service enables failed request tracing | Terraform | | | 1736 | CKVAZURE66 | resource | azurermlinuxweb_app | Ensure that App service enables failed request tracing | Terraform | | | 1737 | CKVAZURE66 | resource | azurermwindowsweb_app | Ensure that App service enables failed request tracing | Terraform | | | 1738 | CKVAZURE67 | resource | azurermfunctionapp | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | | | 1739 | CKVAZURE67 | resource | azurermfunctionapp_slot | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | | | 1740 | CKVAZURE68 | resource | azurermpostgresqlserver | Ensure that PostgreSQL server disables public network access | Terraform | | | 1741 | CKVAZURE69 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender is set to On for Azure SQL database servers | Terraform | | | 1742 | CKVAZURE70 | resource | azurermfunctionapp | Ensure that Function apps is only accessible over HTTPS | Terraform | | | 1743 | CKVAZURE70 | resource | azurermfunctionapp_slot | Ensure that Function apps is only accessible over HTTPS | Terraform | | | 1744 | CKVAZURE70 | resource | azurermlinuxfunction_app | Ensure that Function apps is only accessible over HTTPS | Terraform | | | 1745 | CKVAZURE70 | resource | azurermlinuxfunctionappslot | Ensure that Function apps is only accessible over HTTPS | Terraform | | | 1746 | CKVAZURE70 | resource | azurermwindowsfunction_app | Ensure that Function apps is only accessible over HTTPS | Terraform | | | 1747 | CKVAZURE70 | resource | azurermwindowsfunctionappslot | Ensure that Function apps is only accessible over HTTPS | Terraform | | | 1748 | CKVAZURE71 | resource | azurermappservice | Ensure that Managed identity provider is enabled for app services | Terraform | | | 1749 | CKVAZURE71 | resource | azurermlinuxweb_app | Ensure that Managed identity provider is enabled for app services | Terraform | | | 1750 | CKVAZURE71 | resource | azurermwindowsweb_app | Ensure that Managed identity provider is enabled for app services | Terraform | | | 1751 | CKVAZURE72 | resource | azurermappservice | Ensure that remote debugging is not enabled for app services | Terraform | | | 1752 | CKVAZURE72 | resource | azurermlinuxweb_app | Ensure that remote debugging is not enabled for app services | Terraform | | | 1753 | CKVAZURE72 | resource | azurermwindowsweb_app | Ensure that remote debugging is not enabled for app services | Terraform | | | 1754 | CKVAZURE73 | resource | azurermautomationvariable_bool | Ensure that Automation account variables are encrypted | Terraform | | | 1755 | CKVAZURE73 | resource | azurermautomationvariable_datetime | Ensure that Automation account variables are encrypted | Terraform | | | 1756 | CKVAZURE73 | resource | azurermautomationvariable_int | Ensure that Automation account variables are encrypted | Terraform | | | 1757 | CKVAZURE73 | resource | azurermautomationvariable_string | Ensure that Automation account variables are encrypted | Terraform | | | 1758 | CKVAZURE74 | resource | azurermkustocluster | Ensure that Azure Data Explorer (Kusto) uses disk encryption | Terraform | | | 1759 | CKVAZURE75 | resource | azurermkustocluster | Ensure that Azure Data Explorer uses double encryption | Terraform | | | 1760 | CKVAZURE76 | resource | azurermbatchaccount | Ensure that Azure Batch account uses key vault to encrypt data | Terraform | | | 1761 | CKVAZURE77 | resource | azurermnetworksecurity_group | Ensure that UDP Services are restricted from the Internet | Terraform | | | 1762 | CKVAZURE77 | resource | azurermnetworksecurity_rule | Ensure that UDP Services are restricted from the Internet | Terraform | | | 1763 | CKVAZURE78 | resource | azurermappservice | Ensure FTP deployments are disabled | Terraform | | | 1764 | CKVAZURE78 | resource | azurermlinuxweb_app | Ensure FTP deployments are disabled | Terraform | | | 1765 | CKVAZURE78 | resource | azurermwindowsweb_app | Ensure FTP deployments are disabled | Terraform | | | 1766 | CKVAZURE79 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender is set to On for SQL servers on machines | Terraform | | | 1767 | CKVAZURE80 | resource | Microsoft.Web/sites/config | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | arm | | | 1768 | CKVAZURE80 | resource | Microsoft.Web/sites/config | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Bicep | | | 1769 | CKVAZURE80 | resource | azurermappservice | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | | | 1770 | CKVAZURE80 | resource | azurermwindowsweb_app | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | | | 1771 | CKVAZURE81 | resource | azurermappservice | Ensure that 'PHP version' is the latest, if used to run the web app | Terraform | | | 1772 | CKVAZURE82 | resource | azurermappservice | Ensure that 'Python version' is the latest, if used to run the web app | Terraform | | | 1773 | CKVAZURE83 | resource | azurermappservice | Ensure that 'Java version' is the latest, if used to run the web app | Terraform | | | 1774 | CKVAZURE84 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender is set to On for Storage | Terraform | | | 1775 | CKVAZURE85 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender is set to On for Kubernetes | Terraform | | | 1776 | CKVAZURE86 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender is set to On for Container Registries | Terraform | | | 1777 | CKVAZURE87 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender is set to On for Key Vault | Terraform | | | 1778 | CKVAZURE88 | resource | Microsoft.Web/sites/config | Ensure that app services use Azure Files | arm | | | 1779 | CKVAZURE88 | resource | Microsoft.Web/sites/config | Ensure that app services use Azure Files | Bicep | | | 1780 | CKVAZURE88 | resource | azurermappservice | Ensure that app services use Azure Files | Terraform | | | 1781 | CKVAZURE88 | resource | azurermlinuxweb_app | Ensure that app services use Azure Files | Terraform | | | 1782 | CKVAZURE88 | resource | azurermwindowsweb_app | Ensure that app services use Azure Files | Terraform | | | 1783 | CKVAZURE89 | resource | Microsoft.Cache/redis | Ensure that Azure Cache for Redis disables public network access | arm | | | 1784 | CKVAZURE89 | resource |

| Ensure that Azure Cache for Redis disables public network access | Bicep | | | 1785 | CKVAZURE89 | resource | azurermrediscache | Ensure that Azure Cache for Redis disables public network access | Terraform | | | 1786 | CKVAZURE91 | resource | azurermrediscache | Ensure that only SSL are enabled for Cache for Redis | Terraform | | | 1787 | CKVAZURE92 | resource | azurermlinuxvirtual_machine | Ensure that Virtual Machines use managed disks | Terraform | | | 1788 | CKVAZURE92 | resource | azurermwindowsvirtual_machine | Ensure that Virtual Machines use managed disks | Terraform | | | 1789 | CKVAZURE93 | resource | Microsoft.Compute/disks | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | arm | | | 1790 | CKVAZURE93 | resource | Microsoft.Compute/disks | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Bicep | | | 1791 | CKVAZURE93 | resource | azurermmanageddisk | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Terraform | | | 1792 | CKVAZURE94 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that My SQL server enables geo-redundant backups | arm | | | 1793 | CKVAZURE94 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that My SQL server enables geo-redundant backups | Bicep | | | 1794 | CKVAZURE94 | resource | azurermmysqlflexible_server | Ensure that My SQL server enables geo-redundant backups | Terraform | | | 1795 | CKVAZURE94 | resource | azurermmysqlserver | Ensure that My SQL server enables geo-redundant backups | Terraform | | | 1796 | CKVAZURE95 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | arm | | | 1797 | CKVAZURE95 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Bicep | | | 1798 | CKVAZURE95 | resource | azurermvirtualmachinescaleset | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Terraform | | | 1799 | CKVAZURE96 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that MySQL server enables infrastructure encryption | arm | | | 1800 | CKVAZURE96 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that MySQL server enables infrastructure encryption | Bicep | | | 1801 | CKVAZURE96 | resource | azurermmysqlserver | Ensure that MySQL server enables infrastructure encryption | Terraform | | | 1802 | CKVAZURE97 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine scale sets have encryption at host enabled | arm | | | 1803 | CKVAZURE97 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine scale sets have encryption at host enabled | Bicep | | | 1804 | CKVAZURE97 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine scale sets have encryption at host enabled | arm | | | 1805 | CKVAZURE97 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine scale sets have encryption at host enabled | Bicep | | | 1806 | CKVAZURE97 | resource | azurermlinuxvirtualmachinescale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | | | 1807 | CKVAZURE97 | resource | azurermwindowsvirtualmachinescale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | | | 1808 | CKVAZURE98 | resource | azurermcontainergroup | Ensure that Azure Container group is deployed into virtual network | Terraform | | | 1809 | CKVAZURE99 | resource | azurermcosmosdbaccount | Ensure Cosmos DB accounts have restricted access | Terraform | | | 1810 | CKVAZURE100 | resource | Microsoft.DocumentDb/databaseAccounts | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | arm | | | 1811 | CKVAZURE100 | resource |

| Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Bicep | | | 1812 | CKVAZURE100 | resource | azurermcosmosdbaccount | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Terraform | | | 1813 | CKVAZURE101 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Azure Cosmos DB disables public network access | arm | | | 1814 | CKVAZURE101 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Azure Cosmos DB disables public network access | Bicep | | | 1815 | CKVAZURE101 | resource | azurermcosmosdbaccount | Ensure that Azure Cosmos DB disables public network access | Terraform | | | 1816 | CKVAZURE102 | resource | azurermpostgresqlserver | Ensure that PostgreSQL server enables geo-redundant backups | Terraform | | | 1817 | CKVAZURE103 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data Factory uses Git repository for source control | arm | | | 1818 | CKVAZURE103 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data Factory uses Git repository for source control | Bicep | | | 1819 | CKVAZURE103 | resource | azurermdatafactory | Ensure that Azure Data Factory uses Git repository for source control | Terraform | | | 1820 | CKVAZURE104 | resource | azurermdatafactory | Ensure that Azure Data factory public network access is disabled | Terraform | | | 1821 | CKVAZURE105 | resource | azurermdatalake_store | Ensure that Data Lake Store accounts enables encryption | Terraform | | | 1822 | CKVAZURE106 | resource | azurermeventgriddomain | Ensure that Azure Event Grid Domain public network access is disabled | Terraform | | | 1823 | CKVAZURE107 | resource | Microsoft.ApiManagement/service | Ensure that API management services use virtual networks | arm | | | 1824 | CKVAZURE107 | resource | Microsoft.ApiManagement/service | Ensure that API management services use virtual networks | Bicep | | | 1825 | CKVAZURE107 | resource | azurermapimanagement | Ensure that API management services use virtual networks | Terraform | | | 1826 | CKVAZURE108 | resource | azurerm_iothub | Ensure that Azure IoT Hub disables public network access | Terraform | | | 1827 | CKVAZURE109 | resource | Microsoft.KeyVault/vaults | Ensure that key vault allows firewall rules settings | arm | | | 1828 | CKVAZURE109 | resource | Microsoft.KeyVault/vaults | Ensure that key vault allows firewall rules settings | Bicep | | | 1829 | CKVAZURE109 | resource | azurermkeyvault | Ensure that key vault allows firewall rules settings | Terraform | | | 1830 | CKVAZURE110 | resource | azurermkeyvault | Ensure that key vault enables purge protection | Terraform | | | 1831 | CKVAZURE111 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables soft delete | arm | | | 1832 | CKVAZURE111 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables soft delete | Bicep | | | 1833 | CKVAZURE111 | resource | azurermkeyvault | Ensure that key vault enables soft delete | Terraform | | | 1834 | CKVAZURE112 | resource | Microsoft.KeyVault/vaults/keys | Ensure that key vault key is backed by HSM | arm | | | 1835 | CKVAZURE112 | resource | Microsoft.KeyVault/vaults/keys | Ensure that key vault key is backed by HSM | Bicep | | | 1836 | CKVAZURE112 | resource | azurermkeyvault_key | Ensure that key vault key is backed by HSM | Terraform | | | 1837 | CKVAZURE113 | resource | Microsoft.Sql/servers | Ensure that SQL server disables public network access | arm | | | 1838 | CKVAZURE113 | resource |

| Ensure that SQL server disables public network access | Bicep | | | 1839 | CKVAZURE113 | resource | azurermmssqlserver | Ensure that SQL server disables public network access | Terraform | | | 1840 | CKVAZURE114 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that key vault secrets have "content_type" set | arm | | | 1841 | CKVAZURE114 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that key vault secrets have "content_type" set | Bicep | | | 1842 | CKVAZURE114 | resource | azurermkeyvaultsecret | Ensure that key vault secrets have "contenttype" set | Terraform | | | 1843 | CKVAZURE115 | resource | azurermkubernetescluster | Ensure that AKS enables private clusters | Terraform | | | 1844 | CKVAZURE116 | resource | azurermkubernetescluster | Ensure that AKS uses Azure Policies Add-on | Terraform | | | 1845 | CKVAZURE117 | resource | azurermkubernetescluster | Ensure that AKS uses disk encryption set | Terraform | | | 1846 | CKVAZURE118 | resource | azurermnetworkinterface | Ensure that Network Interfaces disable IP forwarding | Terraform | | | 1847 | CKVAZURE119 | resource | azurermnetworkinterface | Ensure that Network Interfaces don't use public IPs | Terraform | | | 1848 | CKVAZURE120 | resource | azurermapplicationgateway | Ensure that Application Gateway enables WAF | Terraform | | | 1849 | CKVAZURE120 | resource | azurermwebapplicationfirewallpolicy | Ensure that Application Gateway enables WAF | Terraform | | | 1850 | CKVAZURE121 | resource | Microsoft.Network/frontDoors | Ensure that Azure Front Door enables WAF | arm | | | 1851 | CKVAZURE121 | resource | Microsoft.Network/frontDoors | Ensure that Azure Front Door enables WAF | Bicep | | | 1852 | CKVAZURE121 | resource | azurerm_frontdoor | Ensure that Azure Front Door enables WAF | Terraform | | | 1853 | CKVAZURE122 | resource | azurermwebapplicationfirewallpolicy | Ensure that Application Gateway uses WAF in "Detection" or "Prevention" modes | Terraform | | | 1854 | CKVAZURE123 | resource | Microsoft.Network/FrontDoorWebApplicationFirewallPolicies | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | arm | | | 1855 | CKVAZURE123 | resource | Microsoft.Network/FrontDoorWebApplicationFirewallPolicies | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Bicep | | | 1856 | CKVAZURE123 | resource | azurermfrontdoorfirewall_policy | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Terraform | | | 1857 | CKVAZURE124 | resource | azurermsearchservice | Ensure that Azure Cognitive Search disables public network access | Terraform | | | 1858 | CKVAZURE125 | resource | azurermservicefabric_cluster | Ensures that Service Fabric use three levels of protection available | Terraform | | | 1859 | CKVAZURE126 | resource | azurermservicefabric_cluster | Ensures that Active Directory is used for authentication for Service Fabric | Terraform | | | 1860 | CKVAZURE127 | resource | azurermmysqlserver | Ensure that My SQL server enables Threat detection policy | Terraform | | | 1861 | CKVAZURE128 | resource | azurermpostgresqlserver | Ensure that PostgreSQL server enables Threat detection policy | Terraform | | | 1862 | CKVAZURE129 | resource | azurermmariadbserver | Ensure that MariaDB server enables geo-redundant backups | Terraform | | | 1863 | CKVAZURE130 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables infrastructure encryption | arm | | | 1864 | CKVAZURE130 | resource |

| Ensure that PostgreSQL server enables infrastructure encryption | Bicep | | | 1865 | CKVAZURE130 | resource | azurermpostgresqlserver | Ensure that PostgreSQL server enables infrastructure encryption | Terraform | | | 1866 | CKVAZURE131 | resource | azurermsecuritycenter_contact | Ensure that 'Security contact emails' is set | Terraform | | | 1867 | CKVAZURE131 | parameter | secureString | SecureString parameter should not have hardcoded default values | arm | | | 1868 | CKVAZURE131 | parameter | string | SecureString parameter should not have hardcoded default values | Bicep | | | 1869 | CKVAZURE132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | arm | | | 1870 | CKVAZURE132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Bicep | | | 1871 | CKVAZURE132 | resource | azurermcosmosdbaccount | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Terraform | | | 1872 | CKVAZURE133 | resource | azurermfrontdoorfirewall_policy | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | | | 1873 | CKVAZURE134 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable public network access | arm | | | 1874 | CKVAZURE134 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable public network access | Bicep | | | 1875 | CKVAZURE134 | resource | azurermcognitiveaccount | Ensure that Cognitive Services accounts disable public network access | Terraform | | | 1876 | CKVAZURE135 | resource | azurermwebapplicationfirewallpolicy | Ensure Application Gateway WAF prevents message lookup in

See CVE-2021-44228 aka log4jshell | Terraform | | | 1877 | CKVAZURE136 | resource | azurermpostgresqlflexible_server | Ensure that PostgreSQL Flexible server enables geo-redundant backups | Terraform | | | 1878 | CKVAZURE137 | resource | azurermcontainerregistry | Ensure ACR admin account is disabled | Terraform | | | 1879 | CKVAZURE138 | resource | azurermcontainerregistry | Ensures that ACR disables anonymous pulling of images | Terraform | | | 1880 | CKVAZURE139 | resource | azurermcontainerregistry | Ensure ACR set to disable public networking | Terraform | | | 1881 | CKVAZURE140 | resource | azurermcosmosdbaccount | Ensure that Local Authentication is disabled on CosmosDB | Terraform | | | 1882 | CKVAZURE141 | resource | azurermkubernetescluster | Ensure AKS local admin account is disabled | Terraform | | | 1883 | CKVAZURE142 | resource | azurermmachinelearningcomputecluster | Ensure Machine Learning Compute Cluster Local Authentication is disabled | Terraform | | | 1884 | CKVAZURE143 | resource | azurermkubernetescluster | Ensure AKS cluster nodes do not have public IP addresses | Terraform | | | 1885 | CKVAZURE144 | resource | azurermmachinelearning_workspace | Ensure that Public Access is disabled for Machine Learning Workspace | Terraform | | | 1886 | CKVAZURE145 | resource | azurermfunctionapp | Ensure Function app is using the latest version of TLS encryption | Terraform | | | 1887 | CKVAZURE145 | resource | azurermfunctionapp_slot | Ensure Function app is using the latest version of TLS encryption | Terraform | | | 1888 | CKVAZURE145 | resource | azurermlinuxfunction_app | Ensure Function app is using the latest version of TLS encryption | Terraform | | | 1889 | CKVAZURE145 | resource | azurermlinuxfunctionappslot | Ensure Function app is using the latest version of TLS encryption | Terraform | | | 1890 | CKVAZURE145 | resource | azurermwindowsfunction_app | Ensure Function app is using the latest version of TLS encryption | Terraform | | | 1891 | CKVAZURE145 | resource | azurermwindowsfunctionappslot | Ensure Function app is using the latest version of TLS encryption | Terraform | | | 1892 | CKVAZURE146 | resource | azurermpostgresqlconfiguration | Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server | Terraform | | | 1893 | CKVAZURE147 | resource | azurermpostgresqlserver | Ensure PostgreSQL is using the latest version of TLS encryption | Terraform | | | 1894 | CKVAZURE148 | resource | azurermrediscache | Ensure Redis Cache is using the latest version of TLS encryption | Terraform | | | 1895 | CKVAZURE149 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine does not enable password authentication | arm | | | 1896 | CKVAZURE149 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine does not enable password authentication | Bicep | | | 1897 | CKVAZURE149 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine does not enable password authentication | arm | | | 1898 | CKVAZURE149 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine does not enable password authentication | Bicep | | | 1899 | CKVAZURE149 | resource | azurermlinuxvirtual_machine | Ensure that Virtual machine does not enable password authentication | Terraform | | | 1900 | CKVAZURE149 | resource | azurermlinuxvirtualmachinescale_set | Ensure that Virtual machine does not enable password authentication | Terraform | | | 1901 | CKVAZURE150 | resource | azurermmachinelearningcomputecluster | Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0 | Terraform | | | 1902 | CKVAZURE151 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables encryption | arm | | | 1903 | CKVAZURE151 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables encryption | Bicep | | | 1904 | CKVAZURE151 | resource | azurermwindowsvirtual_machine | Ensure Windows VM enables encryption | Terraform | | | 1905 | CKVAZURE152 | resource | azurermapimanagement | Ensure Client Certificates are enforced for API management | Terraform | | | 1906 | CKVAZURE153 | resource | azurermappservice_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | | | 1907 | CKVAZURE153 | resource | azurermlinuxwebappslot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | | | 1908 | CKVAZURE153 | resource | azurermwindowswebappslot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | | | 1909 | CKVAZURE154 | resource | azurermappservice_slot | Ensure the App service slot is using the latest version of TLS encryption | Terraform | | | 1910 | CKVAZURE155 | resource | azurermappservice_slot | Ensure debugging is disabled for the App service slot | Terraform | | | 1911 | CKVAZURE156 | resource | azurermmssqldatabaseextendedauditing_policy | Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs | Terraform | | | 1912 | CKVAZURE157 | resource | azurermsynapseworkspace | Ensure that Synapse workspace has dataexfiltrationprotection_enabled | Terraform | | | 1913 | CKVAZURE158 | resource | azurermdatabricksworkspace | Ensure that databricks workspace is not public | Terraform | | | 1914 | CKVAZURE159 | resource | azurermfunctionapp | Ensure function app builtin logging is enabled | Terraform | | | 1915 | CKVAZURE159 | resource | azurermfunctionapp_slot | Ensure function app builtin logging is enabled | Terraform | | | 1916 | CKVAZURE160 | resource | Microsoft.Network/networkSecurityGroups | Ensure that HTTP (port 80) access is restricted from the internet | arm | | | 1917 | CKVAZURE160 | resource | Microsoft.Network/networkSecurityGroups | Ensure that HTTP (port 80) access is restricted from the internet | Bicep | | | 1918 | CKVAZURE160 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that HTTP (port 80) access is restricted from the internet | arm | | | 1919 | CKVAZURE160 | resource |

| Ensure that HTTP (port 80) access is restricted from the internet | Bicep | | | 1920 | CKVAZURE160 | resource | azurermnetworksecurity_group | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | | | 1921 | CKVAZURE160 | resource | azurermnetworksecurity_rule | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | | | 1922 | CKVAZURE161 | resource | azurermspringcloudapiportal | Ensures Spring Cloud API Portal is enabled on for HTTPS | Terraform | | | 1923 | CKVAZURE162 | resource | azurermspringcloudapiportal | Ensures Spring Cloud API Portal Public Access Is Disabled | Terraform | | | 1924 | CKVAZURE163 | resource | azurermcontainerregistry | Enable vulnerability scanning for container images. | Terraform | | | 1925 | CKVAZURE164 | resource | azurermcontainerregistry | Ensures that ACR uses signed/trusted images | Terraform | | | 1926 | CKVAZURE165 | resource | azurermcontainerregistry | Ensure geo-replicated container registries to match multi-region container deployments. | Terraform | | | 1927 | CKVAZURE166 | resource | azurermcontainerregistry | Ensure container image quarantine, scan, and mark images verified | Terraform | | | 1928 | CKVAZURE167 | resource | azurermcontainerregistry | Ensure a retention policy is set to cleanup untagged manifests. | Terraform | | | 1929 | CKVAZURE168 | resource | azurermkubernetescluster | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Terraform | | | 1930 | CKVAZURE168 | resource | azurermkubernetesclusternodepool | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Terraform | | | 1931 | CKVAZURE169 | resource | azurermkubernetescluster | Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets | Terraform | | | 1932 | CKVAZURE170 | resource | azurermkubernetescluster | Ensure that AKS use the Paid Sku for its SLA | Terraform | | | 1933 | CKVAZURE171 | resource | azurermkubernetescluster | Ensure AKS cluster upgrade channel is chosen | Terraform | | | 1934 | CKVAZURE172 | resource | azurermkubernetescluster | Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters | Terraform | | | 1935 | CKVAZURE173 | resource | azurermapimanagement | Ensure API management uses at least TLS

| Terraform | | | 1936 | CKVAZURE174 | resource | azurermapimanagement | Ensure API management public access is disabled | Terraform | | | 1937 | CKVAZURE175 | resource | azurermwebpubsub | Ensure Web PubSub uses a SKU with an SLA | Terraform | | | 1938 | CKVAZURE176 | resource | azurermwebpubsub | Ensure Web PubSub uses managed identities to access Azure resources | Terraform | | | 1939 | CKVAZURE177 | resource | azurermwindowsvirtual_machine | Ensure Windows VM enables automatic updates | Terraform | | | 1940 | CKVAZURE177 | resource | azurermwindowsvirtualmachinescale_set | Ensure Windows VM enables automatic updates | Terraform | | | 1941 | CKVAZURE178 | resource | azurermlinuxvirtual_machine | Ensure linux VM enables SSH with keys for secure communication | Terraform | | | 1942 | CKVAZURE178 | resource | azurermlinuxvirtualmachinescale_set | Ensure linux VM enables SSH with keys for secure communication | Terraform | | | 1943 | CKVAZURE179 | resource | azurermlinuxvirtual_machine | Ensure VM agent is installed | Terraform | | | 1944 | CKVAZURE179 | resource | azurermlinuxvirtualmachinescale_set | Ensure VM agent is installed | Terraform | | | 1945 | CKVAZURE179 | resource | azurermwindowsvirtual_machine | Ensure VM agent is installed | Terraform | | | 1946 | CKVAZURE179 | resource | azurermwindowsvirtualmachinescale_set | Ensure VM agent is installed | Terraform | | | 1947 | CKVAZURE180 | resource | azurermkustocluster | Ensure that data explorer uses Sku with an SLA | Terraform | | | 1948 | CKVAZURE181 | resource | azurermkustocluster | Ensure that data explorer/Kusto uses managed identities to access Azure resources securely. | Terraform | | | 1949 | CKVAZURE182 | resource | azurermvirtualnetwork | Ensure that VNET has at least 2 connected DNS Endpoints | Terraform | | | 1950 | CKVAZURE182 | resource | azurermvirtualnetworkdnsservers | Ensure that VNET has at least 2 connected DNS Endpoints | Terraform | | | 1951 | CKVAZURE183 | resource | azurermvirtualnetwork | Ensure that VNET uses local DNS addresses | Terraform | | | 1952 | CKVAZURE184 | resource | azurermappconfiguration | Ensure 'localauthenabled' is set to 'False' | Terraform | | | 1953 | CKVAZURE185 | resource | azurermappconfiguration | Ensure 'Public Access' is not Enabled for App configuration | Terraform | | | 1954 | CKVAZURE186 | resource | azurermappconfiguration | Ensure App configuration encryption block is

| Terraform | | | 1955 | CKVAZURE187 | resource | azurermappconfiguration | Ensure App configuration purge protection is enabled | Terraform | | | 1956 | CKVAZURE188 | resource | azurermappconfiguration | Ensure App configuration Sku is standard | Terraform | | | 1957 | CKVAZURE189 | resource | azurermkeyvault | Ensure that Azure Key Vault disables public network access | Terraform | | | 1958 | CKVAZURE190 | resource | azurermstorageaccount | Ensure that Storage blobs restrict public access | Terraform | | | 1959 | CKVAZURE191 | resource | azurermeventgridtopic | Ensure that Managed identity provider is enabled for Azure Event Grid Topic | Terraform | | | 1960 | CKVAZURE192 | resource | azurermeventgridtopic | Ensure that Azure Event Grid Topic local Authentication is disabled | Terraform | | | 1961 | CKVAZURE193 | resource | azurermeventgridtopic | Ensure public network access is disabled for Azure Event Grid Topic | Terraform | | | 1962 | CKVAZURE194 | resource | azurermeventgriddomain | Ensure that Managed identity provider is enabled for Azure Event Grid Domain | Terraform | | | 1963 | CKVAZURE195 | resource | azurermeventgriddomain | Ensure that Azure Event Grid Domain local Authentication is disabled | Terraform | | | 1964 | CKVAZURE196 | resource | azurermsignalrservice | Ensure that SignalR uses a Paid Sku for its SLA | Terraform | | | 1965 | CKVAZURE197 | resource | azurermcdnendpoint | Ensure the Azure CDN disables the HTTP endpoint | Terraform | | | 1966 | CKVAZURE198 | resource | azurermcdnendpoint | Ensure the Azure CDN enables the HTTPS endpoint | Terraform | | | 1967 | CKVAZURE199 | resource | azurermservicebusnamespace | Ensure that Azure Service Bus uses double encryption | Terraform | | | 1968 | CKVAZURE200 | resource | azurermcdnendpointcustomdomain | Ensure the Azure CDN endpoint is using the latest version of TLS encryption | Terraform | | | 1969 | CKVAZURE201 | resource | azurermservicebusnamespace | Ensure that Azure Service Bus uses a customer-managed key to encrypt data | Terraform | | | 1970 | CKVAZURE202 | resource | azurermservicebusnamespace | Ensure that Managed identity provider is enabled for Azure Service Bus | Terraform | | | 1971 | CKVAZURE203 | resource | azurermservicebusnamespace | Ensure Azure Service Bus Local Authentication is disabled | Terraform | | | 1972 | CKVAZURE204 | resource | azurermservicebusnamespace | Ensure 'public network access enabled' is set to 'False' for Azure Service Bus | Terraform | | | 1973 | CKVAZURE205 | resource | azurermservicebusnamespace | Ensure Azure Service Bus is using the latest version of TLS encryption | Terraform | | | 1974 | CKVAZURE206 | resource | azurermstorageaccount | Ensure that Storage Accounts use replication | Terraform | | | 1975 | CKVAZURE207 | resource | azurermsearchservice | Ensure Azure Cognitive Search service uses managed identities to access Azure resources | Terraform | | | 1976 | CKVAZURE208 | resource | azurermsearchservice | Ensure that Azure Cognitive Search maintains SLA for index updates | Terraform | | | 1977 | CKVAZURE209 | resource | azurermsearchservice | Ensure that Azure Cognitive Search maintains SLA for search index queries | Terraform | | | 1978 | CKVAZURE210 | resource | azurermsearchservice | Ensure Azure Cognitive Search service allowed IPS does not give public Access | Terraform | | | 1979 | CKVAZURE211 | resource | azurermserviceplan | Ensure App Service plan suitable for production use | Terraform | | | 1980 | CKVAZURE212 | resource | azurermserviceplan | Ensure App Service has a minimum number of instances for failover | Terraform | | | 1981 | CKVAZURE213 | resource | azurermappservice | Ensure that App Service configures health check | Terraform | | | 1982 | CKVAZURE213 | resource | azurermlinuxweb_app | Ensure that App Service configures health check | Terraform | | | 1983 | CKVAZURE213 | resource | azurermwindowsweb_app | Ensure that App Service configures health check | Terraform | | | 1984 | CKVAZURE214 | resource | azurermlinuxweb_app | Ensure App Service is set to be always on | Terraform | | | 1985 | CKVAZURE214 | resource | azurermwindowsweb_app | Ensure App Service is set to be always on | Terraform | | | 1986 | CKVAZURE215 | resource | azurermapimanagement_backend | Ensure API management backend uses https | Terraform | | | 1987 | CKVAZURE216 | resource | Microsoft.Network/azureFirewalls | Ensure DenyIntelMode is set to Deny for Azure Firewalls | arm | | | 1988 | CKVAZURE216 | resource | Microsoft.Network/azureFirewalls | Ensure DenyIntelMode is set to Deny for Azure Firewalls | Bicep | | | 1989 | CKVAZURE216 | resource | azurerm_firewall | Ensure DenyIntelMode is set to Deny for Azure Firewalls | Terraform | | | 1990 | CKVAZURE217 | resource | azurermapplicationgateway | Ensure Azure Application gateways listener that allow connection requests over HTTP | Terraform | | | 1991 | CKVAZURE218 | resource | azurermapplicationgateway | Ensure Application Gateway defines secure protocols for in transit communication | Terraform | | | 1992 | CKVAZURE219 | resource | azurerm_firewall | Ensure Firewall defines a firewall policy | Terraform | | | 1993 | CKVAZURE220 | resource | azurermfirewallpolicy | Ensure Firewall policy has IDPS mode as deny | Terraform | | | 1994 | CKVAZURE221 | resource | azurermlinuxfunction_app | Ensure that Azure Function App public network access is disabled | Terraform | | | 1995 | CKVAZURE221 | resource | azurermlinuxfunctionappslot | Ensure that Azure Function App public network access is disabled | Terraform | | | 1996 | CKVAZURE221 | resource | azurermwindowsfunction_app | Ensure that Azure Function App public network access is disabled | Terraform | | | 1997 | CKVAZURE221 | resource | azurermwindowsfunctionappslot | Ensure that Azure Function App public network access is disabled | Terraform | | | 1998 | CKVAZURE222 | resource | azurermlinuxweb_app | Ensure that Azure Web App public network access is disabled | Terraform | | | 1999 | CKVAZURE222 | resource | azurermwindowsweb_app | Ensure that Azure Web App public network access is disabled | Terraform | | | 2000 | CKVAZURE223 | resource | azurermeventhubnamespace | Ensure Event Hub Namespace uses at least TLS

| Terraform | | | 2001 | CKVAZURE224 | resource | azurermmssqldatabase | Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity | Terraform | | | 2002 | CKVAZURE225 | resource | azurermserviceplan | Ensure the App Service Plan is zone redundant | Terraform | | | 2003 | CKVAZURE226 | resource | azurermkubernetescluster | Ensure ephemeral disks are used for OS disks | Terraform | | | 2004 | CKVAZURE227 | resource | azurermkubernetescluster | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Terraform | | | 2005 | CKVAZURE227 | resource | azurermkubernetesclusternodepool | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Terraform | | | 2006 | CKVAZURE228 | resource | azurermeventhubnamespace | Ensure the Azure Event Hub Namespace is zone redundant | Terraform | | | 2007 | CKVAZURE229 | resource | azurermmssqldatabase | Ensure the Azure SQL Database Namespace is zone redundant | Terraform | | | 2008 | CKVAZURE230 | resource | azurermrediscache | Standard Replication should be enabled | Terraform | | | 2009 | CKVAZURE231 | resource | azurermappserviceenvironmentv3 | Ensure App Service Environment is zone redundant | Terraform | | | 2010 | CKVAZURE232 | resource | azurermkubernetescluster | Ensure that only critical system pods run on system nodes | Terraform | | | 2011 | CKVAZURE233 | resource | azurermcontainerregistry | Ensure Azure Container Registry (ACR) is zone redundant | Terraform | | | 2012 | CKVAZURE234 | resource | azurermsecuritycentersubscriptionpricing | Ensure that Azure Defender for cloud is set to On for Resource Manager | Terraform | | | 2013 | CKVAZURE235 | resource | azurermcontainergroup | Ensure that Azure container environment variables are configured with secure values only | Terraform | | | 2014 | CKVAZURE237 | resource | azurermcontainerregistry | Ensure dedicated data endpoints are

| Terraform | | | 2015 | CKV2AZURE1 | resource | azurermstorageaccount | Ensure storage for critical data are encrypted with Customer Managed Key | Terraform | | | 2016 | CKV2AZURE2 | resource | azurermmssqlserversecurityalert_policy | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | | | 2017 | CKV2AZURE2 | resource | azurermsqlserver | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | | | 2018 | CKV2AZURE3 | resource | azurermmssqlserver | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | | | 2019 | CKV2AZURE3 | resource | azurermmssqlserversecurityalert_policy | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | | | 2020 | CKV2AZURE3 | resource | azurermmssqlservervulnerabilityassessment | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | | | 2021 | CKV2AZURE3 | resource | azurermsqlserver | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | | | 2022 | CKV2AZURE4 | resource | azurermmssqlserver | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | | | 2023 | CKV2AZURE4 | resource | azurermmssqlserversecurityalert_policy | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | | | 2024 | CKV2AZURE4 | resource | azurermmssqlservervulnerabilityassessment | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | | | 2025 | CKV2AZURE4 | resource | azurermsqlserver | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | | | 2026 | CKV2AZURE5 | resource | azurermmssqlserver | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | | | 2027 | CKV2AZURE5 | resource | azurermmssqlserversecurityalert_policy | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | | | 2028 | CKV2AZURE5 | resource | azurermmssqlservervulnerabilityassessment | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | | | 2029 | CKV2AZURE5 | resource | azurermsqlserver | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | | | 2030 | CKV2AZURE6 | resource | azurermsqlfirewall_rule | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | | | 2031 | CKV2AZURE6 | resource | azurermsqlserver | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | | | 2032 | CKV2AZURE7 | resource | azurermsqlserver | Ensure that Azure Active Directory Admin is configured | Terraform | | | 2033 | CKV2AZURE8 | resource | azurermmonitoractivitylogalert | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | | | 2034 | CKV2AZURE8 | resource | azurermstorageaccount | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | | | 2035 | CKV2AZURE8 | resource | azurermstoragecontainer | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | | | 2036 | CKV2AZURE9 | resource | azurermvirtualmachine | Ensure Virtual Machines are utilizing Managed Disks | Terraform | | | 2037 | CKV2AZURE10 | resource | azurermvirtualmachine | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | | | 2038 | CKV2AZURE10 | resource | azurermvirtualmachine_extension | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | | | 2039 | CKV2AZURE11 | resource | azurermkustocluster | Ensure that Azure Data Explorer encryption at rest uses a customer-managed key | Terraform | | | 2040 | CKV2AZURE12 | resource | azurermvirtualmachine | Ensure that virtual machines are backed up using Azure Backup | Terraform | | | 2041 | CKV2AZURE13 | resource | azurermmssqlserversecurityalert_policy | Ensure that sql servers enables data security policy | Terraform | | | 2042 | CKV2AZURE13 | resource | azurermsqlserver | Ensure that sql servers enables data security policy | Terraform | | | 2043 | CKV2AZURE14 | resource | azurermmanageddisk | Ensure that Unattached disks are encrypted | Terraform | | | 2044 | CKV2AZURE14 | resource | azurermvirtualmachine | Ensure that Unattached disks are encrypted | Terraform | | | 2045 | CKV2AZURE15 | resource | azurermdatafactory | Ensure that Azure data factories are encrypted with a customer-managed key | Terraform | | | 2046 | CKV2AZURE16 | resource | azurermmysqlserver | Ensure that MySQL server enables customer-managed key for encryption | Terraform | | | 2047 | CKV2AZURE16 | resource | azurermmysqlserver_key | Ensure that MySQL server enables customer-managed key for encryption | Terraform | | | 2048 | CKV2AZURE17 | resource | azurermpostgresqlserver | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | | | 2049 | CKV2AZURE17 | resource | azurermpostgresqlserver_key | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | | | 2050 | CKV2AZURE19 | resource | azurermsynapseworkspace | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Terraform | | | 2051 | CKV2AZURE20 | resource | azurermloganalyticsstorageinsights | Ensure Storage logging is enabled for Table service for read requests | Terraform | | | 2052 | CKV2AZURE20 | resource | azurermstorageaccount | Ensure Storage logging is enabled for Table service for read requests | Terraform | | | 2053 | CKV2AZURE20 | resource | azurermstoragetable | Ensure Storage logging is enabled for Table service for read requests | Terraform | | | 2054 | CKV2AZURE21 | resource | azurermloganalyticsstorageinsights | Ensure Storage logging is enabled for Blob service for read requests | Terraform | | | 2055 | CKV2AZURE21 | resource | azurermstorageaccount | Ensure Storage logging is enabled for Blob service for read requests | Terraform | | | 2056 | CKV2AZURE21 | resource | azurermstoragecontainer | Ensure Storage logging is enabled for Blob service for read requests | Terraform | | | 2057 | CKV2AZURE22 | resource | azurermcognitiveaccount | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | | | 2058 | CKV2AZURE22 | resource | azurermcognitiveaccountcustomermanaged_key | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | | | 2059 | CKV2AZURE23 | resource | Microsoft.AppPlatform/Spring | Ensure Azure spring cloud is configured with Virtual network (Vnet) | arm | | | 2060 | CKV2AZURE23 | resource | azurermspringcloud_service | Ensure Azure spring cloud is configured with Virtual network (Vnet) | Terraform | | | 2061 | CKV2AZURE24 | resource | azurermautomationaccount | Ensure Azure automation account does NOT have overly permissive network access | Terraform | | | 2062 | CKV2AZURE25 | resource | azurermmssqldatabase | Ensure Azure SQL database Transparent Data Encryption (TDE) is enabled | Terraform | | | 2063 | CKV2AZURE26 | resource | azurermpostgresqlflexibleserverfirewall_rule | Ensure Azure PostgreSQL Flexible server is not configured with overly permissive network access | Terraform | | | 2064 | CKV2AZURE27 | resource | Microsoft.Sql/servers | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | arm | | | 2065 | CKV2AZURE27 | resource |

| Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | Bicep | | | 2066 | CKV2AZURE27 | resource | azurermmssqlserver | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | Terraform | | | 2067 | CKV2AZURE28 | resource | azurermcontainergroup | Ensure Container Instance is configured with managed identity | Terraform | | | 2068 | CKV2AZURE29 | resource | azurermkubernetescluster | Ensure AKS cluster has Azure CNI networking enabled | Terraform | | | 2069 | CKV2AZURE30 | resource | azurermcontainerregistry_webhook | Ensure Azure Container Registry (ACR) has HTTPS enabled for webhook | Terraform | | | 2070 | CKV2AZURE31 | resource | azurerm_subnet | Ensure VNET subnet is configured with a Network Security Group (NSG) | Terraform | | | 2071 | CKV2AZURE32 | resource | azurermkeyvault | Ensure private endpoint is configured to key vault | Terraform | | | 2072 | CKV2AZURE33 | resource | azurermstorageaccount | Ensure storage account is configured with private endpoint | Terraform | | | 2073 | CKV2AZURE34 | resource | azurermsqlfirewall_rule | Ensure Azure SQL server firewall is not overly permissive | Terraform | | | 2074 | CKV2AZURE35 | resource | azurermrecoveryservices_vault | Ensure Azure recovery services vault is configured with managed identity | Terraform | | | 2075 | CKV2AZURE36 | resource | azurermautomationaccount | Ensure Azure automation account is configured with managed identity | Terraform | | | 2076 | CKV2AZURE37 | resource | azurermmariadbserver | Ensure Azure MariaDB server is using latest TLS (1.2) | Terraform | | | 2077 | CKV2AZURE38 | resource | azurermstorageaccount | Ensure soft-delete is enabled on Azure storage account | Terraform | | | 2078 | CKV2AZURE39 | resource | azurermlinuxvirtual_machine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | | | 2079 | CKV2AZURE39 | resource | azurermnetworkinterface | Ensure Azure VM is not configured with public IP and serial console access | Terraform | | | 2080 | CKV2AZURE39 | resource | azurermvirtualmachine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | | | 2081 | CKV2AZURE39 | resource | azurermwindowsvirtual_machine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | | | 2082 | CKV2AZURE40 | resource | azurermstorageaccount | Ensure storage account is not configured with Shared Key authorization | Terraform | | | 2083 | CKV2AZURE41 | resource | azurermstorageaccount | Ensure storage account is configured with SAS expiration policy | Terraform | | | 2084 | CKV2AZURE42 | resource | azurermpostgresqlserver | Ensure Azure PostgreSQL server is configured with private endpoint | Terraform | | | 2085 | CKV2AZURE43 | resource | azurermmariadbserver | Ensure Azure MariaDB server is configured with private endpoint | Terraform | | | 2086 | CKV2AZURE44 | resource | azurermmysqlserver | Ensure Azure MySQL server is configured with private endpoint | Terraform | | | 2087 | CKV2AZURE45 | resource | azurermmssqlserver | Ensure Microsoft SQL server is configured with private endpoint | Terraform | | | 2088 | CKV2AZURE46 | resource | azurermsynapseworkspacesecurityalert_policy | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | Terraform | | | 2089 | CKV2AZURE46 | resource | azurermsynapseworkspacevulnerabilityassessment | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | Terraform | | | 2090 | CKV2AZURE47 | resource | azurermstorageaccount | Ensure storage account is configured without blob anonymous access | Terraform | | | 2091 | CKVAZUREPIPELINES1 | azure_pipelines | jobs | Ensure container job uses a non latest version tag | Azure Pipelines | | | 2092 | CKVAZUREPIPELINES1 | azure_pipelines | stages | | 2093 | CKVAZUREPIPELINES2 | azure_pipelines | jobs | Ensure container job uses a version digest | Azure Pipelines | | | 2094 | CKVAZUREPIPELINES2 | azure_pipelines | stages | | 2095 | CKVAZUREPIPELINES3 | azure_pipelines | jobs | | 2096 | CKVAZUREPIPELINES3 | azure_pipelines | stages | | 2097 | CKVAZUREPIPELINES5 | azure_pipelines | *.container | | 2098 | CKVAZUREPIPELINES5 | azure_pipelines | jobs | | 2099 | CKVAZUREPIPELINES5 | azure_pipelines | stages | | 2100 | CKVBCW1 | provider | bridgecrew | Ensure no hard coded API token exist in the provider | Terraform | | | 2101 | CKVBITBUCKET1 | bitbucketconfiguration | * | Merge requests should require at least 2 approvals | bitbucketconfiguration | | | 2102 | CKVBITBUCKETPIPELINES1 | bitbucket_pipelines | | | 2103 | CKVBITBUCKETPIPELINES1 | bitbucket_pipelines | pipelines.*. | | 2104 | CKVBITBUCKETPIPELINES1 | bitbucket_pipelines | pipelines.default | | 2105 | CKVCIRCLECIPIPELINES1 | circleci_pipelines | jobs.*.docker | | 2106 | CKVCIRCLECIPIPELINES2 | circleci_pipelines | jobs.*.docker | | 2107 | CKVCIRCLECIPIPELINES3 | circlecipipelines | orbs.{orbs: @} | Ensure mutable development orbs are not used. | circlecipipelines | | | 2108 | CKVCIRCLECIPIPELINES4 | circlecipipelines | orbs.{orbs: @} | Ensure unversioned volatile orbs are not used. | circlecipipelines | | | 2109 | CKVCIRCLECIPIPELINES5 | circleci_pipelines |

| | 2110 | CKVCIRCLECIPIPELINES6 | circleci_pipelines | jobs.*.steps | | 2111 | CKVCIRCLECIPIPELINES7 | circleci_pipelines | jobs.*.steps | | 2112 | CKVCIRCLECIPIPELINES8 | circleci_pipelines | executors.*.docker | | 2113 | CKVCIRCLECIPIPELINES8 | circleci_pipelines | jobs.*.docker | | 2114 | CKVDIO1 | resource | digitaloceanspacesbucket | Ensure the Spaces bucket has versioning enabled | Terraform | | | 2115 | CKVDIO2 | resource | digitalocean_droplet | Ensure the droplet specifies an SSH key | Terraform | | | 2116 | CKVDIO3 | resource | digitaloceanspacesbucket | Ensure the Spaces bucket is private | Terraform | | | 2117 | CKVDIO4 | resource | digitalocean_firewall | Ensure the firewall ingress is not wide open | Terraform | | | 2118 | CKVDOCKER1 | dockerfile | EXPOSE | Ensure port 22 is not exposed | dockerfile | | | 2119 | CKVDOCKER2 | dockerfile | * | Ensure that HEALTHCHECK instructions have been added to container images | dockerfile | | | 2120 | CKVDOCKER3 | dockerfile | * | Ensure that a user for the container has been created | dockerfile | | | 2121 | CKVDOCKER4 | dockerfile | ADD | Ensure that COPY is used instead of ADD in Dockerfiles | dockerfile | | | 2122 | CKVDOCKER5 | dockerfile | RUN | Ensure update instructions are not use alone in the Dockerfile | dockerfile | | | 2123 | CKVDOCKER6 | dockerfile | MAINTAINER | Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) | dockerfile | | | 2124 | CKVDOCKER7 | dockerfile | FROM | Ensure the base image uses a non latest version tag | dockerfile | | | 2125 | CKVDOCKER8 | dockerfile | USER | Ensure the last USER is not root | dockerfile | | | 2126 | CKVDOCKER9 | dockerfile | RUN | Ensure that APT isn't used | dockerfile | | | 2127 | CKVDOCKER10 | dockerfile | WORKDIR | Ensure that WORKDIR values are absolute paths | dockerfile | | | 2128 | CKVDOCKER11 | dockerfile | FROM | Ensure From Alias are unique for multistage

| dockerfile | | | 2129 | CKV2DOCKER1 | resource | RUN | Ensure that sudo isn't used | dockerfile | | | 2130 | CKV2DOCKER2 | resource | RUN | Ensure that certificate validation isn't disabled with curl | dockerfile | | | 2131 | CKV2DOCKER3 | resource | RUN | Ensure that certificate validation isn't disabled with wget | dockerfile | | | 2132 | CKV2DOCKER4 | resource | RUN | Ensure that certificate validation isn't disabled with the pip '--trusted-host' option | dockerfile | | | 2133 | CKV2DOCKER5 | resource | ARG | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environmnet variable | dockerfile | | | 2134 | CKV2DOCKER5 | resource | ENV | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environmnet variable | dockerfile | | | 2135 | CKV2DOCKER5 | resource | RUN | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environmnet variable | dockerfile | | | 2136 | CKV2DOCKER6 | resource | ARG | Ensure that certificate validation isn't disabled with the NODETLSREJECT_UNAUTHORIZED environmnet variable | dockerfile | | | 2137 | CKV2DOCKER6 | resource | ENV | Ensure that certificate validation isn't disabled with the NODETLSREJECT_UNAUTHORIZED environmnet variable | dockerfile | | | 2138 | CKV2DOCKER6 | resource | RUN | Ensure that certificate validation isn't disabled with the NODETLSREJECT_UNAUTHORIZED environmnet variable | dockerfile | | | 2139 | CKV2DOCKER7 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by apk via the '--allow-untrusted' option | dockerfile | | | 2140 | CKV2DOCKER8 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by apt-get via the '--allow-unauthenticated' option | dockerfile | | | 2141 | CKV2DOCKER9 | resource | RUN | Ensure that packages with untrusted or missing GPG signatures are not used by dnf, tdnf, or yum via the '--nogpgcheck' option | dockerfile | | | 2142 | CKV2DOCKER10 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by rpm via the '--nodigest', '--nosignature', '--noverify', or '--nofiledigest' options | dockerfile | | | 2143 | CKV2DOCKER11 | resource | RUN | Ensure that the '--force-yes' option is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | dockerfile | | | 2144 | CKV2DOCKER12 | resource | ARG | Ensure that certificate validation isn't disabled for npm via the 'NPMCONFIGSTRICT_SSL' environmnet variable | dockerfile | | | 2145 | CKV2DOCKER12 | resource | ENV | Ensure that certificate validation isn't disabled for npm via the 'NPMCONFIGSTRICT_SSL' environmnet variable | dockerfile | | | 2146 | CKV2DOCKER12 | resource | RUN | Ensure that certificate validation isn't disabled for npm via the 'NPMCONFIGSTRICT_SSL' environmnet variable | dockerfile | | | 2147 | CKV2DOCKER13 | resource | RUN | Ensure that certificate validation isn't disabled for npm or yarn by setting the option strict-ssl to false | dockerfile | | | 2148 | CKV2DOCKER14 | resource | ARG | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GITSSLNO_VERIFY' to any value | dockerfile | | | 2149 | CKV2DOCKER14 | resource | ENV | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GITSSLNO_VERIFY' to any value | dockerfile | | | 2150 | CKV2DOCKER14 | resource | RUN | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GITSSLNO_VERIFY' to any value | dockerfile | | | 2151 | CKV2DOCKER15 | resource | RUN | Ensure that the yum and dnf package managers are not configured to disable SSL certificate validation via the 'sslverify' configuration option | dockerfile | | | 2152 | CKV2DOCKER16 | resource | ARG | Ensure that certificate validation isn't disabled with pip via the 'PIPTRUSTEDHOST' environment variable | dockerfile | | | 2153 | CKV2DOCKER16 | resource | ENV | Ensure that certificate validation isn't disabled with pip via the 'PIPTRUSTEDHOST' environment variable | dockerfile | | | 2154 | CKV2DOCKER16 | resource | RUN | Ensure that certificate validation isn't disabled with pip via the 'PIPTRUSTEDHOST' environment variable | dockerfile | | | 2155 | CKV2DOCKER17 | resource | RUN | Ensure that 'chpasswd' is not used to set or remove passwords | dockerfile | | | 2156 | CKVGCP1 | resource | googlecontainercluster | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters | Terraform | | | 2157 | CKVGCP2 | resource | googlecomputefirewall | Ensure Google compute firewall ingress does not allow unrestricted ssh access | Terraform | | | 2158 | CKVGCP3 | resource | googlecomputefirewall | Ensure Google compute firewall ingress does not allow unrestricted rdp access | Terraform | | | 2159 | CKVGCP4 | resource | googlecomputessl_policy | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites | Terraform | | | 2160 | CKVGCP6 | resource | googlesqldatabase_instance | Ensure all Cloud SQL database instance requires all incoming connections to use SSL | Terraform | | | 2161 | CKVGCP7 | resource | googlecontainercluster | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters | Terraform | | | 2162 | CKVGCP8 | resource | googlecontainercluster | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters | Terraform | | | 2163 | CKVGCP9 | resource | googlecontainernode_pool | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters | Terraform | | | 2164 | CKVGCP10 | resource | googlecontainernode_pool | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters | Terraform | | | 2165 | CKVGCP11 | resource | googlesqldatabase_instance | Ensure that Cloud SQL database Instances are not open to the world | Terraform | | | 2166 | CKVGCP12 | resource | googlecontainercluster | Ensure Network Policy is enabled on Kubernetes Engine Clusters | Terraform | | | 2167 | CKVGCP13 | resource | googlecontainercluster | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled | Terraform | | | 2168 | CKVGCP14 | resource | googlesqldatabase_instance | Ensure all Cloud SQL database instance have backup configuration enabled | Terraform | | | 2169 | CKVGCP15 | resource | googlebigquerydataset | Ensure that BigQuery datasets are not anonymously or publicly accessible | Terraform | | | 2170 | CKVGCP16 | resource | googlednsmanaged_zone | Ensure that DNSSEC is enabled for Cloud DNS | Terraform | | | 2171 | CKVGCP17 | resource | googlednsmanaged_zone | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC | Terraform | | | 2172 | CKVGCP18 | resource | googlecontainercluster | Ensure GKE Control Plane is not public | Terraform | | | 2173 | CKVGCP20 | resource | googlecontainercluster | Ensure master authorized networks is set to enabled in GKE clusters | Terraform | | | 2174 | CKVGCP21 | resource | googlecontainercluster | Ensure Kubernetes Clusters are configured with Labels | Terraform | | | 2175 | CKVGCP22 | resource | googlecontainernode_pool | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image | Terraform | | | 2176 | CKVGCP23 | resource | googlecontainercluster | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | Terraform | | | 2177 | CKVGCP24 | resource | googlecontainercluster | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters | Terraform | | | 2178 | CKVGCP25 | resource | googlecontainercluster | Ensure Kubernetes Cluster is created with Private cluster enabled | Terraform | | | 2179 | CKVGCP26 | resource | googlecomputesubnetwork | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network | Terraform | | | 2180 | CKVGCP27 | resource | google_project | Ensure that the default network does not exist in a project | Terraform | | | 2181 | CKVGCP28 | resource | googlestoragebucketiambinding | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | | | 2182 | CKVGCP28 | resource | googlestoragebucketiammember | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | | | 2183 | CKVGCP29 | resource | googlestoragebucket | Ensure that Cloud Storage buckets have uniform bucket-level access enabled | Terraform | | | 2184 | CKVGCP30 | resource | googlecomputeinstance | Ensure that instances are not configured to use the default service account | Terraform | | | 2185 | CKVGCP30 | resource | googlecomputeinstancefromtemplate | Ensure that instances are not configured to use the default service account | Terraform | | | 2186 | CKVGCP30 | resource | googlecomputeinstance_template | Ensure that instances are not configured to use the default service account | Terraform | | | 2187 | CKVGCP31 | resource | googlecomputeinstance | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | | | 2188 | CKVGCP31 | resource | googlecomputeinstancefromtemplate | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | | | 2189 | CKVGCP31 | resource | googlecomputeinstance_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | | | 2190 | CKVGCP32 | resource | googlecomputeinstance | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | | | 2191 | CKVGCP32 | resource | googlecomputeinstancefromtemplate | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | | | 2192 | CKVGCP32 | resource | googlecomputeinstance_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | | | 2193 | CKVGCP33 | resource | googlecomputeproject_metadata | Ensure oslogin is enabled for a Project | Terraform | | | 2194 | CKVGCP34 | resource | googlecomputeinstance | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | | | 2195 | CKVGCP34 | resource | googlecomputeinstancefromtemplate | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | | | 2196 | CKVGCP34 | resource | googlecomputeinstance_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | | | 2197 | CKVGCP35 | resource | googlecomputeinstance | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | | | 2198 | CKVGCP35 | resource | googlecomputeinstancefromtemplate | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | | | 2199 | CKVGCP35 | resource | googlecomputeinstance_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | | | 2200 | CKVGCP36 | resource | googlecomputeinstance | Ensure that IP forwarding is not enabled on Instances | Terraform | | | 2201 | CKVGCP36 | resource | googlecomputeinstancefromtemplate | Ensure that IP forwarding is not enabled on Instances | Terraform | | | 2202 | CKVGCP36 | resource | googlecomputeinstance_template | Ensure that IP forwarding is not enabled on Instances | Terraform | | | 2203 | CKVGCP37 | resource | googlecomputedisk | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2204 | CKVGCP38 | resource | googlecomputeinstance | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2205 | CKVGCP39 | resource | googlecomputeinstance | Ensure Compute instances are launched with Shielded VM enabled | Terraform | | | 2206 | CKVGCP39 | resource | googlecomputeinstancefromtemplate | Ensure Compute instances are launched with Shielded VM enabled | Terraform | | | 2207 | CKVGCP39 | resource | googlecomputeinstance_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | | | 2208 | CKVGCP40 | resource | googlecomputeinstance | Ensure that Compute instances do not have public IP addresses | Terraform | | | 2209 | CKVGCP40 | resource | googlecomputeinstancefromtemplate | Ensure that Compute instances do not have public IP addresses | Terraform | | | 2210 | CKVGCP40 | resource | googlecomputeinstance_template | Ensure that Compute instances do not have public IP addresses | Terraform | | | 2211 | CKVGCP41 | resource | googleprojectiam_binding | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | | | 2212 | CKVGCP41 | resource | googleprojectiam_member | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | | | 2213 | CKVGCP42 | resource | googleprojectiam_member | Ensure that Service Account has no Admin privileges | Terraform | | | 2214 | CKVGCP43 | resource | googlekmscrypto_key | Ensure KMS encryption keys are rotated within a period of 90 days | Terraform | | | 2215 | CKVGCP44 | resource | googlefolderiam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | | | 2216 | CKVGCP44 | resource | googlefolderiam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | | | 2217 | CKVGCP45 | resource | googleorganizationiam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | | | 2218 | CKVGCP45 | resource | googleorganizationiam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | | | 2219 | CKVGCP46 | resource | googleprojectiam_binding | Ensure Default Service account is not used at a project level | Terraform | | | 2220 | CKVGCP46 | resource | googleprojectiam_member | Ensure Default Service account is not used at a project level | Terraform | | | 2221 | CKVGCP47 | resource | googleorganizationiam_binding | Ensure default service account is not used at an organization level | Terraform | | | 2222 | CKVGCP47 | resource | googleorganizationiam_member | Ensure default service account is not used at an organization level | Terraform | | | 2223 | CKVGCP48 | resource | googlefolderiam_binding | Ensure Default Service account is not used at a folder level | Terraform | | | 2224 | CKVGCP48 | resource | googlefolderiam_member | Ensure Default Service account is not used at a folder level | Terraform | | | 2225 | CKVGCP49 | resource | googleprojectiam_binding | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | | | 2226 | CKVGCP49 | resource | googleprojectiam_member | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | | | 2227 | CKVGCP50 | resource | googlesqldatabaseinstance | Ensure MySQL database 'localinfile' flag is set to 'off' | Terraform | | | 2228 | CKVGCP51 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database 'logcheckpoints' flag is set to 'on' | Terraform | | | 2229 | CKVGCP52 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database 'logconnections' flag is set to 'on' | Terraform | | | 2230 | CKVGCP53 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database 'logdisconnections' flag is set to 'on' | Terraform | | | 2231 | CKVGCP54 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database 'loglock_waits' flag is set to 'on' | Terraform | | | 2232 | CKVGCP55 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database 'logmin_messages' flag is set to a valid value | Terraform | | | 2233 | CKVGCP56 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database 'logtemp_files flag is set to '0' | Terraform | | | 2234 | CKVGCP57 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database 'logmindurationstatement' flag is set to '-1' | Terraform | | | 2235 | CKVGCP58 | resource | googlesqldatabase_instance | Ensure SQL database 'cross db ownership chaining' flag is set to 'off' | Terraform | | | 2236 | CKVGCP59 | resource | googlesqldatabase_instance | Ensure SQL database 'contained database authentication' flag is set to 'off' | Terraform | | | 2237 | CKVGCP60 | resource | googlesqldatabase_instance | Ensure Cloud SQL database does not have public IP | Terraform | | | 2238 | CKVGCP61 | resource | googlecontainercluster | Enable VPC Flow Logs and Intranode Visibility | Terraform | | | 2239 | CKVGCP62 | resource | googlestoragebucket | Bucket should log access | Terraform | | | 2240 | CKVGCP63 | resource | googlestoragebucket | Bucket should not log to itself | Terraform | | | 2241 | CKVGCP64 | resource | googlecontainercluster | Ensure clusters are created with Private Nodes | Terraform | | | 2242 | CKVGCP65 | resource | googlecontainercluster | Manage Kubernetes RBAC users with Google Groups for GKE | Terraform | | | 2243 | CKVGCP66 | resource | googlecontainercluster | Ensure use of Binary Authorization | Terraform | | | 2244 | CKVGCP68 | resource | googlecontainercluster | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | | | 2245 | CKVGCP68 | resource | googlecontainernode_pool | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | | | 2246 | CKVGCP69 | resource | googlecontainercluster | Ensure the GKE Metadata Server is Enabled | Terraform | | | 2247 | CKVGCP69 | resource | googlecontainernode_pool | Ensure the GKE Metadata Server is Enabled | Terraform | | | 2248 | CKVGCP70 | resource | googlecontainercluster | Ensure the GKE Release Channel is set | Terraform | | | 2249 | CKVGCP71 | resource | googlecontainercluster | Ensure Shielded GKE Nodes are Enabled | Terraform | | | 2250 | CKVGCP72 | resource | googlecontainercluster | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | | | 2251 | CKVGCP72 | resource | googlecontainernode_pool | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | | | 2252 | CKVGCP73 | resource | googlecomputesecurity_policy | Ensure Cloud Armor prevents message lookup in

See CVE-2021-44228 aka log4jshell | Terraform | | | 2253 | CKVGCP74 | resource | googlecomputesubnetwork | Ensure that privateipgoogle_access is enabled for Subnet | Terraform | | | 2254 | CKVGCP75 | resource | googlecomputefirewall | Ensure Google compute firewall ingress does not allow unrestricted FTP access | Terraform | | | 2255 | CKVGCP76 | resource | googlecomputesubnetwork | Ensure that Private google access is enabled for IPV6 | Terraform | | | 2256 | CKVGCP77 | resource | googlecomputefirewall | Ensure Google compute firewall ingress does not allow on ftp port | Terraform | | | 2257 | CKVGCP78 | resource | googlestoragebucket | Ensure Cloud storage has versioning enabled | Terraform | | | 2258 | CKVGCP79 | resource | googlesqldatabase_instance | Ensure SQL database is using latest Major version | Terraform | | | 2259 | CKVGCP80 | resource | googlebigquerytable | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2260 | CKVGCP81 | resource | googlebigquerydataset | Ensure Big Query Datasets are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2261 | CKVGCP82 | resource | googlekmscrypto_key | Ensure KMS keys are protected from deletion | Terraform | | | 2262 | CKVGCP83 | resource | googlepubsubtopic | Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2263 | CKVGCP84 | resource | googleartifactregistry_repository | Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2264 | CKVGCP85 | resource | googlebigtableinstance | Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2265 | CKVGCP86 | resource | googlecloudbuildworker_pool | Ensure Cloud build workers are private | Terraform | | | 2266 | CKVGCP87 | resource | googledatafusion_instance | Ensure Data fusion instances are private | Terraform | | | 2267 | CKVGCP88 | resource | googlecomputefirewall | Ensure Google compute firewall ingress does not allow unrestricted mysql access | Terraform | | | 2268 | CKVGCP89 | resource | googlenotebooksinstance | Ensure Vertex AI instances are private | Terraform | | | 2269 | CKVGCP90 | resource | googledataflowjob | Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2270 | CKVGCP91 | resource | googledataproccluster | Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2271 | CKVGCP92 | resource | googlevertexai_dataset | Ensure Vertex AI datasets uses a CMK (Customer Managed Key) | Terraform | | | 2272 | CKVGCP93 | resource | googlespannerdatabase | Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | | | 2273 | CKVGCP94 | resource | googledataflowjob | Ensure Dataflow jobs are private | Terraform | | | 2274 | CKVGCP95 | resource | googleredisinstance | Ensure Memorystore for Redis has AUTH enabled | Terraform | | | 2275 | CKVGCP96 | resource | googlevertexaimetadatastore | Ensure Vertex AI Metadata Store uses a CMK (Customer Managed Key) | Terraform | | | 2276 | CKVGCP97 | resource | googleredisinstance | Ensure Memorystore for Redis uses intransit encryption | Terraform | | | 2277 | CKVGCP98 | resource | googledataprocclusteriambinding | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | | | 2278 | CKVGCP98 | resource | googledataprocclusteriammember | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | | | 2279 | CKVGCP99 | resource | googlepubsubtopiciambinding | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | | | 2280 | CKVGCP99 | resource | googlepubsubtopiciammember | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | | | 2281 | CKVGCP100 | resource | googlebigquerytableiambinding | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | | | 2282 | CKVGCP100 | resource | googlebigquerytableiammember | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | | | 2283 | CKVGCP101 | resource | googleartifactregistryrepositoryiam_binding | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | | | 2284 | CKVGCP101 | resource | googleartifactregistryrepositoryiam_member | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | | | 2285 | CKVGCP102 | resource | googlecloudrunserviceiam_binding | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | | | 2286 | CKVGCP102 | resource | googlecloudrunserviceiam_member | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | | | 2287 | CKVGCP103 | resource | googledataproccluster | Ensure Dataproc Clusters do not have public IPs | Terraform | | | 2288 | CKVGCP104 | resource | googledatafusion_instance | Ensure Datafusion has stack driver logging enabled | Terraform | | | 2289 | CKVGCP105 | resource | googledatafusion_instance | Ensure Datafusion has stack driver monitoring enabled | Terraform | | | 2290 | CKVGCP106 | resource | googlecomputefirewall | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access | Terraform | | | 2291 | CKVGCP107 | resource | googlecloudfunctions2functioniambinding | Cloud functions should not be public | Terraform | | | 2292 | CKVGCP107 | resource | googlecloudfunctions2functioniammember | Cloud functions should not be public | Terraform | | | 2293 | CKVGCP107 | resource | googlecloudfunctionsfunctioniambinding | Cloud functions should not be public | Terraform | | | 2294 | CKVGCP107 | resource | googlecloudfunctionsfunctioniammember | Cloud functions should not be public | Terraform | | | 2295 | CKVGCP108 | resource | googlesqldatabase_instance | Ensure hostnames are logged for GCP PostgreSQL databases | Terraform | | | 2296 | CKVGCP109 | resource | googlesqldatabase_instance | Ensure the GCP PostgreSQL database log levels are set to ERROR or lower | Terraform | | | 2297 | CKVGCP110 | resource | googlesqldatabase_instance | Ensure pgAudit is enabled for your GCP PostgreSQL database | Terraform | | | 2298 | CKVGCP111 | resource | googlesqldatabase_instance | Ensure GCP PostgreSQL logs SQL statements | Terraform | | | 2299 | CKVGCP112 | resource | googlekmscryptokeyiam_binding | Esnure KMS policy should not allow public access | Terraform | | | 2300 | CKVGCP112 | resource | googlekmscryptokeyiam_member | Esnure KMS policy should not allow public access | Terraform | | | 2301 | CKVGCP112 | resource | googlekmscryptokeyiam_policy | Esnure KMS policy should not allow public access | Terraform | | | 2302 | CKVGCP113 | data | googleiampolicy | Ensure IAM policy should not define public access | Terraform | | | 2303 | CKVGCP114 | resource | googlestoragebucket | Ensure public access prevention is enforced on Cloud Storage bucket | Terraform | | | 2304 | CKVGCP115 | resource | googleorganizationiam_binding | Ensure basic roles are not used at organization level. | Terraform | | | 2305 | CKVGCP115 | resource | googleorganizationiam_member | Ensure basic roles are not used at organization level. | Terraform | | | 2306 | CKVGCP116 | resource | googlefolderiam_binding | Ensure basic roles are not used at folder level. | Terraform | | | 2307 | CKVGCP116 | resource | googlefolderiam_member | Ensure basic roles are not used at folder level. | Terraform | | | 2308 | CKVGCP117 | resource | googleprojectiam_binding | Ensure basic roles are not used at project level. | Terraform | | | 2309 | CKVGCP117 | resource | googleprojectiam_member | Ensure basic roles are not used at project

| Terraform | | | 2310 | CKVGCP118 | resource | googleiamworkloadidentitypool_provider | Ensure IAM workload identity pool provider is restricted | Terraform | | | 2311 | CKVGCP119 | resource | googlespannerdatabase | Ensure Spanner Database has deletion protection enabled | Terraform | | | 2312 | CKVGCP120 | resource | googlespannerdatabase | Ensure Spanner Database has drop protection enabled | Terraform | | | 2313 | CKVGCP121 | resource | googlebigquerytable | Ensure BigQuery tables have deletion protection enabled | Terraform | | | 2314 | CKVGCP122 | resource | googlebigtableinstance | Ensure Big Table Instances have deletion protection enabled | Terraform | | | 2315 | CKVGCP123 | resource | googlecontainercluster | GKE Don't Use NodePools in the Cluster configuration | Terraform | | | 2316 | CKVGCP124 | resource | googlecloudfunctions2function | Ensure GCP Cloud Function is not configured with overly permissive Ingress setting | Terraform | | | 2317 | CKVGCP124 | resource | googlecloudfunctionsfunction | Ensure GCP Cloud Function is not configured with overly permissive Ingress setting | Terraform | | | 2318 | CKV2GCP1 | resource | googleprojectdefaultserviceaccounts | Ensure GKE clusters are not running using the Compute Engine default service account | Terraform | | | 2319 | CKV2GCP2 | resource | googlecomputenetwork | Ensure legacy networks do not exist for a project | Terraform | | | 2320 | CKV2GCP3 | resource | googleserviceaccount_key | Ensure that there are only GCP-managed service account keys for each service account | Terraform | | | 2321 | CKV2GCP4 | resource | googleloggingfolder_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | | | 2322 | CKV2GCP4 | resource | googleloggingorganization_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | | | 2323 | CKV2GCP4 | resource | googleloggingproject_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | | | 2324 | CKV2GCP4 | resource | googlestoragebucket | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | | | 2325 | CKV2GCP5 | resource | google_project | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | | | 2326 | CKV2GCP5 | resource | googleprojectiamauditconfig | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | | | 2327 | CKV2GCP6 | resource | googlekmscrypto_key | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | | | 2328 | CKV2GCP6 | resource | googlekmscryptokeyiam_binding | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | | | 2329 | CKV2GCP6 | resource | googlekmscryptokeyiam_member | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | | | 2330 | CKV2GCP7 | resource | googlesqldatabase_instance | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | | | 2331 | CKV2GCP7 | resource | googlesqluser | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | | | 2332 | CKV2GCP8 | resource | googlekmskey_ring | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | | | 2333 | CKV2GCP8 | resource | googlekmskeyringiam_binding | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | | | 2334 | CKV2GCP8 | resource | googlekmskeyringiam_member | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | | | 2335 | CKV2GCP9 | resource | googlecontainerregistry | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | | | 2336 | CKV2GCP9 | resource | googlestoragebucketiambinding | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | | | 2337 | CKV2GCP9 | resource | googlestoragebucketiammember | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | | | 2338 | CKV2GCP10 | resource | googlecloudfunctionsfunction | Ensure GCP Cloud Function HTTP trigger is secured | Terraform | | | 2339 | CKV2GCP11 | resource | googleprojectservices | Ensure GCP GCR Container Vulnerability Scanning is enabled | Terraform | | | 2340 | CKV2GCP12 | resource | googlecomputefirewall | Ensure GCP compute firewall ingress does not allow unrestricted access to all ports | Terraform | | | 2341 | CKV2GCP13 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database flag 'logduration' is set to 'on' | Terraform | | | 2342 | CKV2GCP14 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database flag 'logexecutor_stats' is set to 'off' | Terraform | | | 2343 | CKV2GCP15 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database flag 'logparser_stats' is set to 'off' | Terraform | | | 2344 | CKV2GCP16 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database flag 'logplanner_stats' is set to 'off' | Terraform | | | 2345 | CKV2GCP17 | resource | googlesqldatabaseinstance | Ensure PostgreSQL database flag 'logstatement_stats' is set to 'off' | Terraform | | | 2346 | CKV2GCP18 | resource | googlecomputenetwork | Ensure GCP network defines a firewall and does not use the default firewall | Terraform | | | 2347 | CKV2GCP19 | resource | googlecontainercluster | Ensure GCP Kubernetes engine clusters have 'alpha cluster' feature disabled | Terraform | | | 2348 | CKV2GCP20 | resource | googlesqldatabase_instance | Ensure MySQL DB instance has point-in-time recovery backup configured | Terraform | | | 2349 | CKV2GCP21 | resource | googlenotebooksinstance | Ensure Vertex AI instance disks are encrypted with a Customer Managed Key (CMK) | Terraform | | | 2350 | CKV2GCP22 | resource | googledocumentai_processor | Ensure Document AI Processors are encrypted with a Customer Managed Key (CMK) | Terraform | | | 2351 | CKV2GCP23 | resource | googledocumentaiwarehouselocation | Ensure Document AI Warehouse Location is configured to use a Customer Managed Key (CMK) | Terraform | | | 2352 | CKV2GCP24 | resource | googlevertexai_endpoint | Ensure Vertex AI endpoint uses a Customer Managed Key (CMK) | Terraform | | | 2353 | CKV2GCP25 | resource | googlevertexai_featurestore | Ensure Vertex AI featurestore uses a Customer Managed Key (CMK) | Terraform | | | 2354 | CKV2GCP26 | resource | googlevertexai_tensorboard | Ensure Vertex AI tensorboard uses a Customer Managed Key (CMK) | Terraform | | | 2355 | CKV2GCP27 | resource | googleworkbenchinstance | Ensure Vertex AI workbench instance disks are encrypted with a Customer Managed Key (CMK) | Terraform | | | 2356 | CKV2GCP28 | resource | googleworkbenchinstance | Ensure Vertex AI workbench instances are private | Terraform | | | 2357 | CKV2GCP29 | resource | googledialogflowagent | Ensure logging is enabled for Dialogflow agents | Terraform | | | 2358 | CKV2GCP30 | resource | googledialogflowcx_agent | Ensure logging is enabled for Dialogflow CX agents | Terraform | | | 2359 | CKV2GCP31 | resource | googledialogflowcx_webhook | Ensure logging is enabled for Dialogflow CX webhooks | Terraform | | | 2360 | CKV2GCP32 | resource | googletpuv2_vm | Ensure TPU v2 is private | Terraform | | | 2361 | CKV2GCP33 | resource | googlevertexai_endpoint | Ensure Vertex AI endpoint is private | Terraform | | | 2362 | CKV2GCP34 | resource | googlevertexaiindexendpoint | Ensure Vertex AI index endpoint is private | Terraform | | | 2363 | CKV2GCP35 | resource | googlenotebooksruntime | Ensure Vertex AI runtime is encrypted with a Customer Managed Key (CMK) | Terraform | | | 2364 | CKV2GCP36 | resource | googlenotebooksruntime | Ensure Vertex AI runtime is private | Terraform | | | 2365 | CKVGHA1 | jobs | jobs | Ensure ACTIONSALLOWUNSECURECOMMANDS isn't true on environment variables | githubactions | | | 2366 | CKVGHA1 | jobs | jobs.*.steps | | 2367 | CKVGHA2 | jobs | jobs | Ensure run commands are not vulnerable to shell injection | github_actions | | | 2368 | CKVGHA2 | jobs | jobs.*.steps | | 2369 | CKVGHA3 | jobs | jobs | Suspicious use of curl with secrets | github_actions | | | 2370 | CKVGHA3 | jobs | jobs.*.steps | | 2371 | CKVGHA4 | jobs | jobs | Suspicious use of netcat with IP address | github_actions | | | 2372 | CKVGHA4 | jobs | jobs.*.steps | | 2373 | CKVGHA5 | jobs | jobs | Found artifact build without evidence of cosign sign execution in pipeline | github_actions | | | 2374 | CKVGHA6 | jobs | jobs | Found artifact build without evidence of cosign sbom attestation in pipeline | github_actions | | | 2375 | CKVGHA7 | jobs | on | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflowdispatch inputs MUST be

| githubactions | | | 2376 | CKV2GHA1 | resource | permissions | Ensure top-level permissions are not set to write-all | github_actions | | | 2377 | CKVGIT1 | resource | github_repository | Ensure GitHub repository is Private | Terraform | | | 2378 | CKVGIT2 | resource | githubrepositorywebhook | Ensure GitHub repository webhooks are using HTTPS | Terraform | | | 2379 | CKVGIT3 | resource | github_repository | Ensure GitHub repository has vulnerability alerts enabled | Terraform | | | 2380 | CKVGIT4 | resource | githubactionsenvironment_secret | Ensure GitHub Actions secrets are encrypted | Terraform | | | 2381 | CKVGIT4 | resource | githubactionsorganization_secret | Ensure GitHub Actions secrets are encrypted | Terraform | | | 2382 | CKVGIT4 | resource | githubactionssecret | Ensure GitHub Actions secrets are encrypted | Terraform | | | 2383 | CKVGIT5 | resource | githubbranchprotection | GitHub pull requests should require at least 2 approvals | Terraform | | | 2384 | CKVGIT5 | resource | githubbranchprotection_v3 | GitHub pull requests should require at least 2 approvals | Terraform | | | 2385 | CKVGIT6 | resource | githubbranchprotection | Ensure GitHub branch protection rules requires signed commits | Terraform | | | 2386 | CKVGIT6 | resource | githubbranchprotection_v3 | Ensure GitHub branch protection rules requires signed commits | Terraform | | | 2387 | CKV2GIT1 | resource | github_repository | Ensure each Repository has branch protection associated | Terraform | | | 2388 | CKVGITHUB1 | githubconfiguration | * | Ensure GitHub organization security settings require 2FA | githubconfiguration | | | 2389 | CKVGITHUB2 | githubconfiguration | * | Ensure GitHub organization security settings require SSO | githubconfiguration | | | 2390 | CKVGITHUB3 | githubconfiguration | * | Ensure GitHub organization security settings has IP allow list enabled | githubconfiguration | | | 2391 | CKVGITHUB4 | githubconfiguration | * | Ensure GitHub branch protection rules requires signed commits | githubconfiguration | | | 2392 | CKVGITHUB5 | githubconfiguration | * | Ensure GitHub branch protection rules does not allow force pushes | githubconfiguration | | | 2393 | CKVGITHUB6 | githubconfiguration | * | Ensure GitHub organization webhooks are using HTTPS | githubconfiguration | | | 2394 | CKVGITHUB7 | githubconfiguration | * | Ensure GitHub repository webhooks are using HTTPS | githubconfiguration | | | 2395 | CKVGITHUB8 | githubconfiguration | * | Ensure GitHub branch protection rules requires linear history | githubconfiguration | | | 2396 | CKVGITHUB9 | githubconfiguration | * | Ensure 2 admins are set for each repository | githubconfiguration | | | 2397 | CKVGITHUB10 | githubconfiguration | * | Ensure branch protection rules are enforced on administrators | githubconfiguration | | | 2398 | CKVGITHUB11 | githubconfiguration | * | Ensure GitHub branch protection dismisses stale review on new commit | githubconfiguration | | | 2399 | CKVGITHUB12 | githubconfiguration | * | Ensure GitHub branch protection restricts who can dismiss PR reviews | githubconfiguration | | | 2400 | CKVGITHUB13 | githubconfiguration | * | Ensure GitHub branch protection requires CODEOWNER reviews | githubconfiguration | | | 2401 | CKVGITHUB14 | githubconfiguration | * | Ensure all checks have passed before the merge of new code | githubconfiguration | | | 2402 | CKVGITHUB15 | githubconfiguration | * | Ensure inactive branches are reviewed and removed periodically | githubconfiguration | | | 2403 | CKVGITHUB16 | githubconfiguration | * | Ensure GitHub branch protection requires conversation resolution | githubconfiguration | | | 2404 | CKVGITHUB17 | githubconfiguration | * | Ensure GitHub branch protection requires push restrictions | githubconfiguration | | | 2405 | CKVGITHUB18 | githubconfiguration | * | Ensure GitHub branch protection rules does not allow deletions | githubconfiguration | | | 2406 | CKVGITHUB19 | githubconfiguration | * | Ensure any change to code receives approval of two strongly authenticated users | githubconfiguration | | | 2407 | CKVGITHUB20 | githubconfiguration | * | Ensure open git branches are up to date before they can be merged into codebase | githubconfiguration | | | 2408 | CKVGITHUB21 | githubconfiguration | * | Ensure public repository creation is limited to specific members | githubconfiguration | | | 2409 | CKVGITHUB22 | githubconfiguration | * | Ensure private repository creation is limited to specific members | githubconfiguration | | | 2410 | CKVGITHUB23 | githubconfiguration | * | Ensure internal repository creation is limited to specific members | githubconfiguration | | | 2411 | CKVGITHUB26 | githubconfiguration | * | Ensure minimum admins are set for the organization | githubconfiguration | | | 2412 | CKVGITHUB27 | githubconfiguration | * | Ensure strict base permissions are set for repositories | githubconfiguration | | | 2413 | CKVGITHUB28 | githubconfiguration | * | Ensure an organization's identity is confirmed with a Verified badge Passed | githubconfiguration | | | 2414 | CKVGITLAB1 | gitlabconfiguration | * | Merge requests should require at least 2 approvals | gitlabconfiguration | | | 2415 | CKVGITLAB2 | gitlabconfiguration | * | Ensure all Gitlab groups require two factor authentication | gitlabconfiguration | | | 2416 | CKVGITLABCI1 | jobs | *.script | | 2417 | CKVGITLABCI2 | jobs | *.rules | Avoid creating rules that generate double pipelines | gitlab_ci | | | 2418 | CKVGITLABCI3 | jobs | *.image | | 2419 | CKVGITLABCI3 | jobs |

| | 2420 | CKVGLB1 | resource | gitlab_project | Ensure at least two approving reviews are required to merge a GitLab MR | Terraform | | | 2421 | CKVGLB2 | resource | gitlabbranchprotection | Ensure GitLab branch protection rules does not allow force pushes | Terraform | | | 2422 | CKVGLB3 | resource | gitlab_project | Ensure GitLab prevent secrets is enabled | Terraform | | | 2423 | CKVGLB4 | resource | gitlab_project | Ensure GitLab commits are signed | Terraform | | | 2424 | CKV2IBM1 | resource | ibmislb | Ensure load balancer for VPC is private (disable public access) | Terraform | | | 2425 | CKV2IBM2 | resource | ibmisvpc | Ensure VPC classic access is disabled | Terraform | | | 2426 | CKV2IBM3 | resource | ibmiamaccount_settings | Ensure API key creation is restricted in account settings | Terraform | | | 2427 | CKV2IBM4 | resource | ibmiamaccount_settings | Ensure Multi-Factor Authentication (MFA) is enabled at the account level | Terraform | | | 2428 | CKV2IBM5 | resource | ibmiamaccount_settings | Ensure Service ID creation is restricted in account settings | Terraform | | | 2429 | CKV2IBM6 | resource | ibm_database | Ensure Databases network access is restricted to a specific IP range | Terraform | | | 2430 | CKV2IBM7 | resource | ibmcontainercluster | Ensure Kubernetes clusters are accessible by using private endpoint and NOT public endpoint | Terraform | | | 2431 | CKVK8S1 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host process ID namespace | Kubernetes | | | 2432 | CKVK8S1 | resource | kubernetespodsecurity_policy | Do not admit containers wishing to share the host process ID namespace | Terraform | | | 2433 | CKVK8S2 | resource | PodSecurityPolicy | Do not admit privileged containers | Kubernetes | | | 2434 | CKVK8S2 | resource | kubernetespodsecurity_policy | Do not admit privileged containers | Terraform | | | 2435 | CKVK8S3 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host IPC namespace | Kubernetes | | | 2436 | CKVK8S3 | resource | kubernetespodsecurity_policy | Do not admit containers wishing to share the host IPC namespace | Terraform | | | 2437 | CKVK8S4 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host network namespace | Kubernetes | | | 2438 | CKVK8S4 | resource | kubernetespodsecurity_policy | Do not admit containers wishing to share the host network namespace | Terraform | | | 2439 | CKVK8S5 | resource | PodSecurityPolicy | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2440 | CKVK8S5 | resource | kubernetespodsecurity_policy | Containers should not run with allowPrivilegeEscalation | Terraform | | | 2441 | CKVK8S6 | resource | PodSecurityPolicy | Do not admit root containers | Kubernetes | | | 2442 | CKVK8S6 | resource | kubernetespodsecurity_policy | Do not admit root containers | Terraform | | | 2443 | CKVK8S7 | resource | PodSecurityPolicy | Do not admit containers with the NET_RAW capability | Kubernetes | | | 2444 | CKVK8S7 | resource | kubernetespodsecuritypolicy | Do not admit containers with the NETRAW capability | Terraform | | | 2445 | CKVK8S8 | resource | DaemonSet | Liveness Probe Should be Configured | Kubernetes | | | 2446 | CKVK8S8 | resource | Deployment | Liveness Probe Should be Configured | Kubernetes | | | 2447 | CKVK8S8 | resource | DeploymentConfig | Liveness Probe Should be Configured | Kubernetes | | | 2448 | CKVK8S8 | resource | Pod | Liveness Probe Should be Configured | Kubernetes | | | 2449 | CKVK8S8 | resource | PodTemplate | Liveness Probe Should be Configured | Kubernetes | | | 2450 | CKVK8S8 | resource | ReplicaSet | Liveness Probe Should be Configured | Kubernetes | | | 2451 | CKVK8S8 | resource | ReplicationController | Liveness Probe Should be Configured | Kubernetes | | | 2452 | CKVK8S8 | resource | StatefulSet | Liveness Probe Should be Configured | Kubernetes | | | 2453 | CKVK8S8 | resource | kubernetes_deployment | Liveness Probe Should be Configured | Terraform | | | 2454 | CKVK8S8 | resource | kubernetesdeploymentv1 | Liveness Probe Should be Configured | Terraform | | | 2455 | CKVK8S8 | resource | kubernetes_pod | Liveness Probe Should be Configured | Terraform | | | 2456 | CKVK8S8 | resource | kubernetespodv1 | Liveness Probe Should be Configured | Terraform | | | 2457 | CKVK8S9 | resource | DaemonSet | Readiness Probe Should be Configured | Kubernetes | | | 2458 | CKVK8S9 | resource | Deployment | Readiness Probe Should be Configured | Kubernetes | | | 2459 | CKVK8S9 | resource | DeploymentConfig | Readiness Probe Should be Configured | Kubernetes | | | 2460 | CKVK8S9 | resource | Pod | Readiness Probe Should be Configured | Kubernetes | | | 2461 | CKVK8S9 | resource | PodTemplate | Readiness Probe Should be Configured | Kubernetes | | | 2462 | CKVK8S9 | resource | ReplicaSet | Readiness Probe Should be Configured | Kubernetes | | | 2463 | CKVK8S9 | resource | ReplicationController | Readiness Probe Should be Configured | Kubernetes | | | 2464 | CKVK8S9 | resource | StatefulSet | Readiness Probe Should be Configured | Kubernetes | | | 2465 | CKVK8S9 | resource | kubernetes_deployment | Readiness Probe Should be Configured | Terraform | | | 2466 | CKVK8S9 | resource | kubernetesdeploymentv1 | Readiness Probe Should be Configured | Terraform | | | 2467 | CKVK8S9 | resource | kubernetes_pod | Readiness Probe Should be Configured | Terraform | | | 2468 | CKVK8S9 | resource | kubernetespodv1 | Readiness Probe Should be Configured | Terraform | | | 2469 | CKVK8S10 | resource | CronJob | CPU requests should be set | Kubernetes | | | 2470 | CKVK8S10 | resource | DaemonSet | CPU requests should be set | Kubernetes | | | 2471 | CKVK8S10 | resource | Deployment | CPU requests should be set | Kubernetes | | | 2472 | CKVK8S10 | resource | DeploymentConfig | CPU requests should be set | Kubernetes | | | 2473 | CKVK8S10 | resource | Job | CPU requests should be set | Kubernetes | | | 2474 | CKVK8S10 | resource | Pod | CPU requests should be set | Kubernetes | | | 2475 | CKVK8S10 | resource | PodTemplate | CPU requests should be set | Kubernetes | | | 2476 | CKVK8S10 | resource | ReplicaSet | CPU requests should be set | Kubernetes | | | 2477 | CKVK8S10 | resource | ReplicationController | CPU requests should be set | Kubernetes | | | 2478 | CKVK8S10 | resource | StatefulSet | CPU requests should be set | Kubernetes | | | 2479 | CKVK8S10 | resource | kubernetes_deployment | CPU requests should be set | Terraform | | | 2480 | CKVK8S10 | resource | kubernetesdeploymentv1 | CPU requests should be set | Terraform | | | 2481 | CKVK8S10 | resource | kubernetes_pod | CPU requests should be set | Terraform | | | 2482 | CKVK8S10 | resource | kubernetespodv1 | CPU requests should be set | Terraform | | | 2483 | CKVK8S11 | resource | CronJob | CPU limits should be set | Kubernetes | | | 2484 | CKVK8S11 | resource | DaemonSet | CPU limits should be set | Kubernetes | | | 2485 | CKVK8S11 | resource | Deployment | CPU limits should be set | Kubernetes | | | 2486 | CKVK8S11 | resource | DeploymentConfig | CPU limits should be set | Kubernetes | | | 2487 | CKVK8S11 | resource | Job | CPU limits should be set | Kubernetes | | | 2488 | CKVK8S11 | resource | Pod | CPU limits should be set | Kubernetes | | | 2489 | CKVK8S11 | resource | PodTemplate | CPU limits should be set | Kubernetes | | | 2490 | CKVK8S11 | resource | ReplicaSet | CPU limits should be set | Kubernetes | | | 2491 | CKVK8S11 | resource | ReplicationController | CPU limits should be set | Kubernetes | | | 2492 | CKVK8S11 | resource | StatefulSet | CPU limits should be set | Kubernetes | | | 2493 | CKVK8S11 | resource | kubernetes_deployment | CPU Limits should be set | Terraform | | | 2494 | CKVK8S11 | resource | kubernetesdeploymentv1 | CPU Limits should be set | Terraform | | | 2495 | CKVK8S11 | resource | kubernetes_pod | CPU Limits should be set | Terraform | | | 2496 | CKVK8S11 | resource | kubernetespodv1 | CPU Limits should be set | Terraform | | | 2497 | CKVK8S12 | resource | CronJob | Memory requests should be set | Kubernetes | | | 2498 | CKVK8S12 | resource | DaemonSet | Memory requests should be set | Kubernetes | | | 2499 | CKVK8S12 | resource | Deployment | Memory requests should be set | Kubernetes | | | 2500 | CKVK8S12 | resource | DeploymentConfig | Memory requests should be set | Kubernetes | | | 2501 | CKVK8S12 | resource | Job | Memory requests should be set | Kubernetes | | | 2502 | CKVK8S12 | resource | Pod | Memory requests should be set | Kubernetes | | | 2503 | CKVK8S12 | resource | PodTemplate | Memory requests should be set | Kubernetes | | | 2504 | CKVK8S12 | resource | ReplicaSet | Memory requests should be set | Kubernetes | | | 2505 | CKVK8S12 | resource | ReplicationController | Memory requests should be set | Kubernetes | | | 2506 | CKVK8S12 | resource | StatefulSet | Memory requests should be set | Kubernetes | | | 2507 | CKVK8S12 | resource | kubernetes_deployment | Memory Limits should be set | Terraform | | | 2508 | CKVK8S12 | resource | kubernetesdeploymentv1 | Memory Limits should be set | Terraform | | | 2509 | CKVK8S12 | resource | kubernetes_pod | Memory Limits should be set | Terraform | | | 2510 | CKVK8S12 | resource | kubernetespodv1 | Memory Limits should be set | Terraform | | | 2511 | CKVK8S13 | resource | CronJob | Memory limits should be set | Kubernetes | | | 2512 | CKVK8S13 | resource | DaemonSet | Memory limits should be set | Kubernetes | | | 2513 | CKVK8S13 | resource | Deployment | Memory limits should be set | Kubernetes | | | 2514 | CKVK8S13 | resource | DeploymentConfig | Memory limits should be set | Kubernetes | | | 2515 | CKVK8S13 | resource | Job | Memory limits should be set | Kubernetes | | | 2516 | CKVK8S13 | resource | Pod | Memory limits should be set | Kubernetes | | | 2517 | CKVK8S13 | resource | PodTemplate | Memory limits should be set | Kubernetes | | | 2518 | CKVK8S13 | resource | ReplicaSet | Memory limits should be set | Kubernetes | | | 2519 | CKVK8S13 | resource | ReplicationController | Memory limits should be set | Kubernetes | | | 2520 | CKVK8S13 | resource | StatefulSet | Memory limits should be set | Kubernetes | | | 2521 | CKVK8S13 | resource | kubernetes_deployment | Memory requests should be set | Terraform | | | 2522 | CKVK8S13 | resource | kubernetesdeploymentv1 | Memory requests should be set | Terraform | | | 2523 | CKVK8S13 | resource | kubernetes_pod | Memory requests should be set | Terraform | | | 2524 | CKVK8S13 | resource | kubernetespodv1 | Memory requests should be set | Terraform | | | 2525 | CKVK8S14 | resource | CronJob | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2526 | CKVK8S14 | resource | DaemonSet | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2527 | CKVK8S14 | resource | Deployment | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2528 | CKVK8S14 | resource | DeploymentConfig | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2529 | CKVK8S14 | resource | Job | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2530 | CKVK8S14 | resource | Pod | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2531 | CKVK8S14 | resource | PodTemplate | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2532 | CKVK8S14 | resource | ReplicaSet | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2533 | CKVK8S14 | resource | ReplicationController | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2534 | CKVK8S14 | resource | StatefulSet | Image Tag should be fixed - not latest or blank | Kubernetes | | | 2535 | CKVK8S14 | resource | kubernetes_deployment | Image Tag should be fixed - not latest or blank | Terraform | | | 2536 | CKVK8S14 | resource | kubernetesdeploymentv1 | Image Tag should be fixed - not latest or blank | Terraform | | | 2537 | CKVK8S14 | resource | kubernetes_pod | Image Tag should be fixed - not latest or blank | Terraform | | | 2538 | CKVK8S14 | resource | kubernetespodv1 | Image Tag should be fixed - not latest or blank | Terraform | | | 2539 | CKVK8S15 | resource | CronJob | Image Pull Policy should be Always | Kubernetes | | | 2540 | CKVK8S15 | resource | DaemonSet | Image Pull Policy should be Always | Kubernetes | | | 2541 | CKVK8S15 | resource | Deployment | Image Pull Policy should be Always | Kubernetes | | | 2542 | CKVK8S15 | resource | DeploymentConfig | Image Pull Policy should be Always | Kubernetes | | | 2543 | CKVK8S15 | resource | Job | Image Pull Policy should be Always | Kubernetes | | | 2544 | CKVK8S15 | resource | Pod | Image Pull Policy should be Always | Kubernetes | | | 2545 | CKVK8S15 | resource | PodTemplate | Image Pull Policy should be Always | Kubernetes | | | 2546 | CKVK8S15 | resource | ReplicaSet | Image Pull Policy should be Always | Kubernetes | | | 2547 | CKVK8S15 | resource | ReplicationController | Image Pull Policy should be Always | Kubernetes | | | 2548 | CKVK8S15 | resource | StatefulSet | Image Pull Policy should be Always | Kubernetes | | | 2549 | CKVK8S15 | resource | kubernetes_deployment | Image Pull Policy should be Always | Terraform | | | 2550 | CKVK8S15 | resource | kubernetesdeploymentv1 | Image Pull Policy should be Always | Terraform | | | 2551 | CKVK8S15 | resource | kubernetes_pod | Image Pull Policy should be Always | Terraform | | | 2552 | CKVK8S15 | resource | kubernetespodv1 | Image Pull Policy should be Always | Terraform | | | 2553 | CKVK8S16 | resource | CronJob | Container should not be privileged | Kubernetes | | | 2554 | CKVK8S16 | resource | DaemonSet | Container should not be privileged | Kubernetes | | | 2555 | CKVK8S16 | resource | Deployment | Container should not be privileged | Kubernetes | | | 2556 | CKVK8S16 | resource | DeploymentConfig | Container should not be privileged | Kubernetes | | | 2557 | CKVK8S16 | resource | Job | Container should not be privileged | Kubernetes | | | 2558 | CKVK8S16 | resource | Pod | Container should not be privileged | Kubernetes | | | 2559 | CKVK8S16 | resource | PodTemplate | Container should not be privileged | Kubernetes | | | 2560 | CKVK8S16 | resource | ReplicaSet | Container should not be privileged | Kubernetes | | | 2561 | CKVK8S16 | resource | ReplicationController | Container should not be privileged | Kubernetes | | | 2562 | CKVK8S16 | resource | StatefulSet | Container should not be privileged | Kubernetes | | | 2563 | CKVK8S16 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | | | 2564 | CKVK8S16 | resource | kubernetesdeploymentv1 | Do not admit privileged containers | Terraform | | | 2565 | CKVK8S16 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | | | 2566 | CKVK8S16 | resource | kubernetespodv1 | Do not admit privileged containers | Terraform | | | 2567 | CKVK8S17 | resource | CronJob | Containers should not share the host process ID namespace | Kubernetes | | | 2568 | CKVK8S17 | resource | DaemonSet | Containers should not share the host process ID namespace | Kubernetes | | | 2569 | CKVK8S17 | resource | Deployment | Containers should not share the host process ID namespace | Kubernetes | | | 2570 | CKVK8S17 | resource | Job | Containers should not share the host process ID namespace | Kubernetes | | | 2571 | CKVK8S17 | resource | Pod | Containers should not share the host process ID namespace | Kubernetes | | | 2572 | CKVK8S17 | resource | ReplicaSet | Containers should not share the host process ID namespace | Kubernetes | | | 2573 | CKVK8S17 | resource | ReplicationController | Containers should not share the host process ID namespace | Kubernetes | | | 2574 | CKVK8S17 | resource | StatefulSet | Containers should not share the host process ID namespace | Kubernetes | | | 2575 | CKVK8S17 | resource | kubernetes_deployment | Do not admit containers wishing to share the host process ID namespace | Terraform | | | 2576 | CKVK8S17 | resource | kubernetesdeploymentv1 | Do not admit containers wishing to share the host process ID namespace | Terraform | | | 2577 | CKVK8S17 | resource | kubernetes_pod | Do not admit containers wishing to share the host process ID namespace | Terraform | | | 2578 | CKVK8S17 | resource | kubernetespodv1 | Do not admit containers wishing to share the host process ID namespace | Terraform | | | 2579 | CKVK8S18 | resource | CronJob | Containers should not share the host IPC namespace | Kubernetes | | | 2580 | CKVK8S18 | resource | DaemonSet | Containers should not share the host IPC namespace | Kubernetes | | | 2581 | CKVK8S18 | resource | Deployment | Containers should not share the host IPC namespace | Kubernetes | | | 2582 | CKVK8S18 | resource | Job | Containers should not share the host IPC namespace | Kubernetes | | | 2583 | CKVK8S18 | resource | Pod | Containers should not share the host IPC namespace | Kubernetes | | | 2584 | CKVK8S18 | resource | ReplicaSet | Containers should not share the host IPC namespace | Kubernetes | | | 2585 | CKVK8S18 | resource | ReplicationController | Containers should not share the host IPC namespace | Kubernetes | | | 2586 | CKVK8S18 | resource | StatefulSet | Containers should not share the host IPC namespace | Kubernetes | | | 2587 | CKVK8S18 | resource | kubernetes_deployment | Do not admit containers wishing to share the host IPC namespace | Terraform | | | 2588 | CKVK8S18 | resource | kubernetesdeploymentv1 | Do not admit containers wishing to share the host IPC namespace | Terraform | | | 2589 | CKVK8S18 | resource | kubernetes_pod | Do not admit containers wishing to share the host IPC namespace | Terraform | | | 2590 | CKVK8S18 | resource | kubernetespodv1 | Do not admit containers wishing to share the host IPC namespace | Terraform | | | 2591 | CKVK8S19 | resource | CronJob | Containers should not share the host network namespace | Kubernetes | | | 2592 | CKVK8S19 | resource | DaemonSet | Containers should not share the host network namespace | Kubernetes | | | 2593 | CKVK8S19 | resource | Deployment | Containers should not share the host network namespace | Kubernetes | | | 2594 | CKVK8S19 | resource | Job | Containers should not share the host network namespace | Kubernetes | | | 2595 | CKVK8S19 | resource | Pod | Containers should not share the host network namespace | Kubernetes | | | 2596 | CKVK8S19 | resource | ReplicaSet | Containers should not share the host network namespace | Kubernetes | | | 2597 | CKVK8S19 | resource | ReplicationController | Containers should not share the host network namespace | Kubernetes | | | 2598 | CKVK8S19 | resource | StatefulSet | Containers should not share the host network namespace | Kubernetes | | | 2599 | CKVK8S19 | resource | kubernetes_deployment | Do not admit containers wishing to share the host network namespace | Terraform | | | 2600 | CKVK8S19 | resource | kubernetesdeploymentv1 | Do not admit containers wishing to share the host network namespace | Terraform | | | 2601 | CKVK8S19 | resource | kubernetes_pod | Do not admit containers wishing to share the host network namespace | Terraform | | | 2602 | CKVK8S19 | resource | kubernetespodv1 | Do not admit containers wishing to share the host network namespace | Terraform | | | 2603 | CKVK8S20 | resource | CronJob | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2604 | CKVK8S20 | resource | DaemonSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2605 | CKVK8S20 | resource | Deployment | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2606 | CKVK8S20 | resource | DeploymentConfig | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2607 | CKVK8S20 | resource | Job | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2608 | CKVK8S20 | resource | Pod | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2609 | CKVK8S20 | resource | PodTemplate | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2610 | CKVK8S20 | resource | ReplicaSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2611 | CKVK8S20 | resource | ReplicationController | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2612 | CKVK8S20 | resource | StatefulSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | | | 2613 | CKVK8S20 | resource | kubernetes_deployment | Containers should not run with allowPrivilegeEscalation | Terraform | | | 2614 | CKVK8S20 | resource | kubernetesdeploymentv1 | Containers should not run with allowPrivilegeEscalation | Terraform | | | 2615 | CKVK8S20 | resource | kubernetes_pod | Containers should not run with allowPrivilegeEscalation | Terraform | | | 2616 | CKVK8S20 | resource | kubernetespodv1 | Containers should not run with allowPrivilegeEscalation | Terraform | | | 2617 | CKVK8S21 | resource | ConfigMap | The default namespace should not be used | Kubernetes | | | 2618 | CKVK8S21 | resource | CronJob | The default namespace should not be used | Kubernetes | | | 2619 | CKVK8S21 | resource | DaemonSet | The default namespace should not be used | Kubernetes | | | 2620 | CKVK8S21 | resource | Deployment | The default namespace should not be used | Kubernetes | | | 2621 | CKVK8S21 | resource | Ingress | The default namespace should not be used | Kubernetes | | | 2622 | CKVK8S21 | resource | Job | The default namespace should not be used | Kubernetes | | | 2623 | CKVK8S21 | resource | Pod | The default namespace should not be used | Kubernetes | | | 2624 | CKVK8S21 | resource | ReplicaSet | The default namespace should not be used | Kubernetes | | | 2625 | CKVK8S21 | resource | ReplicationController | The default namespace should not be used | Kubernetes | | | 2626 | CKVK8S21 | resource | Role | The default namespace should not be used | Kubernetes | | | 2627 | CKVK8S21 | resource | RoleBinding | The default namespace should not be used | Kubernetes | | | 2628 | CKVK8S21 | resource | Secret | The default namespace should not be used | Kubernetes | | | 2629 | CKVK8S21 | resource | Service | The default namespace should not be used | Kubernetes | | | 2630 | CKVK8S21 | resource | ServiceAccount | The default namespace should not be used | Kubernetes | | | 2631 | CKVK8S21 | resource | StatefulSet | The default namespace should not be used | Kubernetes | | | 2632 | CKVK8S21 | resource | kubernetesconfigmap | The default namespace should not be used | Terraform | | | 2633 | CKVK8S21 | resource | kubernetesconfigmap_v1 | The default namespace should not be used | Terraform | | | 2634 | CKVK8S21 | resource | kubernetescronjob | The default namespace should not be used | Terraform | | | 2635 | CKVK8S21 | resource | kubernetescronjob_v1 | The default namespace should not be used | Terraform | | | 2636 | CKVK8S21 | resource | kubernetesdaemonset_v1 | The default namespace should not be used | Terraform | | | 2637 | CKVK8S21 | resource | kubernetes_daemonset | The default namespace should not be used | Terraform | | | 2638 | CKVK8S21 | resource | kubernetes_deployment | The default namespace should not be used | Terraform | | | 2639 | CKVK8S21 | resource | kubernetesdeploymentv1 | The default namespace should not be used | Terraform | | | 2640 | CKVK8S21 | resource | kubernetes_ingress | The default namespace should not be used | Terraform | | | 2641 | CKVK8S21 | resource | kubernetesingressv1 | The default namespace should not be used | Terraform | | | 2642 | CKVK8S21 | resource | kubernetes_job | The default namespace should not be used | Terraform | | | 2643 | CKVK8S21 | resource | kubernetesjobv1 | The default namespace should not be used | Terraform | | | 2644 | CKVK8S21 | resource | kubernetes_pod | The default namespace should not be used | Terraform | | | 2645 | CKVK8S21 | resource | kubernetespodv1 | The default namespace should not be used | Terraform | | | 2646 | CKVK8S21 | resource | kubernetesreplicationcontroller | The default namespace should not be used | Terraform | | | 2647 | CKVK8S21 | resource | kubernetesreplicationcontroller_v1 | The default namespace should not be used | Terraform | | | 2648 | CKVK8S21 | resource | kubernetesrolebinding | The default namespace should not be used | Terraform | | | 2649 | CKVK8S21 | resource | kubernetesrolebinding_v1 | The default namespace should not be used | Terraform | | | 2650 | CKVK8S21 | resource | kubernetes_secret | The default namespace should not be used | Terraform | | | 2651 | CKVK8S21 | resource | kubernetessecretv1 | The default namespace should not be used | Terraform | | | 2652 | CKVK8S21 | resource | kubernetes_service | The default namespace should not be used | Terraform | | | 2653 | CKVK8S21 | resource | kubernetesserviceaccount | The default namespace should not be used | Terraform | | | 2654 | CKVK8S21 | resource | kubernetesserviceaccount_v1 | The default namespace should not be used | Terraform | | | 2655 | CKVK8S21 | resource | kubernetesservicev1 | The default namespace should not be used | Terraform | | | 2656 | CKVK8S21 | resource | kubernetesstatefulset | The default namespace should not be used | Terraform | | | 2657 | CKVK8S21 | resource | kubernetesstatefulset_v1 | The default namespace should not be used | Terraform | | | 2658 | CKVK8S22 | resource | CronJob | Use read-only filesystem for containers where possible | Kubernetes | | | 2659 | CKVK8S22 | resource | DaemonSet | Use read-only filesystem for containers where possible | Kubernetes | | | 2660 | CKVK8S22 | resource | Deployment | Use read-only filesystem for containers where possible | Kubernetes | | | 2661 | CKVK8S22 | resource | DeploymentConfig | Use read-only filesystem for containers where possible | Kubernetes | | | 2662 | CKVK8S22 | resource | Job | Use read-only filesystem for containers where possible | Kubernetes | | | 2663 | CKVK8S22 | resource | Pod | Use read-only filesystem for containers where possible | Kubernetes | | | 2664 | CKVK8S22 | resource | PodTemplate | Use read-only filesystem for containers where possible | Kubernetes | | | 2665 | CKVK8S22 | resource | ReplicaSet | Use read-only filesystem for containers where possible | Kubernetes | | | 2666 | CKVK8S22 | resource | ReplicationController | Use read-only filesystem for containers where possible | Kubernetes | | | 2667 | CKVK8S22 | resource | StatefulSet | Use read-only filesystem for containers where possible | Kubernetes | | | 2668 | CKVK8S22 | resource | kubernetes_deployment | Use read-only filesystem for containers where possible | Terraform | | | 2669 | CKVK8S22 | resource | kubernetesdeploymentv1 | Use read-only filesystem for containers where possible | Terraform | | | 2670 | CKVK8S22 | resource | kubernetes_pod | Use read-only filesystem for containers where possible | Terraform | | | 2671 | CKVK8S22 | resource | kubernetespodv1 | Use read-only filesystem for containers where possible | Terraform | | | 2672 | CKVK8S23 | resource | CronJob | Minimize the admission of root containers | Kubernetes | | | 2673 | CKVK8S23 | resource | DaemonSet | Minimize the admission of root containers | Kubernetes | | | 2674 | CKVK8S23 | resource | Deployment | Minimize the admission of root containers | Kubernetes | | | 2675 | CKVK8S23 | resource | Job | Minimize the admission of root containers | Kubernetes | | | 2676 | CKVK8S23 | resource | Pod | Minimize the admission of root containers | Kubernetes | | | 2677 | CKVK8S23 | resource | ReplicaSet | Minimize the admission of root containers | Kubernetes | | | 2678 | CKVK8S23 | resource | ReplicationController | Minimize the admission of root containers | Kubernetes | | | 2679 | CKVK8S23 | resource | StatefulSet | Minimize the admission of root containers | Kubernetes | | | 2680 | CKVK8S24 | resource | PodSecurityPolicy | Do not allow containers with added capability | Kubernetes | | | 2681 | CKVK8S24 | resource | kubernetespodsecurity_policy | Do not allow containers with added capability | Terraform | | | 2682 | CKVK8S25 | resource | CronJob | Minimize the admission of containers with added capability | Kubernetes | | | 2683 | CKVK8S25 | resource | DaemonSet | Minimize the admission of containers with added capability | Kubernetes | | | 2684 | CKVK8S25 | resource | Deployment | Minimize the admission of containers with added capability | Kubernetes | | | 2685 | CKVK8S25 | resource | DeploymentConfig | Minimize the admission of containers with added capability | Kubernetes | | | 2686 | CKVK8S25 | resource | Job | Minimize the admission of containers with added capability | Kubernetes | | | 2687 | CKVK8S25 | resource | Pod | Minimize the admission of containers with added capability | Kubernetes | | | 2688 | CKVK8S25 | resource | PodTemplate | Minimize the admission of containers with added capability | Kubernetes | | | 2689 | CKVK8S25 | resource | ReplicaSet | Minimize the admission of containers with added capability | Kubernetes | | | 2690 | CKVK8S25 | resource | ReplicationController | Minimize the admission of containers with added capability | Kubernetes | | | 2691 | CKVK8S25 | resource | StatefulSet | Minimize the admission of containers with added capability | Kubernetes | | | 2692 | CKVK8S25 | resource | kubernetes_deployment | Minimize the admission of containers with added capability | Terraform | | | 2693 | CKVK8S25 | resource | kubernetesdeploymentv1 | Minimize the admission of containers with added capability | Terraform | | | 2694 | CKVK8S25 | resource | kubernetes_pod | Minimize the admission of containers with added capability | Terraform | | | 2695 | CKVK8S25 | resource | kubernetespodv1 | Minimize the admission of containers with added capability | Terraform | | | 2696 | CKVK8S26 | resource | CronJob | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2697 | CKVK8S26 | resource | DaemonSet | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2698 | CKVK8S26 | resource | Deployment | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2699 | CKVK8S26 | resource | DeploymentConfig | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2700 | CKVK8S26 | resource | Job | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2701 | CKVK8S26 | resource | Pod | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2702 | CKVK8S26 | resource | PodTemplate | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2703 | CKVK8S26 | resource | ReplicaSet | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2704 | CKVK8S26 | resource | ReplicationController | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2705 | CKVK8S26 | resource | StatefulSet | Do not specify hostPort unless absolutely necessary | Kubernetes | | | 2706 | CKVK8S26 | resource | kubernetes_deployment | Do not specify hostPort unless absolutely necessary | Terraform | | | 2707 | CKVK8S26 | resource | kubernetesdeploymentv1 | Do not specify hostPort unless absolutely necessary | Terraform | | | 2708 | CKVK8S26 | resource | kubernetes_pod | Do not specify hostPort unless absolutely necessary | Terraform | | | 2709 | CKVK8S26 | resource | kubernetespodv1 | Do not specify hostPort unless absolutely necessary | Terraform | | | 2710 | CKVK8S27 | resource | CronJob | Do not expose the docker daemon socket to containers | Kubernetes | | | 2711 | CKVK8S27 | resource | DaemonSet | Do not expose the docker daemon socket to containers | Kubernetes | | | 2712 | CKVK8S27 | resource | Deployment | Do not expose the docker daemon socket to containers | Kubernetes | | | 2713 | CKVK8S27 | resource | Job | Do not expose the docker daemon socket to containers | Kubernetes | | | 2714 | CKVK8S27 | resource | Pod | Do not expose the docker daemon socket to containers | Kubernetes | | | 2715 | CKVK8S27 | resource | ReplicaSet | Do not expose the docker daemon socket to containers | Kubernetes | | | 2716 | CKVK8S27 | resource | ReplicationController | Do not expose the docker daemon socket to containers | Kubernetes | | | 2717 | CKVK8S27 | resource | StatefulSet | Do not expose the docker daemon socket to containers | Kubernetes | | | 2718 | CKVK8S27 | resource | kubernetesdaemonset_v1 | Do not expose the docker daemon socket to containers | Terraform | | | 2719 | CKVK8S27 | resource | kubernetes_daemonset | Do not expose the docker daemon socket to containers | Terraform | | | 2720 | CKVK8S27 | resource | kubernetes_deployment | Do not expose the docker daemon socket to containers | Terraform | | | 2721 | CKVK8S27 | resource | kubernetesdeploymentv1 | Do not expose the docker daemon socket to containers | Terraform | | | 2722 | CKVK8S27 | resource | kubernetes_pod | Do not expose the docker daemon socket to containers | Terraform | | | 2723 | CKVK8S27 | resource | kubernetespodv1 | Do not expose the docker daemon socket to containers | Terraform | | | 2724 | CKVK8S28 | resource | CronJob | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2725 | CKVK8S28 | resource | DaemonSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2726 | CKVK8S28 | resource | Deployment | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2727 | CKVK8S28 | resource | DeploymentConfig | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2728 | CKVK8S28 | resource | Job | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2729 | CKVK8S28 | resource | Pod | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2730 | CKVK8S28 | resource | PodTemplate | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2731 | CKVK8S28 | resource | ReplicaSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2732 | CKVK8S28 | resource | ReplicationController | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2733 | CKVK8S28 | resource | StatefulSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | | | 2734 | CKVK8S28 | resource | kubernetesdeployment | Minimize the admission of containers with the NETRAW capability | Terraform | | | 2735 | CKVK8S28 | resource | kubernetesdeploymentv1 | Minimize the admission of containers with the NET_RAW capability | Terraform | | | 2736 | CKVK8S28 | resource | kubernetespod | Minimize the admission of containers with the NETRAW capability | Terraform | | | 2737 | CKVK8S28 | resource | kubernetespodv1 | Minimize the admission of containers with the NET_RAW capability | Terraform | | | 2738 | CKVK8S29 | resource | CronJob | Apply security context to your pods and containers | Kubernetes | | | 2739 | CKVK8S29 | resource | DaemonSet | Apply security context to your pods and containers | Kubernetes | | | 2740 | CKVK8S29 | resource | Deployment | Apply security context to your pods and containers | Kubernetes | | | 2741 | CKVK8S29 | resource | Job | Apply security context to your pods and containers | Kubernetes | | | 2742 | CKVK8S29 | resource | Pod | Apply security context to your pods and containers | Kubernetes | | | 2743 | CKVK8S29 | resource | ReplicaSet | Apply security context to your pods and containers | Kubernetes | | | 2744 | CKVK8S29 | resource | ReplicationController | Apply security context to your pods and containers | Kubernetes | | | 2745 | CKVK8S29 | resource | StatefulSet | Apply security context to your pods and containers | Kubernetes | | | 2746 | CKVK8S29 | resource | kubernetesdaemonsetv1 | Apply security context to your pods, deployments and daemonsets | Terraform | | | 2747 | CKVK8S29 | resource | kubernetesdaemonset | Apply security context to your pods, deployments and daemonsets | Terraform | | | 2748 | CKVK8S29 | resource | kubernetesdeployment | Apply security context to your pods, deployments and daemonsets | Terraform | | | 2749 | CKVK8S29 | resource | kubernetesdeploymentv1 | Apply security context to your pods, deployments and daemon_sets | Terraform | | | 2750 | CKVK8S29 | resource | kubernetespod | Apply security context to your pods, deployments and daemonsets | Terraform | | | 2751 | CKVK8S29 | resource | kubernetespodv1 | Apply security context to your pods, deployments and daemon_sets | Terraform | | | 2752 | CKVK8S30 | resource | CronJob | Apply security context to your containers | Kubernetes | | | 2753 | CKVK8S30 | resource | DaemonSet | Apply security context to your containers | Kubernetes | | | 2754 | CKVK8S30 | resource | Deployment | Apply security context to your containers | Kubernetes | | | 2755 | CKVK8S30 | resource | DeploymentConfig | Apply security context to your containers | Kubernetes | | | 2756 | CKVK8S30 | resource | Job | Apply security context to your containers | Kubernetes | | | 2757 | CKVK8S30 | resource | Pod | Apply security context to your containers | Kubernetes | | | 2758 | CKVK8S30 | resource | PodTemplate | Apply security context to your containers | Kubernetes | | | 2759 | CKVK8S30 | resource | ReplicaSet | Apply security context to your containers | Kubernetes | | | 2760 | CKVK8S30 | resource | ReplicationController | Apply security context to your containers | Kubernetes | | | 2761 | CKVK8S30 | resource | StatefulSet | Apply security context to your containers | Kubernetes | | | 2762 | CKVK8S30 | resource | kubernetes_deployment | Apply security context to your pods and containers | Terraform | | | 2763 | CKVK8S30 | resource | kubernetesdeploymentv1 | Apply security context to your pods and containers | Terraform | | | 2764 | CKVK8S30 | resource | kubernetes_pod | Apply security context to your pods and containers | Terraform | | | 2765 | CKVK8S30 | resource | kubernetespodv1 | Apply security context to your pods and containers | Terraform | | | 2766 | CKVK8S31 | resource | CronJob | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | | | 2767 | CKVK8S31 | resource | DaemonSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | | | 2768 | CKVK8S31 | resource | Deployment | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | | | 2769 | CKVK8S31 | resource | Job | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | | | 2770 | CKVK8S31 | resource | Pod | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | | | 2771 | CKVK8S31 | resource | ReplicaSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | | | 2772 | CKVK8S31 | resource | ReplicationController | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | | | 2773 | CKVK8S31 | resource | StatefulSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | | | 2774 | CKVK8S32 | resource | PodSecurityPolicy | Ensure default seccomp profile set to docker/default or runtime/default | Kubernetes | | | 2775 | CKVK8S32 | resource | kubernetespodsecurity_policy | Ensure default seccomp profile set to docker/default or runtime/default | Terraform | | | 2776 | CKVK8S33 | resource | CronJob | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2777 | CKVK8S33 | resource | DaemonSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2778 | CKVK8S33 | resource | Deployment | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2779 | CKVK8S33 | resource | DeploymentConfig | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2780 | CKVK8S33 | resource | Job | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2781 | CKVK8S33 | resource | Pod | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2782 | CKVK8S33 | resource | PodTemplate | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2783 | CKVK8S33 | resource | ReplicaSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2784 | CKVK8S33 | resource | ReplicationController | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2785 | CKVK8S33 | resource | StatefulSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | | | 2786 | CKVK8S34 | resource | CronJob | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2787 | CKVK8S34 | resource | DaemonSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2788 | CKVK8S34 | resource | Deployment | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2789 | CKVK8S34 | resource | DeploymentConfig | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2790 | CKVK8S34 | resource | Job | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2791 | CKVK8S34 | resource | Pod | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2792 | CKVK8S34 | resource | PodTemplate | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2793 | CKVK8S34 | resource | ReplicaSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2794 | CKVK8S34 | resource | ReplicationController | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2795 | CKVK8S34 | resource | StatefulSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | | | 2796 | CKVK8S34 | resource | kubernetes_deployment | Ensure that Tiller (Helm v2) is not deployed | Terraform | | | 2797 | CKVK8S34 | resource | kubernetesdeploymentv1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | | | 2798 | CKVK8S34 | resource | kubernetes_pod | Ensure that Tiller (Helm v2) is not deployed | Terraform | | | 2799 | CKVK8S34 | resource | kubernetespodv1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | | | 2800 | CKVK8S35 | resource | CronJob | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2801 | CKVK8S35 | resource | DaemonSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2802 | CKVK8S35 | resource | Deployment | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2803 | CKVK8S35 | resource | DeploymentConfig | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2804 | CKVK8S35 | resource | Job | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2805 | CKVK8S35 | resource | Pod | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2806 | CKVK8S35 | resource | PodTemplate | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2807 | CKVK8S35 | resource | ReplicaSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2808 | CKVK8S35 | resource | ReplicationController | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2809 | CKVK8S35 | resource | StatefulSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | | | 2810 | CKVK8S35 | resource | kubernetes_deployment | Prefer using secrets as files over secrets as environment variables | Terraform | | | 2811 | CKVK8S35 | resource | kubernetesdeploymentv1 | Prefer using secrets as files over secrets as environment variables | Terraform | | | 2812 | CKVK8S35 | resource | kubernetes_pod | Prefer using secrets as files over secrets as environment variables | Terraform | | | 2813 | CKVK8S35 | resource | kubernetespodv1 | Prefer using secrets as files over secrets as environment variables | Terraform | | | 2814 | CKVK8S36 | resource | PodSecurityPolicy | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2815 | CKVK8S36 | resource | kubernetespodsecurity_policy | Minimise the admission of containers with capabilities assigned | Terraform | | | 2816 | CKVK8S37 | resource | CronJob | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2817 | CKVK8S37 | resource | DaemonSet | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2818 | CKVK8S37 | resource | Deployment | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2819 | CKVK8S37 | resource | DeploymentConfig | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2820 | CKVK8S37 | resource | Job | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2821 | CKVK8S37 | resource | Pod | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2822 | CKVK8S37 | resource | PodTemplate | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2823 | CKVK8S37 | resource | ReplicaSet | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2824 | CKVK8S37 | resource | ReplicationController | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2825 | CKVK8S37 | resource | StatefulSet | Minimize the admission of containers with capabilities assigned | Kubernetes | | | 2826 | CKVK8S37 | resource | kubernetes_deployment | Minimise the admission of containers with capabilities assigned | Terraform | | | 2827 | CKVK8S37 | resource | kubernetesdeploymentv1 | Minimise the admission of containers with capabilities assigned | Terraform | | | 2828 | CKVK8S37 | resource | kubernetes_pod | Minimise the admission of containers with capabilities assigned | Terraform | | | 2829 | CKVK8S37 | resource | kubernetespodv1 | Minimise the admission of containers with capabilities assigned | Terraform | | | 2830 | CKVK8S38 | resource | CronJob | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | | | 2831 | CKVK8S38 | resource | DaemonSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | | | 2832 | CKVK8S38 | resource | Deployment | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | | | 2833 | CKVK8S38 | resource | Job | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | | | 2834 | CKVK8S38 | resource | Pod | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | | | 2835 | CKVK8S38 | resource | ReplicaSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | | | 2836 | CKVK8S38 | resource | ReplicationController | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | | | 2837 | CKVK8S38 | resource | StatefulSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | | | 2838 | CKVK8S39 | resource | CronJob | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2839 | CKVK8S39 | resource | DaemonSet | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2840 | CKVK8S39 | resource | Deployment | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2841 | CKVK8S39 | resource | DeploymentConfig | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2842 | CKVK8S39 | resource | Job | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2843 | CKVK8S39 | resource | Pod | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2844 | CKVK8S39 | resource | PodTemplate | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2845 | CKVK8S39 | resource | ReplicaSet | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2846 | CKVK8S39 | resource | ReplicationController | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2847 | CKVK8S39 | resource | StatefulSet | Do not use the CAPSYSADMIN linux capability | Kubernetes | | | 2848 | CKVK8S39 | resource | kubernetesdeployment | Do not use the CAPSYS_ADMIN linux capability | Terraform | | | 2849 | CKVK8S39 | resource | kubernetesdeploymentv1 | Do not use the CAPSYSADMIN linux capability | Terraform | | | 2850 | CKVK8S39 | resource | kubernetespod | Do not use the CAPSYS_ADMIN linux capability | Terraform | | | 2851 | CKVK8S39 | resource | kubernetespodv1 | Do not use the CAPSYSADMIN linux capability | Terraform | | | 2852 | CKVK8S40 | resource | CronJob | Containers should run as a high UID to avoid host conflict | Kubernetes | | | 2853 | CKVK8S40 | resource | DaemonSet | Containers should run as a high UID to avoid host conflict | Kubernetes | | | 2854 | CKVK8S40 | resource | Deployment | Containers should run as a high UID to avoid host conflict | Kubernetes | | | 2855 | CKVK8S40 | resource | Job | Containers should run as a high UID to avoid host conflict | Kubernetes | | | 2856 | CKVK8S40 | resource | Pod | Containers should run as a high UID to avoid host conflict | Kubernetes | | | 2857 | CKVK8S40 | resource | ReplicaSet | Containers should run as a high UID to avoid host conflict | Kubernetes | | | 2858 | CKVK8S40 | resource | ReplicationController | Containers should run as a high UID to avoid host conflict | Kubernetes | | | 2859 | CKVK8S40 | resource | StatefulSet | Containers should run as a high UID to avoid host conflict | Kubernetes | | | 2860 | CKVK8S41 | resource | ServiceAccount | Ensure that default service accounts are not actively used | Kubernetes | | | 2861 | CKVK8S41 | resource | kubernetesserviceaccount | Ensure that default service accounts are not actively used | Terraform | | | 2862 | CKVK8S41 | resource | kubernetesserviceaccount_v1 | Ensure that default service accounts are not actively used | Terraform | | | 2863 | CKVK8S42 | resource | ClusterRoleBinding | Ensure that default service accounts are not actively used | Kubernetes | | | 2864 | CKVK8S42 | resource | RoleBinding | Ensure that default service accounts are not actively used | Kubernetes | | | 2865 | CKVK8S42 | resource | kubernetesclusterrole_binding | Ensure that default service accounts are not actively used | Terraform | | | 2866 | CKVK8S42 | resource | kubernetesclusterrolebindingv1 | Ensure that default service accounts are not actively used | Terraform | | | 2867 | CKVK8S42 | resource | kubernetesrolebinding | Ensure that default service accounts are not actively used | Terraform | | | 2868 | CKVK8S42 | resource | kubernetesrolebinding_v1 | Ensure that default service accounts are not actively used | Terraform | | | 2869 | CKVK8S43 | resource | CronJob | Image should use digest | Kubernetes | | | 2870 | CKVK8S43 | resource | DaemonSet | Image should use digest | Kubernetes | | | 2871 | CKVK8S43 | resource | Deployment | Image should use digest | Kubernetes | | | 2872 | CKVK8S43 | resource | DeploymentConfig | Image should use digest | Kubernetes | | | 2873 | CKVK8S43 | resource | Job | Image should use digest | Kubernetes | | | 2874 | CKVK8S43 | resource | Pod | Image should use digest | Kubernetes | | | 2875 | CKVK8S43 | resource | PodTemplate | Image should use digest | Kubernetes | | | 2876 | CKVK8S43 | resource | ReplicaSet | Image should use digest | Kubernetes | | | 2877 | CKVK8S43 | resource | ReplicationController | Image should use digest | Kubernetes | | | 2878 | CKVK8S43 | resource | StatefulSet | Image should use digest | Kubernetes | | | 2879 | CKVK8S43 | resource | kubernetes_deployment | Image should use digest | Terraform | | | 2880 | CKVK8S43 | resource | kubernetesdeploymentv1 | Image should use digest | Terraform | | | 2881 | CKVK8S43 | resource | kubernetes_pod | Image should use digest | Terraform | | | 2882 | CKVK8S43 | resource | kubernetespodv1 | Image should use digest | Terraform | | | 2883 | CKVK8S44 | resource | Service | Ensure that the Tiller Service (Helm v2) is deleted | Kubernetes | | | 2884 | CKVK8S44 | resource | kubernetes_service | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | | | 2885 | CKVK8S44 | resource | kubernetesservicev1 | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | | | 2886 | CKVK8S45 | resource | CronJob | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2887 | CKVK8S45 | resource | DaemonSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2888 | CKVK8S45 | resource | Deployment | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2889 | CKVK8S45 | resource | DeploymentConfig | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2890 | CKVK8S45 | resource | Job | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2891 | CKVK8S45 | resource | Pod | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2892 | CKVK8S45 | resource | PodTemplate | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2893 | CKVK8S45 | resource | ReplicaSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2894 | CKVK8S45 | resource | ReplicationController | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2895 | CKVK8S45 | resource | StatefulSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | | | 2896 | CKVK8S49 | resource | ClusterRole | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | | | 2897 | CKVK8S49 | resource | Role | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | | | 2898 | CKVK8S49 | resource | kubernetesclusterrole | Minimize wildcard use in Roles and ClusterRoles | Terraform | | | 2899 | CKVK8S49 | resource | kubernetesclusterrole_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | | | 2900 | CKVK8S49 | resource | kubernetes_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | | | 2901 | CKVK8S49 | resource | kubernetesrolev1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | | | 2902 | CKVK8S68 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2903 | CKVK8S68 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2904 | CKVK8S68 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2905 | CKVK8S68 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2906 | CKVK8S68 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2907 | CKVK8S68 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2908 | CKVK8S68 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2909 | CKVK8S68 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2910 | CKVK8S68 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2911 | CKVK8S68 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 2912 | CKVK8S69 | resource | CronJob | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2913 | CKVK8S69 | resource | DaemonSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2914 | CKVK8S69 | resource | Deployment | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2915 | CKVK8S69 | resource | DeploymentConfig | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2916 | CKVK8S69 | resource | Job | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2917 | CKVK8S69 | resource | Pod | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2918 | CKVK8S69 | resource | PodTemplate | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2919 | CKVK8S69 | resource | ReplicaSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2920 | CKVK8S69 | resource | ReplicationController | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2921 | CKVK8S69 | resource | StatefulSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | | | 2922 | CKVK8S70 | resource | CronJob | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2923 | CKVK8S70 | resource | DaemonSet | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2924 | CKVK8S70 | resource | Deployment | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2925 | CKVK8S70 | resource | DeploymentConfig | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2926 | CKVK8S70 | resource | Job | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2927 | CKVK8S70 | resource | Pod | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2928 | CKVK8S70 | resource | PodTemplate | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2929 | CKVK8S70 | resource | ReplicaSet | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2930 | CKVK8S70 | resource | ReplicationController | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2931 | CKVK8S70 | resource | StatefulSet | Ensure that the --token-auth-file argument is not set | Kubernetes | | | 2932 | CKVK8S71 | resource | CronJob | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2933 | CKVK8S71 | resource | DaemonSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2934 | CKVK8S71 | resource | Deployment | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2935 | CKVK8S71 | resource | DeploymentConfig | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2936 | CKVK8S71 | resource | Job | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2937 | CKVK8S71 | resource | Pod | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2938 | CKVK8S71 | resource | PodTemplate | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2939 | CKVK8S71 | resource | ReplicaSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2940 | CKVK8S71 | resource | ReplicationController | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2941 | CKVK8S71 | resource | StatefulSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | | | 2942 | CKVK8S72 | resource | CronJob | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2943 | CKVK8S72 | resource | DaemonSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2944 | CKVK8S72 | resource | Deployment | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2945 | CKVK8S72 | resource | DeploymentConfig | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2946 | CKVK8S72 | resource | Job | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2947 | CKVK8S72 | resource | Pod | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2948 | CKVK8S72 | resource | PodTemplate | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2949 | CKVK8S72 | resource | ReplicaSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2950 | CKVK8S72 | resource | ReplicationController | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2951 | CKVK8S72 | resource | StatefulSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | | | 2952 | CKVK8S73 | resource | CronJob | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2953 | CKVK8S73 | resource | DaemonSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2954 | CKVK8S73 | resource | Deployment | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2955 | CKVK8S73 | resource | DeploymentConfig | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2956 | CKVK8S73 | resource | Job | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2957 | CKVK8S73 | resource | Pod | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2958 | CKVK8S73 | resource | PodTemplate | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2959 | CKVK8S73 | resource | ReplicaSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2960 | CKVK8S73 | resource | ReplicationController | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2961 | CKVK8S73 | resource | StatefulSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | | | 2962 | CKVK8S74 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2963 | CKVK8S74 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2964 | CKVK8S74 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2965 | CKVK8S74 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2966 | CKVK8S74 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2967 | CKVK8S74 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2968 | CKVK8S74 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2969 | CKVK8S74 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2970 | CKVK8S74 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2971 | CKVK8S74 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 2972 | CKVK8S75 | resource | CronJob | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2973 | CKVK8S75 | resource | DaemonSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2974 | CKVK8S75 | resource | Deployment | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2975 | CKVK8S75 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2976 | CKVK8S75 | resource | Job | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2977 | CKVK8S75 | resource | Pod | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2978 | CKVK8S75 | resource | PodTemplate | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2979 | CKVK8S75 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2980 | CKVK8S75 | resource | ReplicationController | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2981 | CKVK8S75 | resource | StatefulSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | | | 2982 | CKVK8S77 | resource | CronJob | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2983 | CKVK8S77 | resource | DaemonSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2984 | CKVK8S77 | resource | Deployment | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2985 | CKVK8S77 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2986 | CKVK8S77 | resource | Job | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2987 | CKVK8S77 | resource | Pod | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2988 | CKVK8S77 | resource | PodTemplate | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2989 | CKVK8S77 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2990 | CKVK8S77 | resource | ReplicationController | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2991 | CKVK8S77 | resource | StatefulSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | | | 2992 | CKVK8S78 | resource | AdmissionConfiguration | Ensure that the admission control plugin EventRateLimit is set | Kubernetes | | | 2993 | CKVK8S79 | resource | CronJob | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 2994 | CKVK8S79 | resource | DaemonSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 2995 | CKVK8S79 | resource | Deployment | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 2996 | CKVK8S79 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 2997 | CKVK8S79 | resource | Job | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 2998 | CKVK8S79 | resource | Pod | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 2999 | CKVK8S79 | resource | PodTemplate | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 3000 | CKVK8S79 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 3001 | CKVK8S79 | resource | ReplicationController | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 3002 | CKVK8S79 | resource | StatefulSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | | | 3003 | CKVK8S80 | resource | CronJob | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3004 | CKVK8S80 | resource | DaemonSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3005 | CKVK8S80 | resource | Deployment | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3006 | CKVK8S80 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3007 | CKVK8S80 | resource | Job | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3008 | CKVK8S80 | resource | Pod | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3009 | CKVK8S80 | resource | PodTemplate | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3010 | CKVK8S80 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3011 | CKVK8S80 | resource | ReplicationController | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3012 | CKVK8S80 | resource | StatefulSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | | | 3013 | CKVK8S81 | resource | CronJob | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3014 | CKVK8S81 | resource | DaemonSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3015 | CKVK8S81 | resource | Deployment | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3016 | CKVK8S81 | resource | DeploymentConfig | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3017 | CKVK8S81 | resource | Job | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3018 | CKVK8S81 | resource | Pod | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3019 | CKVK8S81 | resource | PodTemplate | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3020 | CKVK8S81 | resource | ReplicaSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3021 | CKVK8S81 | resource | ReplicationController | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3022 | CKVK8S81 | resource | StatefulSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | | | 3023 | CKVK8S82 | resource | CronJob | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3024 | CKVK8S82 | resource | DaemonSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3025 | CKVK8S82 | resource | Deployment | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3026 | CKVK8S82 | resource | DeploymentConfig | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3027 | CKVK8S82 | resource | Job | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3028 | CKVK8S82 | resource | Pod | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3029 | CKVK8S82 | resource | PodTemplate | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3030 | CKVK8S82 | resource | ReplicaSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3031 | CKVK8S82 | resource | ReplicationController | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3032 | CKVK8S82 | resource | StatefulSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | | | 3033 | CKVK8S83 | resource | CronJob | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3034 | CKVK8S83 | resource | DaemonSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3035 | CKVK8S83 | resource | Deployment | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3036 | CKVK8S83 | resource | DeploymentConfig | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3037 | CKVK8S83 | resource | Job | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3038 | CKVK8S83 | resource | Pod | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3039 | CKVK8S83 | resource | PodTemplate | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3040 | CKVK8S83 | resource | ReplicaSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3041 | CKVK8S83 | resource | ReplicationController | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3042 | CKVK8S83 | resource | StatefulSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | | | 3043 | CKVK8S84 | resource | CronJob | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3044 | CKVK8S84 | resource | DaemonSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3045 | CKVK8S84 | resource | Deployment | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3046 | CKVK8S84 | resource | DeploymentConfig | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3047 | CKVK8S84 | resource | Job | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3048 | CKVK8S84 | resource | Pod | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3049 | CKVK8S84 | resource | PodTemplate | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3050 | CKVK8S84 | resource | ReplicaSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3051 | CKVK8S84 | resource | ReplicationController | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3052 | CKVK8S84 | resource | StatefulSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | | | 3053 | CKVK8S85 | resource | CronJob | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3054 | CKVK8S85 | resource | DaemonSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3055 | CKVK8S85 | resource | Deployment | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3056 | CKVK8S85 | resource | DeploymentConfig | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3057 | CKVK8S85 | resource | Job | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3058 | CKVK8S85 | resource | Pod | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3059 | CKVK8S85 | resource | PodTemplate | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3060 | CKVK8S85 | resource | ReplicaSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3061 | CKVK8S85 | resource | ReplicationController | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3062 | CKVK8S85 | resource | StatefulSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | | | 3063 | CKVK8S86 | resource | CronJob | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3064 | CKVK8S86 | resource | DaemonSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3065 | CKVK8S86 | resource | Deployment | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3066 | CKVK8S86 | resource | DeploymentConfig | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3067 | CKVK8S86 | resource | Job | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3068 | CKVK8S86 | resource | Pod | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3069 | CKVK8S86 | resource | PodTemplate | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3070 | CKVK8S86 | resource | ReplicaSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3071 | CKVK8S86 | resource | ReplicationController | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3072 | CKVK8S86 | resource | StatefulSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | | | 3073 | CKVK8S88 | resource | CronJob | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3074 | CKVK8S88 | resource | DaemonSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3075 | CKVK8S88 | resource | Deployment | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3076 | CKVK8S88 | resource | DeploymentConfig | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3077 | CKVK8S88 | resource | Job | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3078 | CKVK8S88 | resource | Pod | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3079 | CKVK8S88 | resource | PodTemplate | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3080 | CKVK8S88 | resource | ReplicaSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3081 | CKVK8S88 | resource | ReplicationController | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3082 | CKVK8S88 | resource | StatefulSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | | | 3083 | CKVK8S89 | resource | CronJob | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3084 | CKVK8S89 | resource | DaemonSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3085 | CKVK8S89 | resource | Deployment | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3086 | CKVK8S89 | resource | DeploymentConfig | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3087 | CKVK8S89 | resource | Job | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3088 | CKVK8S89 | resource | Pod | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3089 | CKVK8S89 | resource | PodTemplate | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3090 | CKVK8S89 | resource | ReplicaSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3091 | CKVK8S89 | resource | ReplicationController | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3092 | CKVK8S89 | resource | StatefulSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | | | 3093 | CKVK8S90 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | | | 3094 | CKVK8S90 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3095 | CKVK8S90 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | | | 3096 | CKVK8S90 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | | | 3097 | CKVK8S90 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | | | 3098 | CKVK8S90 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | | | 3099 | CKVK8S90 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | | | 3100 | CKVK8S90 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3101 | CKVK8S90 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | | | 3102 | CKVK8S90 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3103 | CKVK8S91 | resource | CronJob | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3104 | CKVK8S91 | resource | DaemonSet | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3105 | CKVK8S91 | resource | Deployment | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3106 | CKVK8S91 | resource | DeploymentConfig | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3107 | CKVK8S91 | resource | Job | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3108 | CKVK8S91 | resource | Pod | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3109 | CKVK8S91 | resource | PodTemplate | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3110 | CKVK8S91 | resource | ReplicaSet | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3111 | CKVK8S91 | resource | ReplicationController | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3112 | CKVK8S91 | resource | StatefulSet | Ensure that the --audit-log-path argument is set | Kubernetes | | | 3113 | CKVK8S92 | resource | CronJob | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3114 | CKVK8S92 | resource | DaemonSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3115 | CKVK8S92 | resource | Deployment | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3116 | CKVK8S92 | resource | DeploymentConfig | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3117 | CKVK8S92 | resource | Job | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3118 | CKVK8S92 | resource | Pod | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3119 | CKVK8S92 | resource | PodTemplate | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3120 | CKVK8S92 | resource | ReplicaSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3121 | CKVK8S92 | resource | ReplicationController | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3122 | CKVK8S92 | resource | StatefulSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | | | 3123 | CKVK8S93 | resource | CronJob | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3124 | CKVK8S93 | resource | DaemonSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3125 | CKVK8S93 | resource | Deployment | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3126 | CKVK8S93 | resource | DeploymentConfig | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3127 | CKVK8S93 | resource | Job | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3128 | CKVK8S93 | resource | Pod | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3129 | CKVK8S93 | resource | PodTemplate | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3130 | CKVK8S93 | resource | ReplicaSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3131 | CKVK8S93 | resource | ReplicationController | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3132 | CKVK8S93 | resource | StatefulSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | | | 3133 | CKVK8S94 | resource | CronJob | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3134 | CKVK8S94 | resource | DaemonSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3135 | CKVK8S94 | resource | Deployment | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3136 | CKVK8S94 | resource | DeploymentConfig | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3137 | CKVK8S94 | resource | Job | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3138 | CKVK8S94 | resource | Pod | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3139 | CKVK8S94 | resource | PodTemplate | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3140 | CKVK8S94 | resource | ReplicaSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3141 | CKVK8S94 | resource | ReplicationController | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3142 | CKVK8S94 | resource | StatefulSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | | | 3143 | CKVK8S95 | resource | CronJob | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3144 | CKVK8S95 | resource | DaemonSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3145 | CKVK8S95 | resource | Deployment | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3146 | CKVK8S95 | resource | DeploymentConfig | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3147 | CKVK8S95 | resource | Job | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3148 | CKVK8S95 | resource | Pod | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3149 | CKVK8S95 | resource | PodTemplate | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3150 | CKVK8S95 | resource | ReplicaSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3151 | CKVK8S95 | resource | ReplicationController | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3152 | CKVK8S95 | resource | StatefulSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | | | 3153 | CKVK8S96 | resource | CronJob | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3154 | CKVK8S96 | resource | DaemonSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3155 | CKVK8S96 | resource | Deployment | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3156 | CKVK8S96 | resource | DeploymentConfig | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3157 | CKVK8S96 | resource | Job | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3158 | CKVK8S96 | resource | Pod | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3159 | CKVK8S96 | resource | PodTemplate | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3160 | CKVK8S96 | resource | ReplicaSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3161 | CKVK8S96 | resource | ReplicationController | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3162 | CKVK8S96 | resource | StatefulSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | | | 3163 | CKVK8S97 | resource | CronJob | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3164 | CKVK8S97 | resource | DaemonSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3165 | CKVK8S97 | resource | Deployment | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3166 | CKVK8S97 | resource | DeploymentConfig | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3167 | CKVK8S97 | resource | Job | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3168 | CKVK8S97 | resource | Pod | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3169 | CKVK8S97 | resource | PodTemplate | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3170 | CKVK8S97 | resource | ReplicaSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3171 | CKVK8S97 | resource | ReplicationController | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3172 | CKVK8S97 | resource | StatefulSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | | | 3173 | CKVK8S99 | resource | CronJob | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3174 | CKVK8S99 | resource | DaemonSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3175 | CKVK8S99 | resource | Deployment | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3176 | CKVK8S99 | resource | DeploymentConfig | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3177 | CKVK8S99 | resource | Job | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3178 | CKVK8S99 | resource | Pod | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3179 | CKVK8S99 | resource | PodTemplate | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3180 | CKVK8S99 | resource | ReplicaSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3181 | CKVK8S99 | resource | ReplicationController | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3182 | CKVK8S99 | resource | StatefulSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | | | 3183 | CKVK8S100 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3184 | CKVK8S100 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3185 | CKVK8S100 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3186 | CKVK8S100 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3187 | CKVK8S100 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3188 | CKVK8S100 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3189 | CKVK8S100 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3190 | CKVK8S100 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3191 | CKVK8S100 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3192 | CKVK8S100 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3193 | CKVK8S102 | resource | CronJob | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3194 | CKVK8S102 | resource | DaemonSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3195 | CKVK8S102 | resource | Deployment | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3196 | CKVK8S102 | resource | DeploymentConfig | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3197 | CKVK8S102 | resource | Job | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3198 | CKVK8S102 | resource | Pod | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3199 | CKVK8S102 | resource | PodTemplate | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3200 | CKVK8S102 | resource | ReplicaSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3201 | CKVK8S102 | resource | ReplicationController | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3202 | CKVK8S102 | resource | StatefulSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | | | 3203 | CKVK8S104 | resource | CronJob | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3204 | CKVK8S104 | resource | DaemonSet | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3205 | CKVK8S104 | resource | Deployment | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3206 | CKVK8S104 | resource | DeploymentConfig | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3207 | CKVK8S104 | resource | Job | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3208 | CKVK8S104 | resource | Pod | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3209 | CKVK8S104 | resource | PodTemplate | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3210 | CKVK8S104 | resource | ReplicaSet | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3211 | CKVK8S104 | resource | ReplicationController | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3212 | CKVK8S104 | resource | StatefulSet | Ensure that encryption providers are appropriately configured | Kubernetes | | | 3213 | CKVK8S105 | resource | CronJob | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3214 | CKVK8S105 | resource | DaemonSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3215 | CKVK8S105 | resource | Deployment | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3216 | CKVK8S105 | resource | DeploymentConfig | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3217 | CKVK8S105 | resource | Job | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3218 | CKVK8S105 | resource | Pod | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3219 | CKVK8S105 | resource | PodTemplate | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3220 | CKVK8S105 | resource | ReplicaSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3221 | CKVK8S105 | resource | ReplicationController | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3222 | CKVK8S105 | resource | StatefulSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3223 | CKVK8S106 | resource | CronJob | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3224 | CKVK8S106 | resource | DaemonSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3225 | CKVK8S106 | resource | Deployment | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3226 | CKVK8S106 | resource | DeploymentConfig | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3227 | CKVK8S106 | resource | Job | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3228 | CKVK8S106 | resource | Pod | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3229 | CKVK8S106 | resource | PodTemplate | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3230 | CKVK8S106 | resource | ReplicaSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3231 | CKVK8S106 | resource | ReplicationController | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3232 | CKVK8S106 | resource | StatefulSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | | | 3233 | CKVK8S107 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | | | 3234 | CKVK8S107 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3235 | CKVK8S107 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | | | 3236 | CKVK8S107 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | | | 3237 | CKVK8S107 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | | | 3238 | CKVK8S107 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | | | 3239 | CKVK8S107 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | | | 3240 | CKVK8S107 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3241 | CKVK8S107 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | | | 3242 | CKVK8S107 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3243 | CKVK8S108 | resource | CronJob | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3244 | CKVK8S108 | resource | DaemonSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3245 | CKVK8S108 | resource | Deployment | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3246 | CKVK8S108 | resource | DeploymentConfig | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3247 | CKVK8S108 | resource | Job | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3248 | CKVK8S108 | resource | Pod | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3249 | CKVK8S108 | resource | PodTemplate | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3250 | CKVK8S108 | resource | ReplicaSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3251 | CKVK8S108 | resource | ReplicationController | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3252 | CKVK8S108 | resource | StatefulSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | | | 3253 | CKVK8S110 | resource | CronJob | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3254 | CKVK8S110 | resource | DaemonSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3255 | CKVK8S110 | resource | Deployment | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3256 | CKVK8S110 | resource | DeploymentConfig | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3257 | CKVK8S110 | resource | Job | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3258 | CKVK8S110 | resource | Pod | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3259 | CKVK8S110 | resource | PodTemplate | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3260 | CKVK8S110 | resource | ReplicaSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3261 | CKVK8S110 | resource | ReplicationController | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3262 | CKVK8S110 | resource | StatefulSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | | | 3263 | CKVK8S111 | resource | CronJob | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3264 | CKVK8S111 | resource | DaemonSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3265 | CKVK8S111 | resource | Deployment | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3266 | CKVK8S111 | resource | DeploymentConfig | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3267 | CKVK8S111 | resource | Job | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3268 | CKVK8S111 | resource | Pod | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3269 | CKVK8S111 | resource | PodTemplate | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3270 | CKVK8S111 | resource | ReplicaSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3271 | CKVK8S111 | resource | ReplicationController | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3272 | CKVK8S111 | resource | StatefulSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | | | 3273 | CKVK8S112 | resource | CronJob | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3274 | CKVK8S112 | resource | DaemonSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3275 | CKVK8S112 | resource | Deployment | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3276 | CKVK8S112 | resource | DeploymentConfig | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3277 | CKVK8S112 | resource | Job | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3278 | CKVK8S112 | resource | Pod | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3279 | CKVK8S112 | resource | PodTemplate | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3280 | CKVK8S112 | resource | ReplicaSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3281 | CKVK8S112 | resource | ReplicationController | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3282 | CKVK8S112 | resource | StatefulSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | | | 3283 | CKVK8S113 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3284 | CKVK8S113 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3285 | CKVK8S113 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3286 | CKVK8S113 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3287 | CKVK8S113 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3288 | CKVK8S113 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3289 | CKVK8S113 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3290 | CKVK8S113 | resource | ReplicaSet | Ensure that the --bind-address argument is set to

| Kubernetes | | | 3291 | CKVK8S113 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3292 | CKVK8S113 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3293 | CKVK8S114 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | | | 3294 | CKVK8S114 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3295 | CKVK8S114 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | | | 3296 | CKVK8S114 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | | | 3297 | CKVK8S114 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | | | 3298 | CKVK8S114 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | | | 3299 | CKVK8S114 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | | | 3300 | CKVK8S114 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3301 | CKVK8S114 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | | | 3302 | CKVK8S114 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | | | 3303 | CKVK8S115 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3304 | CKVK8S115 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3305 | CKVK8S115 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3306 | CKVK8S115 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3307 | CKVK8S115 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3308 | CKVK8S115 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3309 | CKVK8S115 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3310 | CKVK8S115 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3311 | CKVK8S115 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | | | 3312 | CKVK8S115 | resource | StatefulSet | Ensure that the --bind-address argument is set to

| Kubernetes | | | 3313 | CKVK8S116 | resource | CronJob | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3314 | CKVK8S116 | resource | DaemonSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3315 | CKVK8S116 | resource | Deployment | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3316 | CKVK8S116 | resource | DeploymentConfig | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3317 | CKVK8S116 | resource | Job | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3318 | CKVK8S116 | resource | Pod | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3319 | CKVK8S116 | resource | PodTemplate | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3320 | CKVK8S116 | resource | ReplicaSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3321 | CKVK8S116 | resource | ReplicationController | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3322 | CKVK8S116 | resource | StatefulSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | | | 3323 | CKVK8S117 | resource | CronJob | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3324 | CKVK8S117 | resource | DaemonSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3325 | CKVK8S117 | resource | Deployment | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3326 | CKVK8S117 | resource | DeploymentConfig | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3327 | CKVK8S117 | resource | Job | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3328 | CKVK8S117 | resource | Pod | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3329 | CKVK8S117 | resource | PodTemplate | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3330 | CKVK8S117 | resource | ReplicaSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3331 | CKVK8S117 | resource | ReplicationController | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3332 | CKVK8S117 | resource | StatefulSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | | | 3333 | CKVK8S118 | resource | CronJob | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3334 | CKVK8S118 | resource | DaemonSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3335 | CKVK8S118 | resource | Deployment | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3336 | CKVK8S118 | resource | DeploymentConfig | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3337 | CKVK8S118 | resource | Job | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3338 | CKVK8S118 | resource | Pod | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3339 | CKVK8S118 | resource | PodTemplate | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3340 | CKVK8S118 | resource | ReplicaSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3341 | CKVK8S118 | resource | ReplicationController | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3342 | CKVK8S118 | resource | StatefulSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | | | 3343 | CKVK8S119 | resource | CronJob | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3344 | CKVK8S119 | resource | DaemonSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3345 | CKVK8S119 | resource | Deployment | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3346 | CKVK8S119 | resource | DeploymentConfig | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3347 | CKVK8S119 | resource | Job | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3348 | CKVK8S119 | resource | Pod | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3349 | CKVK8S119 | resource | PodTemplate | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3350 | CKVK8S119 | resource | ReplicaSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3351 | CKVK8S119 | resource | ReplicationController | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3352 | CKVK8S119 | resource | StatefulSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | | | 3353 | CKVK8S121 | resource | Pod | Ensure that the --peer-client-cert-auth argument is set to true | Kubernetes | | | 3354 | CKVK8S138 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3355 | CKVK8S138 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3356 | CKVK8S138 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3357 | CKVK8S138 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3358 | CKVK8S138 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3359 | CKVK8S138 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3360 | CKVK8S138 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3361 | CKVK8S138 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3362 | CKVK8S138 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3363 | CKVK8S138 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | | | 3364 | CKVK8S139 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3365 | CKVK8S139 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3366 | CKVK8S139 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3367 | CKVK8S139 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3368 | CKVK8S139 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3369 | CKVK8S139 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3370 | CKVK8S139 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3371 | CKVK8S139 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3372 | CKVK8S139 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3373 | CKVK8S139 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | | | 3374 | CKVK8S140 | resource | CronJob | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3375 | CKVK8S140 | resource | DaemonSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3376 | CKVK8S140 | resource | Deployment | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3377 | CKVK8S140 | resource | DeploymentConfig | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3378 | CKVK8S140 | resource | Job | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3379 | CKVK8S140 | resource | Pod | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3380 | CKVK8S140 | resource | PodTemplate | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3381 | CKVK8S140 | resource | ReplicaSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3382 | CKVK8S140 | resource | ReplicationController | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3383 | CKVK8S140 | resource | StatefulSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | | | 3384 | CKVK8S141 | resource | CronJob | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3385 | CKVK8S141 | resource | DaemonSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3386 | CKVK8S141 | resource | Deployment | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3387 | CKVK8S141 | resource | DeploymentConfig | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3388 | CKVK8S141 | resource | Job | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3389 | CKVK8S141 | resource | Pod | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3390 | CKVK8S141 | resource | PodTemplate | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3391 | CKVK8S141 | resource | ReplicaSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3392 | CKVK8S141 | resource | ReplicationController | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3393 | CKVK8S141 | resource | StatefulSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | | | 3394 | CKVK8S143 | resource | CronJob | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3395 | CKVK8S143 | resource | DaemonSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3396 | CKVK8S143 | resource | Deployment | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3397 | CKVK8S143 | resource | DeploymentConfig | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3398 | CKVK8S143 | resource | Job | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3399 | CKVK8S143 | resource | Pod | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3400 | CKVK8S143 | resource | PodTemplate | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3401 | CKVK8S143 | resource | ReplicaSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3402 | CKVK8S143 | resource | ReplicationController | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3403 | CKVK8S143 | resource | StatefulSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | | | 3404 | CKVK8S144 | resource | CronJob | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3405 | CKVK8S144 | resource | DaemonSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3406 | CKVK8S144 | resource | Deployment | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3407 | CKVK8S144 | resource | DeploymentConfig | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3408 | CKVK8S144 | resource | Job | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3409 | CKVK8S144 | resource | Pod | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3410 | CKVK8S144 | resource | PodTemplate | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3411 | CKVK8S144 | resource | ReplicaSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3412 | CKVK8S144 | resource | ReplicationController | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3413 | CKVK8S144 | resource | StatefulSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | | | 3414 | CKVK8S145 | resource | CronJob | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3415 | CKVK8S145 | resource | DaemonSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3416 | CKVK8S145 | resource | Deployment | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3417 | CKVK8S145 | resource | DeploymentConfig | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3418 | CKVK8S145 | resource | Job | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3419 | CKVK8S145 | resource | Pod | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3420 | CKVK8S145 | resource | PodTemplate | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3421 | CKVK8S145 | resource | ReplicaSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3422 | CKVK8S145 | resource | ReplicationController | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3423 | CKVK8S145 | resource | StatefulSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | | | 3424 | CKVK8S146 | resource | CronJob | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3425 | CKVK8S146 | resource | DaemonSet | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3426 | CKVK8S146 | resource | Deployment | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3427 | CKVK8S146 | resource | DeploymentConfig | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3428 | CKVK8S146 | resource | Job | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3429 | CKVK8S146 | resource | Pod | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3430 | CKVK8S146 | resource | PodTemplate | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3431 | CKVK8S146 | resource | ReplicaSet | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3432 | CKVK8S146 | resource | ReplicationController | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3433 | CKVK8S146 | resource | StatefulSet | Ensure that the --hostname-override argument is not set | Kubernetes | | | 3434 | CKVK8S147 | resource | CronJob | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3435 | CKVK8S147 | resource | DaemonSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3436 | CKVK8S147 | resource | Deployment | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3437 | CKVK8S147 | resource | DeploymentConfig | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3438 | CKVK8S147 | resource | Job | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3439 | CKVK8S147 | resource | Pod | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3440 | CKVK8S147 | resource | PodTemplate | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3441 | CKVK8S147 | resource | ReplicaSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3442 | CKVK8S147 | resource | ReplicationController | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3443 | CKVK8S147 | resource | StatefulSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | | | 3444 | CKVK8S148 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3445 | CKVK8S148 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3446 | CKVK8S148 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3447 | CKVK8S148 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3448 | CKVK8S148 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3449 | CKVK8S148 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3450 | CKVK8S148 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3451 | CKVK8S148 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3452 | CKVK8S148 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3453 | CKVK8S148 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | | | 3454 | CKVK8S149 | resource | CronJob | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3455 | CKVK8S149 | resource | DaemonSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3456 | CKVK8S149 | resource | Deployment | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3457 | CKVK8S149 | resource | DeploymentConfig | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3458 | CKVK8S149 | resource | Job | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3459 | CKVK8S149 | resource | Pod | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3460 | CKVK8S149 | resource | PodTemplate | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3461 | CKVK8S149 | resource | ReplicaSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3462 | CKVK8S149 | resource | ReplicationController | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3463 | CKVK8S149 | resource | StatefulSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | | | 3464 | CKVK8S151 | resource | CronJob | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3465 | CKVK8S151 | resource | DaemonSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3466 | CKVK8S151 | resource | Deployment | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3467 | CKVK8S151 | resource | DeploymentConfig | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3468 | CKVK8S151 | resource | Job | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3469 | CKVK8S151 | resource | Pod | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3470 | CKVK8S151 | resource | PodTemplate | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3471 | CKVK8S151 | resource | ReplicaSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3472 | CKVK8S151 | resource | ReplicationController | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3473 | CKVK8S151 | resource | StatefulSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | | | 3474 | CKVK8S152 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742 | Kubernetes | | | 3475 | CKVK8S153 | resource | Ingress | Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742 | Kubernetes | | | 3476 | CKVK8S154 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742 | Kubernetes | | | 3477 | CKVK8S155 | resource | ClusterRole | Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations | Kubernetes | | | 3478 | CKVK8S156 | resource | ClusterRole | Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests | Kubernetes | | | 3479 | CKVK8S157 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | | | 3480 | CKVK8S157 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | | | 3481 | CKVK8S158 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | | | 3482 | CKVK8S158 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | | | 3483 | CKV2K8S1 | resource | ClusterRole | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | | | 3484 | CKV2K8S1 | resource | ClusterRoleBinding | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | | | 3485 | CKV2K8S1 | resource | Role | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | | | 3486 | CKV2K8S1 | resource | RoleBinding | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | | | 3487 | CKV2K8S2 | resource | ClusterRole | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | | | 3488 | CKV2K8S2 | resource | ClusterRoleBinding | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | | | 3489 | CKV2K8S2 | resource | Role | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | | | 3490 | CKV2K8S2 | resource | RoleBinding | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | | | 3491 | CKV2K8S3 | resource | ClusterRole | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | | | 3492 | CKV2K8S3 | resource | ClusterRoleBinding | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | | | 3493 | CKV2K8S3 | resource | Role | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | | | 3494 | CKV2K8S3 | resource | RoleBinding | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | | | 3495 | CKV2K8S4 | resource | ClusterRole | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the

| Kubernetes | | | 3496 | CKV2K8S4 | resource | ClusterRoleBinding | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | | | 3497 | CKV2K8S4 | resource | Role | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | | | 3498 | CKV2K8S4 | resource | RoleBinding | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | | | 3499 | CKV2K8S5 | resource | ClusterRole | No ServiceAccount/Node should be able to read all secrets | Kubernetes | | | 3500 | CKV2K8S5 | resource | ClusterRoleBinding | No ServiceAccount/Node should be able to read all secrets | Kubernetes | | | 3501 | CKV2K8S5 | resource | Role | No ServiceAccount/Node should be able to read all secrets | Kubernetes | | | 3502 | CKV2K8S5 | resource | RoleBinding | No ServiceAccount/Node should be able to read all secrets | Kubernetes | | | 3503 | CKV2K8S6 | resource | Deployment | Minimize the admission of pods which lack an associated NetworkPolicy | Kubernetes | | | 3504 | CKV2K8S6 | resource | Pod | Minimize the admission of pods which lack an associated NetworkPolicy | Kubernetes | | | 3505 | CKVLIN1 | provider | linode | Ensure no hard coded Linode tokens exist in provider | Terraform | | | 3506 | CKVLIN2 | resource | linodeinstance | Ensure SSH key set in authorizedkeys | Terraform | | | 3507 | CKVLIN3 | resource | linode_user | Ensure email is set | Terraform | | | 3508 | CKVLIN4 | resource | linode_user | Ensure username is set | Terraform | | | 3509 | CKVLIN5 | resource | linode_firewall | Ensure Inbound Firewall Policy is not set to ACCEPT | Terraform | | | 3510 | CKVLIN6 | resource | linode_firewall | Ensure Outbound Firewall Policy is not set to ACCEPT | Terraform | | | 3511 | CKVNCP1 | resource | ncloudlbtarget_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | | | 3512 | CKVNCP2 | resource | ncloudaccesscontrol_group | Ensure every access control groups rule has a description | Terraform | | | 3513 | CKVNCP2 | resource | ncloudaccesscontrolgrouprule | Ensure every access control groups rule has a description | Terraform | | | 3514 | CKVNCP3 | resource | ncloudaccesscontrolgrouprule | Ensure no security group rules allow outbound traffic to 0.0.0.0/0 | Terraform | | | 3515 | CKVNCP4 | resource | ncloudaccesscontrolgrouprule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22 | Terraform | | | 3516 | CKVNCP5 | resource | ncloudaccesscontrolgrouprule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389 | Terraform | | | 3517 | CKVNCP6 | resource | ncloud_server | Ensure Server instance is encrypted. | Terraform | | | 3518 | CKVNCP7 | resource | ncloudlaunchconfiguration | Ensure Basic Block storage is encrypted. | Terraform | | | 3519 | CKVNCP8 | resource | ncloudnetworkacl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 20 | Terraform | | | 3520 | CKVNCP9 | resource | ncloudnetworkacl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 21 | Terraform | | | 3521 | CKVNCP10 | resource | ncloudnetworkacl_rule | Ensure no NACL allow inbound from

to port 22 | Terraform | | | 3522 | CKVNCP11 | resource | ncloudnetworkacl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389 | Terraform | | | 3523 | CKVNCP12 | resource | ncloudnetworkacl_rule | An inbound Network ACL rule should not allow ALL ports. | Terraform | | | 3524 | CKVNCP13 | resource | ncloudlblistener | Ensure LB Listener uses only secure protocols | Terraform | | | 3525 | CKVNCP14 | resource | ncloudnasvolume | Ensure NAS is securely encrypted | Terraform | | | 3526 | CKVNCP15 | resource | ncloudlbtarget_group | Ensure Load Balancer Target Group is not using HTTP | Terraform | | | 3527 | CKVNCP16 | resource | ncloud_lb | Ensure Load Balancer isn't exposed to the internet | Terraform | | | 3528 | CKVNCP18 | resource | ncloudautoscaling_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks. | Terraform | | | 3529 | CKVNCP18 | resource | ncloudlbtarget_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks. | Terraform | | | 3530 | CKVNCP19 | resource | ncloudnkscluster | Ensure Naver Kubernetes Service public endpoint disabled | Terraform | | | 3531 | CKVNCP20 | resource | ncloud_route | Ensure Routing Table associated with Web tier subnet have the default route (0.0.0.0/0) defined to allow connectivity | Terraform | | | 3532 | CKVNCP22 | resource | ncloudnkscluster | Ensure NKS control plane logging enabled for all log types | Terraform | | | 3533 | CKVNCP22 | resource | ncloudroutetable | Ensure a route table for the public subnets is created. | Terraform | | | 3534 | CKVNCP22 | resource | ncloud_subnet | Ensure a route table for the public subnets is created. | Terraform | | | 3535 | CKVNCP23 | resource | ncloudpublicip | Ensure Server instance should not have public IP. | Terraform | | | 3536 | CKVNCP24 | resource | ncloudlblistener | Ensure Load Balancer Listener Using HTTPS | Terraform | | | 3537 | CKVNCP25 | resource | ncloudaccesscontrolgrouprule | Ensure no access control groups allow inbound from

to port 80 | Terraform | | | 3538 | CKVNCP26 | resource | ncloudaccesscontrol_group | Ensure Access Control Group has Access Control Group Rule attached | Terraform | | | 3539 | CKVOCI1 | provider | oci | Ensure no hard coded OCI private key in provider | Terraform | | | 3540 | CKVOCI2 | resource | ocicorevolume | Ensure OCI Block Storage Block Volume has backup enabled | Terraform | | | 3541 | CKVOCI3 | resource | ocicorevolume | OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) | Terraform | | | 3542 | CKVOCI4 | resource | ocicoreinstance | Ensure OCI Compute Instance boot volume has in-transit data encryption enabled | Terraform | | | 3543 | CKVOCI5 | resource | ocicoreinstance | Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled | Terraform | | | 3544 | CKVOCI6 | resource | ocicoreinstance | Ensure OCI Compute Instance has monitoring enabled | Terraform | | | 3545 | CKVOCI7 | resource | ociobjectstoragebucket | Ensure OCI Object Storage bucket can emit object events | Terraform | | | 3546 | CKVOCI8 | resource | ociobjectstoragebucket | Ensure OCI Object Storage has versioning enabled | Terraform | | | 3547 | CKVOCI9 | resource | ociobjectstoragebucket | Ensure OCI Object Storage is encrypted with Customer Managed Key | Terraform | | | 3548 | CKVOCI10 | resource | ociobjectstoragebucket | Ensure OCI Object Storage is not Public | Terraform | | | 3549 | CKVOCI11 | resource | ociidentityauthentication_policy | OCI IAM password policy - must contain lower case | Terraform | | | 3550 | CKVOCI12 | resource | ociidentityauthentication_policy | OCI IAM password policy - must contain Numeric characters | Terraform | | | 3551 | CKVOCI13 | resource | ociidentityauthentication_policy | OCI IAM password policy - must contain Special characters | Terraform | | | 3552 | CKVOCI14 | resource | ociidentityauthentication_policy | OCI IAM password policy - must contain Uppercase characters | Terraform | | | 3553 | CKVOCI15 | resource | ocifilestoragefilesystem | Ensure OCI File System is Encrypted with a customer Managed Key | Terraform | | | 3554 | CKVOCI16 | resource | ocicoresecurity_list | Ensure VCN has an inbound security list | Terraform | | | 3555 | CKVOCI17 | resource | ocicoresecurity_list | Ensure VCN inbound security lists are stateless | Terraform | | | 3556 | CKVOCI18 | resource | ociidentityauthentication_policy | OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters | Terraform | | | 3557 | CKVOCI19 | resource | ocicoresecurity_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 22. | Terraform | | | 3558 | CKVOCI20 | resource | ocicoresecurity_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 3389. | Terraform | | | 3559 | CKVOCI21 | resource | ocicorenetworksecuritygroupsecurityrule | Ensure security group has stateless ingress security rules | Terraform | | | 3560 | CKVOCI22 | resource | ocicorenetworksecuritygroupsecurityrule | Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22 | Terraform | | | 3561 | CKV2OCI1 | resource | ociidentitygroup | Ensure administrator users are not associated with API keys | Terraform | | | 3562 | CKV2OCI1 | resource | ociidentityuser | Ensure administrator users are not associated with API keys | Terraform | | | 3563 | CKV2OCI1 | resource | ociidentityusergroupmembership | Ensure administrator users are not associated with API keys | Terraform | | | 3564 | CKV2OCI2 | resource | ocicorenetworksecuritygroupsecurityrule | Ensure NSG does not allow all traffic on RDP port (3389) | Terraform | | | 3565 | CKV2OCI3 | resource | ocicontainerenginecluster | Ensure Kubernetes engine cluster is configured with NSG(s) | Terraform | | | 3566 | CKV2OCI4 | resource | ocifilestorage_export | Ensure File Storage File System access is restricted to root users | Terraform | | | 3567 | CKV2OCI5 | resource | ocicontainerenginenode_pool | Ensure Kubernetes Engine Cluster boot volume is configured with in-transit data encryption | Terraform | | | 3568 | CKV2OCI6 | resource | ocicontainerenginecluster | Ensure Kubernetes Engine Cluster pod security policy is enforced | Terraform | | | 3569 | CKVOPENAPI1 | resource | securityDefinitions | Ensure that securityDefinitions is defined and not empty - version 2.0 files | OpenAPI | | | 3570 | CKVOPENAPI2 | resource | security | Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files | OpenAPI | | | 3571 | CKVOPENAPI3 | resource | components | Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version

files | OpenAPI | | | 3572 | CKVOPENAPI4 | resource | security | Ensure that the global security field has rules defined | OpenAPI | | | 3573 | CKVOPENAPI5 | resource | security | Ensure that security operations is not empty. | OpenAPI | | | 3574 | CKVOPENAPI6 | resource | security | Ensure that security requirement defined in securityDefinitions - version 2.0 files | OpenAPI | | | 3575 | CKVOPENAPI7 | resource | security | Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files | OpenAPI | | | 3576 | CKVOPENAPI8 | resource | security | Ensure that security is not using 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | | | 3577 | CKVOPENAPI9 | resource | paths | Ensure that security scopes of operations are defined in securityDefinitions - version 2.0 files | OpenAPI | | | 3578 | CKVOPENAPI10 | resource | paths | Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | | | 3579 | CKVOPENAPI11 | resource | securityDefinitions | Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | | | 3580 | CKVOPENAPI12 | resource | securityDefinitions | Ensure no security definition is using implicit flow on OAuth2, which is deprecated - version 2.0 files | OpenAPI | | | 3581 | CKVOPENAPI13 | resource | securityDefinitions | Ensure security definitions do not use basic auth - version 2.0 files | OpenAPI | | | 3582 | CKVOPENAPI14 | resource | paths | Ensure that operation objects do not use 'implicit' flow, which is deprecated - version 2.0 files | OpenAPI | | | 3583 | CKVOPENAPI15 | resource | paths | Ensure that operation objects do not use basic auth - version 2.0 files | OpenAPI | | | 3584 | CKVOPENAPI16 | resource | paths | Ensure that operation objects have 'produces' field defined for GET operations - version 2.0 files | OpenAPI | | | 3585 | CKVOPENAPI17 | resource | paths | Ensure that operation objects have 'consumes' field defined for PUT, POST and PATCH operations - version 2.0 files | OpenAPI | | | 3586 | CKVOPENAPI18 | resource | schemes | Ensure that global schemes use 'https' protocol instead of 'http'- version 2.0 files | OpenAPI | | | 3587 | CKVOPENAPI19 | resource | security | Ensure that global security scope is defined in securityDefinitions - version 2.0 files | OpenAPI | | | 3588 | CKVOPENAPI20 | resource | paths | Ensure that API keys are not sent over cleartext | OpenAPI | | | 3589 | CKVOPENAPI21 | resource | paths | Ensure that arrays have a maximum number of items | OpenAPI | | | 3590 | CKVOPENSTACK1 | provider | openstack | Ensure no hard coded OpenStack password, token, or applicationcredentialsecret exists in provider | Terraform | | | 3591 | CKVOPENSTACK2 | resource | openstackcomputesecgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | | | 3592 | CKVOPENSTACK2 | resource | openstacknetworkingsecgrouprulev2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | | | 3593 | CKVOPENSTACK3 | resource | openstackcomputesecgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | | | 3594 | CKVOPENSTACK3 | resource | openstacknetworkingsecgrouprulev2 | Ensure no security groups allow ingress from

to port 3389 (tcp / udp) | Terraform | | | 3595 | CKVOPENSTACK4 | resource | openstackcomputeinstance_v2 | Ensure that instance does not use basic credentials | Terraform | | | 3596 | CKVOPENSTACK5 | resource | openstackfwrule_v1 | Ensure firewall rule set a destination IP | Terraform | | | 3597 | CKVPAN1 | provider | panos | Ensure no hard coded PAN-OS credentials exist in provider | Terraform | | | 3598 | CKVPAN2 | resource | panosmanagementprofile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Terraform | | | 3599 | CKVPAN2 | resource | tasks.paloaltonetworks.panos.panosmanagementprofile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Ansible | | | 3600 | CKVPAN3 | resource | panosmanagementprofile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Terraform | | | 3601 | CKVPAN3 | resource | tasks.paloaltonetworks.panos.panosmanagementprofile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Ansible | | | 3602 | CKVPAN4 | resource | panossecuritypolicy | Ensure DSRI is not enabled within security policies | Terraform | | | 3603 | CKVPAN4 | resource | panossecurityrule_group | Ensure DSRI is not enabled within security policies | Terraform | | | 3604 | CKVPAN4 | resource | tasks.paloaltonetworks.panos.panossecurityrule | Ensure DSRI is not enabled within security policies | Ansible | | | 3605 | CKVPAN5 | resource | panossecuritypolicy | Ensure security rules do not have 'applications' set to 'any' | Terraform | | | 3606 | CKVPAN5 | resource | panossecurityrule_group | Ensure security rules do not have 'applications' set to 'any' | Terraform | | | 3607 | CKVPAN5 | resource | tasks.paloaltonetworks.panos.panossecurityrule | Ensure security rules do not have 'application' set to 'any' | Ansible | | | 3608 | CKVPAN6 | resource | panossecuritypolicy | Ensure security rules do not have 'services' set to 'any' | Terraform | | | 3609 | CKVPAN6 | resource | panossecurityrule_group | Ensure security rules do not have 'services' set to 'any' | Terraform | | | 3610 | CKVPAN6 | resource | tasks.paloaltonetworks.panos.panossecurityrule | Ensure security rules do not have 'service' set to 'any' | Ansible | | | 3611 | CKVPAN7 | resource | panossecuritypolicy | Ensure security rules do not have 'sourceaddresses' and 'destinationaddresses' both containing values of 'any' | Terraform | | | 3612 | CKVPAN7 | resource | panossecurityrulegroup | Ensure security rules do not have 'sourceaddresses' and 'destination_addresses' both containing values of 'any' | Terraform | | | 3613 | CKVPAN7 | resource | tasks.paloaltonetworks.panos.panossecurityrule | Ensure security rules do not have 'sourceip' and 'destinationip' both containing values of 'any' | Ansible | | | 3614 | CKVPAN8 | resource | panossecuritypolicy | Ensure description is populated within security policies | Terraform | | | 3615 | CKVPAN8 | resource | panossecurityrule_group | Ensure description is populated within security policies | Terraform | | | 3616 | CKVPAN8 | resource | tasks.paloaltonetworks.panos.panossecurityrule | Ensure description is populated within security policies | Ansible | | | 3617 | CKVPAN9 | resource | panossecuritypolicy | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | | | 3618 | CKVPAN9 | resource | panossecurityrule_group | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | | | 3619 | CKVPAN9 | resource |

| Ensure a Log Forwarding Profile is selected for each security policy rule | Ansible | | | 3620 | CKVPAN10 | resource | panossecuritypolicy | Ensure logging at session end is enabled within security policies | Terraform | | | 3621 | CKVPAN10 | resource | panossecurityrule_group | Ensure logging at session end is enabled within security policies | Terraform | | | 3622 | CKVPAN10 | resource | tasks.paloaltonetworks.panos.panossecurityrule | Ensure logging at session end is enabled within security policies | Ansible | | | 3623 | CKVPAN11 | resource | panosipseccrypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | | | 3624 | CKVPAN11 | resource | panospanoramaipseccryptoprofile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | | | 3625 | CKVPAN12 | resource | panosipseccrypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | | | 3626 | CKVPAN12 | resource | panospanoramaipseccryptoprofile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | | | 3627 | CKVPAN12 | resource | tasks.paloaltonetworks.panos.panosipsecprofile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Ansible | | | 3628 | CKVPAN13 | resource | panosipseccrypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | | | 3629 | CKVPAN13 | resource | panospanoramaipseccryptoprofile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | | | 3630 | CKVPAN13 | resource | tasks.paloaltonetworks.panos.panosipsecprofile | Ensure IPsec profiles do not specify use of insecure protocols | Ansible | | | 3631 | CKVPAN14 | resource | panospanoramazone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | | | 3632 | CKVPAN14 | resource | panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | | | 3633 | CKVPAN14 | resource | panoszoneentry | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | | | 3634 | CKVPAN14 | resource | tasks.paloaltonetworks.panos.panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Ansible | | | 3635 | CKVPAN15 | resource | panospanoramazone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | | | 3636 | CKVPAN15 | resource | panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | | | 3637 | CKVPAN15 | resource | tasks.paloaltonetworks.panos.panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Ansible | | | 3638 | CKVPAN16 | resource | tasks.paloaltonetworks.panos.panossecurityrule | Ensure logging at session start is disabled within security policies except for troubleshooting and long lived GRE tunnels | Ansible | | | 3639 | CKVPAN17 | resource |

| Ensure security rules do not have 'sourcezone' and 'destinationzone' both containing values of 'any' | Ansible | | | 3640 | CKVSECRET1 | Artifactory Credentials | secrets | Artifactory Credentials | secrets | | | 3641 | CKVSECRET2 | AWS Access Key | secrets | AWS Access Key | secrets | | | 3642 | CKVSECRET3 | Azure Storage Account access key | secrets | Azure Storage Account access key | secrets | | | 3643 | CKVSECRET4 | Basic Auth Credentials | secrets | Basic Auth Credentials | secrets | | | 3644 | CKVSECRET5 | Cloudant Credentials | secrets | Cloudant Credentials | secrets | | | 3645 | CKVSECRET6 | Base64 High Entropy String | secrets | Base64 High Entropy String | secrets | | | 3646 | CKVSECRET7 | IBM Cloud IAM Key | secrets | IBM Cloud IAM Key | secrets | | | 3647 | CKVSECRET8 | IBM COS HMAC Credentials | secrets | IBM COS HMAC Credentials | secrets | | | 3648 | CKVSECRET9 | JSON Web Token | secrets | JSON Web Token | secrets | | | 3649 | CKVSECRET11 | Mailchimp Access Key | secrets | Mailchimp Access Key | secrets | | | 3650 | CKVSECRET12 | NPM tokens | secrets | NPM tokens | secrets | | | 3651 | CKVSECRET13 | Private Key | secrets | Private Key | secrets | | | 3652 | CKVSECRET14 | Slack Token | secrets | Slack Token | secrets | | | 3653 | CKVSECRET15 | SoftLayer Credentials | secrets | SoftLayer Credentials | secrets | | | 3654 | CKVSECRET16 | Square OAuth Secret | secrets | Square OAuth Secret | secrets | | | 3655 | CKVSECRET17 | Stripe Access Key | secrets | Stripe Access Key | secrets | | | 3656 | CKVSECRET18 | Twilio API Key | secrets | Twilio API Key | secrets | | | 3657 | CKVSECRET19 | Hex High Entropy String | secrets | Hex High Entropy String | secrets | | | 3658 | CKVTF1 | module | module | Ensure Terraform module sources use a commit hash | Terraform | | | 3659 | CKVTF2 | module | module | Ensure Terraform module sources use a tag with a version number | Terraform | | | 3660 | CKVYC1 | resource | yandexmdbclickhouse_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3661 | CKVYC1 | resource | yandexmdbelasticsearch_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3662 | CKVYC1 | resource | yandexmdbgreenplum_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3663 | CKVYC1 | resource | yandexmdbkafka_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3664 | CKVYC1 | resource | yandexmdbmongodb_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3665 | CKVYC1 | resource | yandexmdbmysql_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3666 | CKVYC1 | resource | yandexmdbpostgresql_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3667 | CKVYC1 | resource | yandexmdbredis_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3668 | CKVYC1 | resource | yandexmdbsqlserver_cluster | Ensure security group is assigned to database cluster. | Terraform | | | 3669 | CKVYC2 | resource | yandexcomputeinstance | Ensure compute instance does not have public IP. | Terraform | | | 3670 | CKVYC3 | resource | yandexstoragebucket | Ensure storage bucket is encrypted. | Terraform | | | 3671 | CKVYC4 | resource | yandexcomputeinstance | Ensure compute instance does not have serial console enabled. | Terraform | | | 3672 | CKVYC5 | resource | yandexkubernetescluster | Ensure Kubernetes cluster does not have public IP address. | Terraform | | | 3673 | CKVYC6 | resource | yandexkubernetesnode_group | Ensure Kubernetes cluster node group does not have public IP addresses. | Terraform | | | 3674 | CKVYC7 | resource | yandexkubernetescluster | Ensure Kubernetes cluster auto-upgrade is enabled. | Terraform | | | 3675 | CKVYC8 | resource | yandexkubernetesnode_group | Ensure Kubernetes node group auto-upgrade is enabled. | Terraform | | | 3676 | CKVYC9 | resource | yandexkmssymmetric_key | Ensure KMS symmetric key is rotated. | Terraform | | | 3677 | CKVYC10 | resource | yandexkubernetescluster | Ensure etcd database is encrypted with KMS

| Terraform | | | 3678 | CKVYC11 | resource | yandexcomputeinstance | Ensure security group is assigned to network interface. | Terraform | | | 3679 | CKVYC12 | resource | yandexmdbclickhouse_cluster | Ensure public IP is not assigned to database cluster. | Terraform | | | 3680 | CKVYC12 | resource | yandexmdbelasticsearch_cluster | Ensure public IP is not assigned to database cluster. | Terraform | | | 3681 | CKVYC12 | resource | yandexmdbgreenplum_cluster | Ensure public IP is not assigned to database cluster. | Terraform | | | 3682 | CKVYC12 | resource | yandexmdbkafka_cluster | Ensure public IP is not assigned to database cluster. | Terraform | | | 3683 | CKVYC12 | resource | yandexmdbmongodb_cluster | Ensure public IP is not assigned to database cluster. | Terraform | | | 3684 | CKVYC12 | resource | yandexmdbmysql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | | | 3685 | CKVYC12 | resource | yandexmdbpostgresql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | | | 3686 | CKVYC12 | resource | yandexmdbsqlserver_cluster | Ensure public IP is not assigned to database cluster. | Terraform | | | 3687 | CKVYC13 | resource | yandexresourcemanagercloudiambinding | Ensure cloud member does not have elevated access. | Terraform | | | 3688 | CKVYC13 | resource | yandexresourcemanagercloudiammember | Ensure cloud member does not have elevated access. | Terraform | | | 3689 | CKVYC14 | resource | yandexkubernetescluster | Ensure security group is assigned to Kubernetes cluster. | Terraform | | | 3690 | CKVYC15 | resource | yandexkubernetesnode_group | Ensure security group is assigned to Kubernetes node group. | Terraform | | | 3691 | CKVYC16 | resource | yandexkubernetescluster | Ensure network policy is assigned to Kubernetes cluster. | Terraform | | | 3692 | CKVYC17 | resource | yandexstoragebucket | Ensure storage bucket does not have public access permissions. | Terraform | | | 3693 | CKVYC18 | resource | yandexcomputeinstance_group | Ensure compute instance group does not have public IP. | Terraform | | | 3694 | CKVYC19 | resource | yandexvpcsecurity_group | Ensure security group does not contain allow-all rules. | Terraform | | | 3695 | CKVYC20 | resource | yandexvpcsecuritygrouprule | Ensure security group rule is not allow-all. | Terraform | | | 3696 | CKVYC21 | resource | yandexorganizationmanagerorganizationiambinding | Ensure organization member does not have elevated access. | Terraform | | | 3697 | CKVYC21 | resource | yandexorganizationmanagerorganizationiammember | Ensure organization member does not have elevated access. | Terraform | | | 3698 | CKVYC22 | resource | yandexcomputeinstance_group | Ensure compute instance group has security group assigned. | Terraform | | | 3699 | CKVYC23 | resource | yandexresourcemanagerfolderiambinding | Ensure folder member does not have elevated access. | Terraform | | | 3700 | CKVYC23 | resource | yandexresourcemanagerfolderiammember | Ensure folder member does not have elevated access. | Terraform | | | 3701 | CKVYC24 | resource | yandexorganizationmanagerorganizationiambinding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | | | 3702 | CKVYC24 | resource | yandexorganizationmanagerorganizationiammember | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | | | 3703 | CKVYC24 | resource | yandexresourcemanagercloudiambinding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | | | 3704 | CKVYC24 | resource | yandexresourcemanagercloudiammember | Ensure passport account is not used for