Repository: aquasecurity/tfsec
Pull request #1270 (2022-01-08 22:08:59)

AWS Autoscaling - convert to use defsec
Closes: https://github.com/aquasecurity/tfsec/issues/1269


Patch:
diff --git a/go.mod b/go.mod
index c248c8c3d..2e2eff2ba 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/google/go-cmp v0.5.6
 	github.com/google/uuid v1.3.0
 	github.com/hashicorp/go-uuid v1.0.2
-	github.com/hashicorp/go-version v1.3.0
+	github.com/hashicorp/go-version v1.4.0
 	github.com/hashicorp/hcl/v2 v2.11.1
 	github.com/inconshreveable/go-update v0.0.0-20160112193335-8152e7eb6ccf
 	github.com/liamg/tml v0.4.0
diff --git a/go.sum b/go.sum
index bd15209e2..ad40440e4 100644
--- a/go.sum
+++ b/go.sum
@@ -74,16 +74,6 @@ github.com/apparentlymart/go-textseg v1.0.0 h1:rRmlIsPEEhUTIKQb7T++Nz/A5Q6C9IuX2
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
-github.com/aquasecurity/defsec v0.2.13 h1:gyiCqQrlM5PcF3TqTaW3YjP8OfcrpKEIz4u19/snHWs=
-github.com/aquasecurity/defsec v0.2.13/go.mod h1:UxYfQXEX2Qd+SFOo+IFGQhYWfZzLHOb5Xxxv5oKdmYM=
-github.com/aquasecurity/defsec v0.2.14 h1:/qRJo9Aa/cV18ycnSOg8u+iEvX9i1NGgImyFr11/+xo=
-github.com/aquasecurity/defsec v0.2.14/go.mod h1:UxYfQXEX2Qd+SFOo+IFGQhYWfZzLHOb5Xxxv5oKdmYM=
-github.com/aquasecurity/defsec v0.3.2 h1:UgSp5bWO1t2V8dkczGAXATH6IHG/Qpemcs82oRygYC0=
-github.com/aquasecurity/defsec v0.3.2/go.mod h1:UxYfQXEX2Qd+SFOo+IFGQhYWfZzLHOb5Xxxv5oKdmYM=
-github.com/aquasecurity/defsec v0.3.3 h1:yH9+bKzOxt0jkORYb1AL/+/1mDr2fuQAvpX79rVw/KE=
-github.com/aquasecurity/defsec v0.3.3/go.mod h1:UxYfQXEX2Qd+SFOo+IFGQhYWfZzLHOb5Xxxv5oKdmYM=
-github.com/aquasecurity/defsec v0.3.4 h1:SwIfv9o+IyAVivn8ySkm9WfdQSRa5myzI8m0PrtH+2E=
-github.com/aquasecurity/defsec v0.3.4/go.mod h1:UxYfQXEX2Qd+SFOo+IFGQhYWfZzLHOb5Xxxv5oKdmYM=
 github.com/aquasecurity/defsec v0.3.5 h1:8aO8HYyo9PYX7Y3ewXdl7c5oo1lQEv1xlcg1akEPryU=
 github.com/aquasecurity/defsec v0.3.5/go.mod h1:UxYfQXEX2Qd+SFOo+IFGQhYWfZzLHOb5Xxxv5oKdmYM=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
@@ -290,8 +280,8 @@ github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.3.0 h1:McDWVJIU/y+u1BRV06dPaLfLCaT7fUTJLp5r04x7iNw=
-github.com/hashicorp/go-version v1.3.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.4.0 h1:aAQzgqIrRKRa7w75CKpbBxYsmUoPjzVm1W59ca1L0J4=
+github.com/hashicorp/go-version v1.4.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
diff --git a/internal/app/tfsec/adapter/aws/autoscaling/adapt.go b/internal/app/tfsec/adapter/aws/autoscaling/adapt.go
index 4b8719b99..89b41d301 100644
--- a/internal/app/tfsec/adapter/aws/autoscaling/adapt.go
+++ b/internal/app/tfsec/adapter/aws/autoscaling/adapt.go
@@ -1,10 +1,110 @@
 package autoscaling
 
 import (
+	"encoding/base64"
+
 	"github.com/aquasecurity/defsec/provider/aws/autoscaling"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) autoscaling.Autoscaling {
-	return autoscaling.Autoscaling{}
+	return autoscaling.Autoscaling{
+		LaunchConfigurations: adaptLaunchConfigurations(modules),
+	}
+}
+
+func adaptLaunchConfigurations(modules []block.Module) []autoscaling.LaunchConfiguration {
+	var launchConfigurations []autoscaling.LaunchConfiguration
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_launch_configuration") {
+			launchConfig := adaptLaunchConfiguration(resource)
+			for _, resource := range module.GetResourcesByType("aws_ebs_encryption_by_default") {
+				if resource.GetAttribute("enabled").NotEqual(false) {
+					launchConfig.RootBlockDevice.Encrypted = types.BoolDefault(true, *resource.GetMetadata())
+					for i := 0; i < len(launchConfig.EBSBlockDevices); i++ {
+						ebs := &launchConfig.EBSBlockDevices[i]
+						ebs.Encrypted = types.BoolDefault(true, *resource.GetMetadata())
+					}
+				}
+			}
+			launchConfigurations = append(launchConfigurations, launchConfig)
+		}
+		for _, resource := range module.GetResourcesByType("aws_instance") {
+			launchConfig := adaptLaunchConfiguration(resource)
+			for _, resource := range module.GetResourcesByType("aws_ebs_encryption_by_default") {
+				if resource.GetAttribute("enabled").NotEqual(false) {
+					launchConfig.RootBlockDevice.Encrypted = types.BoolDefault(true, *resource.GetMetadata())
+					for i := 0; i < len(launchConfig.EBSBlockDevices); i++ {
+						ebs := &launchConfig.EBSBlockDevices[i]
+						ebs.Encrypted = types.BoolDefault(true, *resource.GetMetadata())
+					}
+				}
+			}
+			launchConfigurations = append(launchConfigurations, launchConfig)
+		}
+	}
+	return launchConfigurations
+}
+
+func adaptLaunchConfiguration(resource block.Block) autoscaling.LaunchConfiguration {
+	nameVal := types.String("", *resource.GetMetadata())
+
+	if resource.TypeLabel() == "aws_launch_configuration" {
+		nameAttr := resource.GetAttribute("name")
+		nameVal = nameAttr.AsStringValueOrDefault("", resource)
+	}
+
+	associatePublicIPAddressAttr := resource.GetAttribute("associate_public_ip_address")
+	associatePublicIPAddressVal := associatePublicIPAddressAttr.AsBoolValueOrDefault(false, resource)
+
+	rootEncryptedVal := types.BoolDefault(false, *resource.GetMetadata())
+	var rootBlockDeviceBlock block.Block
+	rootBlockDevice := autoscaling.BlockDevice{
+		Metadata:  *resource.GetMetadata(),
+		Encrypted: rootEncryptedVal,
+	}
+
+	if resource.HasChild("root_block_device") {
+		rootBlockDeviceBlock = resource.GetBlock("root_block_device")
+		encryptedAttr := rootBlockDeviceBlock.GetAttribute("encrypted")
+		rootEncryptedVal = encryptedAttr.AsBoolValueOrDefault(false, rootBlockDeviceBlock)
+		rootBlockDevice = autoscaling.BlockDevice{
+			Metadata:  rootBlockDevice.Metadata,
+			Encrypted: rootEncryptedVal,
+		}
+	}
+
+	var EBSBlockDevices []autoscaling.BlockDevice
+	EBSBlockDevicesBlocks := resource.GetBlocks("ebs_block_device")
+	for _, EBSBlockDevicesBlock := range EBSBlockDevicesBlocks {
+		encryptedAttr := EBSBlockDevicesBlock.GetAttribute("encrypted")
+		encryptedVal := encryptedAttr.AsBoolValueOrDefault(false, EBSBlockDevicesBlock)
+		EBSBlockDevices = append(EBSBlockDevices, autoscaling.BlockDevice{
+			Metadata:  *EBSBlockDevicesBlock.GetMetadata(),
+			Encrypted: encryptedVal,
+		})
+	}
+
+	userDataVal := types.String("", *resource.GetMetadata())
+	if resource.GetAttribute("user_data").IsNotNil() {
+		userDataAttr := resource.GetAttribute("user_data")
+		userDataVal = userDataAttr.AsStringValueOrDefault("", resource)
+	} else if resource.GetAttribute("user_data_base64").IsNotNil() && resource.GetAttribute("user_data_base64").IsString() {
+		userDataBase64Attr := resource.GetAttribute("user_data_base64")
+		encoded, err := base64.StdEncoding.DecodeString(userDataBase64Attr.Value().AsString())
+		if err == nil {
+			userDataVal = types.String(string(encoded), *userDataBase64Attr.GetMetadata())
+		}
+	}
+
+	return autoscaling.LaunchConfiguration{
+		Metadata:          *resource.GetMetadata(),
+		Name:              nameVal,
+		AssociatePublicIP: associatePublicIPAddressVal,
+		RootBlockDevice:   &rootBlockDevice,
+		EBSBlockDevices:   EBSBlockDevices,
+		UserData:          userDataVal,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/cloudfront/adapt.go b/internal/app/tfsec/adapter/aws/cloudfront/adapt.go
index 40627baf7..1b48c8e9a 100644
--- a/internal/app/tfsec/adapter/aws/cloudfront/adapt.go
+++ b/internal/app/tfsec/adapter/aws/cloudfront/adapt.go
@@ -2,9 +2,78 @@ package cloudfront
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/cloudfront"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) cloudfront.Cloudfront {
-	return cloudfront.Cloudfront{}
+	return cloudfront.Cloudfront{
+		Distributions: adaptDistributions(modules),
+	}
+}
+
+func adaptDistributions(modules []block.Module) []cloudfront.Distribution {
+	var distributions []cloudfront.Distribution
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_cloudfront_distribution") {
+			distributions = append(distributions, adaptDistribution(resource))
+		}
+	}
+	return distributions
+}
+
+func adaptDistribution(resource block.Block) cloudfront.Distribution {
+	WAFIDAtrr := resource.GetAttribute("web_acl_id")
+	WAFIDAVal := WAFIDAtrr.AsStringValueOrDefault("", resource)
+
+	defaultCacheBehaviour := cloudfront.CacheBehaviour{
+		Metadata:             *resource.GetMetadata(),
+		ViewerProtocolPolicy: types.String("allow-all", *resource.GetMetadata()),
+	}
+	var orderedCacheBehaviours []cloudfront.CacheBehaviour
+
+	bucketVal := types.String("", *resource.GetMetadata())
+	if resource.HasChild("logging_config") {
+		loggingBlock := resource.GetBlock("logging_config")
+		bucketAttr := loggingBlock.GetAttribute("bucket")
+		bucketVal = bucketAttr.AsStringValueOrDefault("", loggingBlock)
+	}
+
+	if resource.HasChild("default_cache_behavior") {
+		defaultCacheBlock := resource.GetBlock("default_cache_behavior")
+		defaultCacheBehaviour.Metadata = *defaultCacheBlock.GetMetadata()
+		ViewerProtocolPolicyAttr := defaultCacheBlock.GetAttribute("viewer_protocol_policy")
+		defaultCacheBehaviour.ViewerProtocolPolicy = ViewerProtocolPolicyAttr.AsStringValueOrDefault("allow-all", defaultCacheBlock)
+	}
+
+	orderedCacheBlocks := resource.GetBlocks("ordered_cache_behavior")
+	for _, orderedCacheBlock := range orderedCacheBlocks {
+		ViewerProtocolPolicyAttr := orderedCacheBlock.GetAttribute("viewer_protocol_policy")
+		ViewerProtocolPolicyVal := ViewerProtocolPolicyAttr.AsStringValueOrDefault("allow-all", orderedCacheBlock)
+
+		orderedCacheBehaviours = append(orderedCacheBehaviours, cloudfront.CacheBehaviour{
+			Metadata:             *orderedCacheBlock.GetMetadata(),
+			ViewerProtocolPolicy: ViewerProtocolPolicyVal,
+		})
+	}
+
+	minProtocolVal := types.String("", *resource.GetMetadata())
+	if resource.HasChild("viewer_certificate") {
+		viewerCertBlock := resource.GetBlock("viewer_certificate")
+		minProtocolAttr := viewerCertBlock.GetAttribute("minimum_protocol_version")
+		minProtocolVal = minProtocolAttr.AsStringValueOrDefault("TLSv1", viewerCertBlock)
+	}
+
+	return cloudfront.Distribution{
+		Metadata: *resource.GetMetadata(),
+		WAFID:    WAFIDAVal,
+		Logging: cloudfront.Logging{
+			Bucket: bucketVal,
+		},
+		DefaultCacheBehaviour:  defaultCacheBehaviour,
+		OrdererCacheBehaviours: orderedCacheBehaviours,
+		ViewerCertificate: cloudfront.ViewerCertificate{
+			MinimumProtocolVersion: minProtocolVal,
+		},
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/cloudtrail/adapt.go b/internal/app/tfsec/adapter/aws/cloudtrail/adapt.go
index 13f7156ea..c5ee13d63 100644
--- a/internal/app/tfsec/adapter/aws/cloudtrail/adapt.go
+++ b/internal/app/tfsec/adapter/aws/cloudtrail/adapt.go
@@ -6,5 +6,40 @@ import (
 )
 
 func Adapt(modules []block.Module) cloudtrail.CloudTrail {
-	return cloudtrail.CloudTrail{}
+	return cloudtrail.CloudTrail{
+		Trails: adaptTrails(modules),
+	}
+}
+
+func adaptTrails(modules []block.Module) []cloudtrail.Trail {
+	var trails []cloudtrail.Trail
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_cloudtrail") {
+			trails = append(trails, adaptTrail(resource))
+		}
+	}
+	return trails
+}
+
+func adaptTrail(resource block.Block) cloudtrail.Trail {
+	nameAttr := resource.GetAttribute("name")
+	nameVal := nameAttr.AsStringValueOrDefault("", resource)
+
+	enableLogFileValidationAttr := resource.GetAttribute("enable_log_file_validation")
+	enableLogFileValidationVal := enableLogFileValidationAttr.AsBoolValueOrDefault(false, resource)
+
+	isMultiRegionAttr := resource.GetAttribute("is_multi_region_trail")
+	isMultiRegionVal := isMultiRegionAttr.AsBoolValueOrDefault(false, resource)
+
+	KMSKeyIDAttr := resource.GetAttribute("kms_key_id")
+	KMSKeyIDVal := KMSKeyIDAttr.AsStringValueOrDefault("", resource)
+
+	return cloudtrail.Trail{
+		Metadata:                *resource.GetMetadata(),
+		Name:                    nameVal,
+		EnableLogFileValidation: enableLogFileValidationVal,
+		IsMultiRegion:           isMultiRegionVal,
+		KMSKeyID:                KMSKeyIDVal,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/cloudwatch/adapt.go b/internal/app/tfsec/adapter/aws/cloudwatch/adapt.go
index e6054ce58..c600a1495 100644
--- a/internal/app/tfsec/adapter/aws/cloudwatch/adapt.go
+++ b/internal/app/tfsec/adapter/aws/cloudwatch/adapt.go
@@ -6,5 +6,35 @@ import (
 )
 
 func Adapt(modules []block.Module) cloudwatch.CloudWatch {
-	return cloudwatch.CloudWatch{}
+	return cloudwatch.CloudWatch{
+		LogGroups: adaptLogGroups(modules),
+	}
+}
+
+func adaptLogGroups(modules []block.Module) []cloudwatch.LogGroup {
+	var logGroups []cloudwatch.LogGroup
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_cloudwatch_log_group") {
+			logGroups = append(logGroups, adaptLogGroup(resource))
+		}
+	}
+	return logGroups
+}
+
+func adaptLogGroup(resource block.Block) cloudwatch.LogGroup {
+	nameAttr := resource.GetAttribute("name")
+	nameVal := nameAttr.AsStringValueOrDefault("", resource)
+
+	KMSKeyIDAttr := resource.GetAttribute("kms_key_id")
+	KMSKeyIDVal := KMSKeyIDAttr.AsStringValueOrDefault("", resource)
+
+	retentionInDaysAttr := resource.GetAttribute("retention_in_days")
+	retentionInDaysVal := retentionInDaysAttr.AsIntValueOrDefault(0, resource)
+
+	return cloudwatch.LogGroup{
+		Metadata:        *resource.GetMetadata(),
+		Name:            nameVal,
+		KMSKeyID:        KMSKeyIDVal,
+		RetentionInDays: retentionInDaysVal,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/codebuild/adapt.go b/internal/app/tfsec/adapter/aws/codebuild/adapt.go
index 8349ae2ed..07edd9e24 100644
--- a/internal/app/tfsec/adapter/aws/codebuild/adapt.go
+++ b/internal/app/tfsec/adapter/aws/codebuild/adapt.go
@@ -2,9 +2,65 @@ package codebuild
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/codebuild"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) codebuild.CodeBuild {
-	return codebuild.CodeBuild{}
+	return codebuild.CodeBuild{
+		Projects: adaptProjects(modules),
+	}
+}
+
+func adaptProjects(modules []block.Module) []codebuild.Project {
+	var projects []codebuild.Project
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_codebuild_project") {
+			projects = append(projects, adaptProject(resource))
+		}
+	}
+	return projects
+}
+
+func adaptProject(resource block.Block) codebuild.Project {
+	artifactsBlock := resource.GetBlock("artifacts")
+	encryptionEnabled := types.BoolDefault(true, *resource.GetMetadata())
+
+	if artifactsBlock.IsNotNil() {
+		typeAttr := artifactsBlock.GetAttribute("type")
+		encryptionDisabledAttr := artifactsBlock.GetAttribute("encryption_disabled")
+
+		if encryptionDisabledAttr.IsTrue() && typeAttr.NotEqual("NO_ARTIFACTS") {
+			encryptionEnabled = types.Bool(false, *artifactsBlock.GetMetadata())
+		} else {
+			encryptionEnabled = types.Bool(true, *artifactsBlock.GetMetadata())
+		}
+	}
+
+	var secondaryArtifacts []codebuild.ArtifactSettings
+	secondaryArtifactBlocks := resource.GetBlocks("secondary_artifacts")
+
+	for _, secondaryArtifactBlock := range secondaryArtifactBlocks {
+
+		secondaryEncryptionEnabled := types.BoolDefault(true, *secondaryArtifactBlock.GetMetadata())
+		secondaryEncryptionDisabledAttr := secondaryArtifactBlock.GetAttribute("encryption_disabled")
+		secondaryTypeAttr := artifactsBlock.GetAttribute("type")
+
+		if secondaryEncryptionDisabledAttr.IsTrue() && secondaryTypeAttr.NotEqual("NO_ARTIFACTS") {
+			secondaryEncryptionEnabled = types.Bool(false, *secondaryArtifactBlock.GetMetadata())
+		}
+
+		secondaryArtifacts = append(secondaryArtifacts, codebuild.ArtifactSettings{
+			Metadata:          *secondaryArtifactBlock.GetMetadata(),
+			EncryptionEnabled: secondaryEncryptionEnabled,
+		})
+	}
+
+	return codebuild.Project{
+		Metadata: *resource.GetMetadata(),
+		ArtifactSettings: codebuild.ArtifactSettings{
+			EncryptionEnabled: encryptionEnabled,
+		},
+		SecondaryArtifactSettings: secondaryArtifacts,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/config/adapt.go b/internal/app/tfsec/adapter/aws/config/adapt.go
index e687f6d4e..f688a1625 100644
--- a/internal/app/tfsec/adapter/aws/config/adapt.go
+++ b/internal/app/tfsec/adapter/aws/config/adapt.go
@@ -2,9 +2,32 @@ package config
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/config"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) config.Config {
-	return config.Config{}
+	return config.Config{
+		ConfigurationAggregrator: adaptConfigurationAggregrator(modules),
+	}
+}
+
+func adaptConfigurationAggregrator(modules []block.Module) config.ConfigurationAggregrator {
+	var configurationAggregrator config.ConfigurationAggregrator
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_config_configuration_aggregator") {
+			configurationAggregrator.IsDefined = true
+
+			aggregationBlock := resource.GetFirstMatchingBlock("account_aggregation_source", "organization_aggregation_source")
+			if aggregationBlock.IsNil() {
+				configurationAggregrator.SourceAllRegions = types.Bool(false, *resource.GetMetadata())
+			} else {
+				allRegionsAttr := aggregationBlock.GetAttribute("all_regions")
+				allRegionsVal := allRegionsAttr.AsBoolValueOrDefault(false, aggregationBlock)
+				configurationAggregrator.SourceAllRegions = allRegionsVal
+			}
+		}
+	}
+	return configurationAggregrator
 }
diff --git a/internal/app/tfsec/adapter/aws/ebs/adapt.go b/internal/app/tfsec/adapter/aws/ebs/adapt.go
index af994cd5a..b91c1a9f5 100644
--- a/internal/app/tfsec/adapter/aws/ebs/adapt.go
+++ b/internal/app/tfsec/adapter/aws/ebs/adapt.go
@@ -6,5 +6,33 @@ import (
 )
 
 func Adapt(modules []block.Module) ebs.EBS {
-	return ebs.EBS{}
+	return ebs.EBS{
+		Volumes: adaptVolumes(modules),
+	}
+}
+
+func adaptVolumes(modules []block.Module) []ebs.Volume {
+	var volumes []ebs.Volume
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_ebs_volume") {
+			volumes = append(volumes, adaptVolume(resource))
+		}
+	}
+	return volumes
+}
+
+func adaptVolume(resource block.Block) ebs.Volume {
+	encryptedAttr := resource.GetAttribute("encrypted")
+	encryptedVal := encryptedAttr.AsBoolValueOrDefault(false, resource)
+
+	kmsKeyAttr := resource.GetAttribute("kms_key_id")
+	kmsKeyVal := kmsKeyAttr.AsStringValueOrDefault("", resource)
+
+	return ebs.Volume{
+		Metadata: *resource.GetMetadata(),
+		Encryption: ebs.Encryption{
+			Enabled:  encryptedVal,
+			KMSKeyID: kmsKeyVal,
+		},
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/efs/adapt.go b/internal/app/tfsec/adapter/aws/efs/adapt.go
index 06d2f9ec6..ddbff10a9 100644
--- a/internal/app/tfsec/adapter/aws/efs/adapt.go
+++ b/internal/app/tfsec/adapter/aws/efs/adapt.go
@@ -6,5 +6,27 @@ import (
 )
 
 func Adapt(modules []block.Module) efs.EFS {
-	return efs.EFS{}
+	return efs.EFS{
+		FileSystems: adaptFileSystems(modules),
+	}
+}
+
+func adaptFileSystems(modules []block.Module) []efs.FileSystem {
+	var filesystems []efs.FileSystem
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_efs_file_system") {
+			filesystems = append(filesystems, adaptFileSystem(resource))
+		}
+	}
+	return filesystems
+}
+
+func adaptFileSystem(resource block.Block) efs.FileSystem {
+	encryptedAttr := resource.GetAttribute("encrypted")
+	encryptedVal := encryptedAttr.AsBoolValueOrDefault(false, resource)
+
+	return efs.FileSystem{
+		Metadata:  *resource.GetMetadata(),
+		Encrypted: encryptedVal,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/elasticache/adapt.go b/internal/app/tfsec/adapter/aws/elasticache/adapt.go
index dbf4b800c..cde733bab 100644
--- a/internal/app/tfsec/adapter/aws/elasticache/adapt.go
+++ b/internal/app/tfsec/adapter/aws/elasticache/adapt.go
@@ -6,5 +6,80 @@ import (
 )
 
 func Adapt(modules []block.Module) elasticache.ElastiCache {
-	return elasticache.ElastiCache{}
+	return elasticache.ElastiCache{
+		Clusters:          adaptClusters(modules),
+		ReplicationGroups: adaptReplicationGroups(modules),
+		SecurityGroups:    adaptSecurityGroups(modules),
+	}
+}
+func adaptClusters(modules []block.Module) []elasticache.Cluster {
+	var clusters []elasticache.Cluster
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_elasticache_cluster") {
+			clusters = append(clusters, adaptCluster(resource))
+		}
+	}
+	return clusters
+}
+
+func adaptReplicationGroups(modules []block.Module) []elasticache.ReplicationGroup {
+	var replicationGroups []elasticache.ReplicationGroup
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_elasticache_replication_group") {
+			replicationGroups = append(replicationGroups, adaptReplicationGroup(resource))
+		}
+	}
+	return replicationGroups
+}
+
+func adaptSecurityGroups(modules []block.Module) []elasticache.SecurityGroup {
+	var securityGroups []elasticache.SecurityGroup
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_elasticache_security_group") {
+			securityGroups = append(securityGroups, adaptSecurityGroup(resource))
+		}
+	}
+	return securityGroups
+}
+
+func adaptCluster(resource block.Block) elasticache.Cluster {
+	engineAttr := resource.GetAttribute("engine")
+	engineVal := engineAttr.AsStringValueOrDefault("", resource)
+
+	nodeTypeAttr := resource.GetAttribute("node_type")
+	nodeTypeVal := nodeTypeAttr.AsStringValueOrDefault("", resource)
+
+	snapshotRetentionAttr := resource.GetAttribute("snapshot_retention_limit")
+	snapshotRetentionVal := snapshotRetentionAttr.AsIntValueOrDefault(0, resource)
+
+	return elasticache.Cluster{
+		Metadata:               *resource.GetMetadata(),
+		Engine:                 engineVal,
+		NodeType:               nodeTypeVal,
+		SnapshotRetentionLimit: snapshotRetentionVal,
+	}
+}
+
+func adaptReplicationGroup(resource block.Block) elasticache.ReplicationGroup {
+	transitEncryptionAttr := resource.GetAttribute("transit_encryption_enabled")
+	transitEncryptionVal := transitEncryptionAttr.AsBoolValueOrDefault(false, resource)
+
+	atRestEncryptionAttr := resource.GetAttribute("at_rest_encryption_enabled")
+	atRestEncryptionVal := atRestEncryptionAttr.AsBoolValueOrDefault(false, resource)
+
+	return elasticache.ReplicationGroup{
+		Metadata:                 *resource.GetMetadata(),
+		TransitEncryptionEnabled: transitEncryptionVal,
+		AtRestEncryptionEnabled:  atRestEncryptionVal,
+	}
+}
+
+func adaptSecurityGroup(resource block.Block) elasticache.SecurityGroup {
+	descriptionAttr := resource.GetAttribute("description")
+	descriptionVal := descriptionAttr.AsStringValueOrDefault("Managed by Terraform", resource)
+
+	return elasticache.SecurityGroup{
+		Metadata:    *resource.GetMetadata(),
+		Description: descriptionVal,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/elb/adapt.go b/internal/app/tfsec/adapter/aws/elb/adapt.go
index 5cd2f6988..64b4f5526 100644
--- a/internal/app/tfsec/adapter/aws/elb/adapt.go
+++ b/internal/app/tfsec/adapter/aws/elb/adapt.go
@@ -2,9 +2,75 @@ package elb
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/elb"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) elb.ELB {
-	return elb.ELB{}
+	return elb.ELB{
+		LoadBalancers: adaptLoadBalancers(modules),
+	}
+}
+
+func adaptLoadBalancers(modules []block.Module) []elb.LoadBalancer {
+	var loadBalancers []elb.LoadBalancer
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_lb") {
+			loadBalancers = append(loadBalancers, adaptLoadBalancer(resource, module))
+		}
+		for _, resource := range module.GetResourcesByType("aws_alb") {
+			loadBalancers = append(loadBalancers, adaptLoadBalancer(resource, module))
+		}
+	}
+	return loadBalancers
+}
+
+func adaptLoadBalancer(resource block.Block, module block.Module) elb.LoadBalancer {
+	var listeners []elb.Listener
+
+	typeAttr := resource.GetAttribute("load_balancer_type")
+	typeVal := typeAttr.AsStringValueOrDefault("application", resource)
+
+	dropInvalidHeadersAttr := resource.GetAttribute("drop_invalid_header_fields")
+	dropInvalidHeadersVal := dropInvalidHeadersAttr.AsBoolValueOrDefault(false, resource)
+
+	internalAttr := resource.GetAttribute("internal")
+	internalVal := internalAttr.AsBoolValueOrDefault(false, resource)
+
+	listenerBlocks := module.GetReferencingResources(resource, "aws_lb_listener", "load_balancer_arn")
+	listenerBlocks = append(listenerBlocks, module.GetReferencingResources(resource, "aws_alb_listener", "load_balancer_arn")...)
+
+	for _, listenerBlock := range listenerBlocks {
+		protocolAttr := listenerBlock.GetAttribute("protocol")
+		protocolVal := protocolAttr.AsStringValueOrDefault("", listenerBlock)
+		if typeVal.EqualTo("application") {
+			protocolVal = protocolAttr.AsStringValueOrDefault("HTTP", listenerBlock)
+		}
+
+		sslPolicyAttr := listenerBlock.GetAttribute("ssl_policy")
+		sslPolicyVal := sslPolicyAttr.AsStringValueOrDefault("", listenerBlock)
+
+		actionTypeVal := types.String("", *listenerBlock.GetMetadata())
+		if listenerBlock.HasChild("default_action") {
+			defaultActionBlock := listenerBlock.GetBlock("default_action")
+			actionTypeAttr := defaultActionBlock.GetAttribute("type")
+			actionTypeVal = actionTypeAttr.AsStringValueOrDefault("", defaultActionBlock)
+		}
+
+		listeners = append(listeners, elb.Listener{
+			Metadata:  *listenerBlock.GetMetadata(),
+			Protocol:  protocolVal,
+			TLSPolicy: sslPolicyVal,
+			DefaultAction: elb.Action{
+				Type: actionTypeVal,
+			},
+		})
+	}
+	return elb.LoadBalancer{
+		Metadata:                *resource.GetMetadata(),
+		Type:                    typeVal,
+		DropInvalidHeaderFields: dropInvalidHeadersVal,
+		Internal:                internalVal,
+		Listeners:               listeners,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/kinesis/adapt.go b/internal/app/tfsec/adapter/aws/kinesis/adapt.go
index 84eaa2492..d422bfbaf 100644
--- a/internal/app/tfsec/adapter/aws/kinesis/adapt.go
+++ b/internal/app/tfsec/adapter/aws/kinesis/adapt.go
@@ -6,5 +6,33 @@ import (
 )
 
 func Adapt(modules []block.Module) kinesis.Kinesis {
-	return kinesis.Kinesis{}
+	return kinesis.Kinesis{
+		Streams: adaptStreams(modules),
+	}
+}
+
+func adaptStreams(modules []block.Module) []kinesis.Stream {
+	var streams []kinesis.Stream
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_kinesis_stream") {
+			streams = append(streams, adaptStream(resource))
+		}
+	}
+	return streams
+}
+
+func adaptStream(resource block.Block) kinesis.Stream {
+	encryptionTypeAttr := resource.GetAttribute("encryption_type")
+	encryptionTypeVal := encryptionTypeAttr.AsStringValueOrDefault("NONE", resource)
+
+	KMSKeyIDAttr := resource.GetAttribute("kms_key_id")
+	KMSKeyIDVal := KMSKeyIDAttr.AsStringValueOrDefault("", resource)
+
+	return kinesis.Stream{
+		Metadata: *resource.GetMetadata(),
+		Encryption: kinesis.Encryption{
+			Type:     encryptionTypeVal,
+			KMSKeyID: KMSKeyIDVal,
+		},
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/lambda/adapt.go b/internal/app/tfsec/adapter/aws/lambda/adapt.go
index 36bcc6d61..ebfd242f6 100644
--- a/internal/app/tfsec/adapter/aws/lambda/adapt.go
+++ b/internal/app/tfsec/adapter/aws/lambda/adapt.go
@@ -2,9 +2,59 @@ package lambda
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/lambda"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) lambda.Lambda {
-	return lambda.Lambda{}
+	return lambda.Lambda{
+		Functions: adaptFunctions(modules),
+	}
+}
+
+func adaptFunctions(modules []block.Module) []lambda.Function {
+	var functions []lambda.Function
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_lambda_function") {
+			functions = append(functions, adaptFunction(resource, modules))
+		}
+	}
+	return functions
+}
+
+func adaptFunction(function block.Block, modules []block.Module) lambda.Function {
+	return lambda.Function{
+		Metadata:    function.Metadata(),
+		Tracing:     adaptTracing(function),
+		Permissions: adaptPermissions(function, modules),
+	}
+}
+
+func adaptTracing(function block.Block) lambda.Tracing {
+	if tracingConfig := function.GetBlock("tracing_config"); tracingConfig.IsNotNil() {
+		return lambda.Tracing{
+			Mode: tracingConfig.GetAttribute("mode").AsStringValueOrDefault("", tracingConfig),
+		}
+	}
+
+	return lambda.Tracing{
+		Mode: types.StringDefault("", function.Metadata()),
+	}
+}
+
+func adaptPermissions(function block.Block, modules []block.Module) []lambda.Permission {
+	var permissions []lambda.Permission
+	for _, module := range modules {
+		for _, permission := range module.GetResourcesByType("aws_lambda_permission") {
+			var functionName = function.GetAttribute("function_name").AsStringValueOrDefault("", function)
+			var permissionFunctionName = permission.GetAttribute("function_name").AsStringValueOrDefault("", permission)
+			if functionName.EqualTo(permissionFunctionName.Value()) {
+				permissions = append(permissions, lambda.Permission{
+					Principal: permission.GetAttribute("principal").AsStringValueOrDefault("", permission),
+					SourceARN: permission.GetAttribute("source_arn").AsStringValueOrDefault("", permission),
+				})
+			}
+		}
+	}
+	return permissions
 }
diff --git a/internal/app/tfsec/adapter/aws/mq/adapt.go b/internal/app/tfsec/adapter/aws/mq/adapt.go
index e81bb9e11..6fd59a359 100644
--- a/internal/app/tfsec/adapter/aws/mq/adapt.go
+++ b/internal/app/tfsec/adapter/aws/mq/adapt.go
@@ -2,9 +2,49 @@ package mq
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/mq"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) mq.MQ {
-	return mq.MQ{}
+	return mq.MQ{
+		Brokers: adaptBrokers(modules),
+	}
+}
+
+func adaptBrokers(modules []block.Module) []mq.Broker {
+	var brokers []mq.Broker
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_mq_broker") {
+			brokers = append(brokers, adaptBroker(resource))
+		}
+	}
+	return brokers
+}
+
+func adaptBroker(resource block.Block) mq.Broker {
+	publicAccessAttr := resource.GetAttribute("publicly_accessible")
+	publicAccessVal := publicAccessAttr.AsBoolValueOrDefault(false, resource)
+
+	auditVal := types.Bool(false, *resource.GetMetadata())
+	generalVal := types.Bool(false, *resource.GetMetadata())
+
+	if resource.HasChild("logs") {
+		logsBlock := resource.GetBlock("logs")
+
+		auditAttr := logsBlock.GetAttribute("audit")
+		auditVal = auditAttr.AsBoolValueOrDefault(false, logsBlock)
+
+		generalAttr := logsBlock.GetAttribute("general")
+		generalVal = generalAttr.AsBoolValueOrDefault(false, logsBlock)
+	}
+
+	return mq.Broker{
+		Metadata:     *resource.GetMetadata(),
+		PublicAccess: publicAccessVal,
+		Logging: mq.Logging{
+			General: generalVal,
+			Audit:   auditVal,
+		},
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/neptune/adapt.go b/internal/app/tfsec/adapter/aws/neptune/adapt.go
index 252be19df..8ae2f3a87 100644
--- a/internal/app/tfsec/adapter/aws/neptune/adapt.go
+++ b/internal/app/tfsec/adapter/aws/neptune/adapt.go
@@ -2,9 +2,45 @@ package neptune
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/neptune"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) neptune.Neptune {
-	return neptune.Neptune{}
+	return neptune.Neptune{
+		Clusters: adaptClusters(modules),
+	}
+}
+
+func adaptClusters(modules []block.Module) []neptune.Cluster {
+	var clusters []neptune.Cluster
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_neptune_cluster") {
+			clusters = append(clusters, adaptCluster(resource))
+		}
+	}
+	return clusters
+}
+
+func adaptCluster(resource block.Block) neptune.Cluster {
+	enableLogExportsAttr := resource.GetAttribute("enable_cloudwatch_logs_exports")
+	auditVal := types.BoolDefault(false, *resource.GetMetadata())
+	if enableLogExportsAttr.Contains("audit") {
+		auditVal = types.Bool(true, *resource.GetMetadata())
+	}
+
+	storageEncryptedAttr := resource.GetAttribute("storage_encrypted")
+	storageEncryptedVal := storageEncryptedAttr.AsBoolValueOrDefault(false, resource)
+
+	KMSKeyAttr := resource.GetAttribute("kms_key_arn")
+	KMSKeyVal := KMSKeyAttr.AsStringValueOrDefault("", resource)
+
+	return neptune.Cluster{
+		Metadata: *resource.GetMetadata(),
+		Logging: neptune.Logging{
+			Audit: auditVal,
+		},
+		StorageEncrypted: storageEncryptedVal,
+		KMSKeyID:         KMSKeyVal,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/redshift/adapt.go b/internal/app/tfsec/adapter/aws/redshift/adapt.go
index 27361d83f..be021d060 100644
--- a/internal/app/tfsec/adapter/aws/redshift/adapt.go
+++ b/internal/app/tfsec/adapter/aws/redshift/adapt.go
@@ -6,5 +6,58 @@ import (
 )
 
 func Adapt(modules []block.Module) redshift.Redshift {
-	return redshift.Redshift{}
+	return redshift.Redshift{
+		Clusters:       adaptClusters(modules),
+		SecurityGroups: adaptSecurityGroups(modules),
+	}
+}
+
+func adaptClusters(modules []block.Module) []redshift.Cluster {
+	var clusters []redshift.Cluster
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_redshift_cluster") {
+			clusters = append(clusters, adaptCluster(resource))
+		}
+	}
+	return clusters
+}
+
+func adaptSecurityGroups(modules []block.Module) []redshift.SecurityGroup {
+	var securityGroups []redshift.SecurityGroup
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_redshift_security_group") {
+			securityGroups = append(securityGroups, adaptSecurityGroup(resource))
+		}
+	}
+	return securityGroups
+}
+
+func adaptCluster(resource block.Block) redshift.Cluster {
+	encryptedAttr := resource.GetAttribute("encrypted")
+	encryptedVal := encryptedAttr.AsBoolValueOrDefault(false, resource)
+
+	KMSKeyIDAttr := resource.GetAttribute("kms_key_id")
+	KMSKeyIDVal := KMSKeyIDAttr.AsStringValueOrDefault("", resource)
+
+	subnetGroupNameAttr := resource.GetAttribute("cluster_subnet_group_name")
+	subnetGroupNameVal := subnetGroupNameAttr.AsStringValueOrDefault("", resource)
+
+	return redshift.Cluster{
+		Metadata: *resource.GetMetadata(),
+		Encryption: redshift.Encryption{
+			Enabled:  encryptedVal,
+			KMSKeyID: KMSKeyIDVal,
+		},
+		SubnetGroupName: subnetGroupNameVal,
+	}
+}
+
+func adaptSecurityGroup(resource block.Block) redshift.SecurityGroup {
+	descriptionAttr := resource.GetAttribute("description")
+	descriptionVal := descriptionAttr.AsStringValueOrDefault("Managed by Terraform", resource)
+
+	return redshift.SecurityGroup{
+		Metadata:    *resource.GetMetadata(),
+		Description: descriptionVal,
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/sns/adapt.go b/internal/app/tfsec/adapter/aws/sns/adapt.go
index 17498dab3..30e7a46db 100644
--- a/internal/app/tfsec/adapter/aws/sns/adapt.go
+++ b/internal/app/tfsec/adapter/aws/sns/adapt.go
@@ -6,5 +6,30 @@ import (
 )
 
 func Adapt(modules []block.Module) sns.SNS {
-	return sns.SNS{}
+	return sns.SNS{
+		Topics: adaptTopics(modules),
+	}
+}
+
+func adaptTopics(modules []block.Module) []sns.Topic {
+	var topics []sns.Topic
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_sns_topic") {
+			topics = append(topics, adaptTopic(resource))
+		}
+	}
+	return topics
+}
+
+func adaptTopic(resourceBlock block.Block) sns.Topic {
+	return sns.Topic{
+		Metadata: resourceBlock.Metadata(),
+		Encryption: adaptEncryption(resourceBlock),
+	}
+}
+
+func adaptEncryption(resourceBlock block.Block) sns.Encryption {
+	return sns.Encryption{
+		KMSKeyID: resourceBlock.GetAttribute("kms_master_key_id").AsStringValueOrDefault("alias/aws/sns", resourceBlock),
+	}
 }
diff --git a/internal/app/tfsec/rules/aws/autoscaling/enable_at_rest_encryption_rule.go b/internal/app/tfsec/rules/aws/autoscaling/enable_at_rest_encryption_rule.go
index 208c2c92a..2152741dd 100644
--- a/internal/app/tfsec/rules/aws/autoscaling/enable_at_rest_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/autoscaling/enable_at_rest_encryption_rule.go
@@ -1,9 +1,7 @@
 package autoscaling
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/autoscaling"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -31,39 +29,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_launch_configuration"},
 		Base:           autoscaling.CheckEnableAtRestEncryption,
-		CheckTerraform: func(resourceBlock block.Block, module block.Module) (results rules.Results) {
-
-			var encryptionByDefault bool
-			for _, defaultEncryptionBlock := range module.GetResourcesByType("aws_ebs_encryption_by_default") {
-				enabledAttr := defaultEncryptionBlock.GetAttribute("enabled")
-				if enabledAttr.IsTrue() {
-					encryptionByDefault = true
-				}
-			}
-
-			rootDeviceBlock := resourceBlock.GetBlock("root_block_device")
-			if rootDeviceBlock.IsNil() && !encryptionByDefault {
-				results.Add("Resource uses an unencrypted root EBS block device. Consider adding 'root_block_device{ encrypted = true }'", resourceBlock)
-			} else if rootDeviceBlock.IsNotNil() {
-				results = append(results, checkDeviceEncryption(rootDeviceBlock, encryptionByDefault, resourceBlock)...)
-			}
-
-			ebsDeviceBlocks := resourceBlock.GetBlocks("ebs_block_device")
-			for _, ebsDeviceBlock := range ebsDeviceBlocks {
-				results = append(results, checkDeviceEncryption(ebsDeviceBlock, encryptionByDefault, resourceBlock)...)
-			}
-
-			return results
-		},
 	})
 }
-
-func checkDeviceEncryption(deviceBlock block.Block, encryptionByDefault bool, resourceBlock block.Block) (results rules.Results) {
-	encryptedAttr := deviceBlock.GetAttribute("encrypted")
-	if encryptedAttr.IsNil() && !encryptionByDefault {
-		results.Add("Resource uses an unencrypted EBS block device. Consider adding 'encrypted = true'", deviceBlock)
-	} else if encryptedAttr.IsFalse() {
-		results.Add("Resource uses an unencrypted root EBS block device.", encryptedAttr)
-	}
-	return results
-}
diff --git a/internal/app/tfsec/rules/aws/autoscaling/no_public_ip_rule.go b/internal/app/tfsec/rules/aws/autoscaling/no_public_ip_rule.go
index 4d7e3093b..0a52b6b25 100644
--- a/internal/app/tfsec/rules/aws/autoscaling/no_public_ip_rule.go
+++ b/internal/app/tfsec/rules/aws/autoscaling/no_public_ip_rule.go
@@ -1,9 +1,7 @@
 package autoscaling
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/autoscaling"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -28,18 +26,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_launch_configuration", "aws_instance"},
 		Base:           autoscaling.CheckNoPublicIp,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("associate_public_ip_address") {
-				return
-			}
-
-			publicAttr := resourceBlock.GetAttribute("associate_public_ip_address")
-			if publicAttr.IsTrue() {
-				results.Add("Resource has a public IP address associated.", publicAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/autoscaling/no_sensitive_info_rule.go b/internal/app/tfsec/rules/aws/autoscaling/no_sensitive_info_rule.go
index 6d3d24c01..bd459b4bb 100644
--- a/internal/app/tfsec/rules/aws/autoscaling/no_sensitive_info_rule.go
+++ b/internal/app/tfsec/rules/aws/autoscaling/no_sensitive_info_rule.go
@@ -1,15 +1,9 @@
 package autoscaling
 
 import (
-	"encoding/base64"
-
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/autoscaling"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/debug"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
-	"github.com/owenrumney/squealer/pkg/squealer"
 )
 
 func init() {
@@ -59,38 +53,5 @@ func init() {
 			"aws_launch_configuration",
 		},
 		Base: autoscaling.CheckNoSensitiveInfo,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("user_data") && resourceBlock.MissingChild("user_data_base64") {
-				return
-			}
-
-			customDataAttr := resourceBlock.GetAttribute("user_data")
-			customDataBase64Attr := resourceBlock.GetAttribute("user_data_base64")
-
-			if customDataAttr.IsNotNil() {
-				for _, str := range customDataAttr.ValueAsStrings() {
-					if checkStringForSensitive(str) {
-						results.Add("Resource has user_data with sensitive data.", customDataAttr)
-					}
-				}
-			}
-
-			if customDataBase64Attr.IsNotNil() && customDataBase64Attr.IsString() {
-				encoded, err := base64.StdEncoding.DecodeString(customDataBase64Attr.Value().AsString())
-				if err != nil {
-					debug.Log("could not decode the base64 string in the terraform, trying with the string verbatim")
-					encoded = []byte(customDataAttr.Value().AsString())
-				}
-				if checkStringForSensitive(string(encoded)) {
-					results.Add("Resource has user_data_base64 with sensitive data.", customDataBase64Attr)
-				}
-			}
-			return results
-		},
 	})
 }
-
-func checkStringForSensitive(stringToCheck string) bool {
-	return squealer.NewStringScanner().Scan(stringToCheck).TransgressionFound
-}
diff --git a/internal/app/tfsec/rules/aws/cloudfront/enable_logging_rule.go b/internal/app/tfsec/rules/aws/cloudfront/enable_logging_rule.go
index f28e9f2d5..ca031b6a9 100644
--- a/internal/app/tfsec/rules/aws/cloudfront/enable_logging_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudfront/enable_logging_rule.go
@@ -1,9 +1,7 @@
 package cloudfront
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/cloudfront"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -33,11 +31,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_cloudfront_distribution"},
 		Base:           cloudfront.CheckEnableLogging,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if resourceBlock.MissingChild("logging_config") {
-				results.Add("Resource does not have Access Logging configured", resourceBlock)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/cloudfront/enable_waf_rule.go b/internal/app/tfsec/rules/aws/cloudfront/enable_waf_rule.go
index 0b38c7210..e02508b32 100644
--- a/internal/app/tfsec/rules/aws/cloudfront/enable_waf_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudfront/enable_waf_rule.go
@@ -1,9 +1,7 @@
 package cloudfront
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/cloudfront"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -82,14 +80,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_cloudfront_distribution"},
 		Base:           cloudfront.CheckEnableWaf,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			wafAclIdBlock := resourceBlock.GetAttribute("web_acl_id")
-			if wafAclIdBlock.IsNil() {
-				results.Add("Resource does not have a WAF in front of it.", resourceBlock)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/cloudfront/enforce_https_rule.go b/internal/app/tfsec/rules/aws/cloudfront/enforce_https_rule.go
index 587f8fde4..574c0ae66 100644
--- a/internal/app/tfsec/rules/aws/cloudfront/enforce_https_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudfront/enforce_https_rule.go
@@ -1,9 +1,7 @@
 package cloudfront
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/cloudfront"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -31,35 +29,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_cloudfront_distribution"},
 		Base:           cloudfront.CheckEnforceHttps,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			defaultBehaviorBlock := resourceBlock.GetBlock("default_cache_behavior")
-			if defaultBehaviorBlock.IsNil() {
-				results.Add("Resource defines a CloudFront distribution that allows unencrypted communications (missing default_cache_behavior block).", resourceBlock)
-				return
-			}
-
-			protocolPolicyAttr := defaultBehaviorBlock.GetAttribute("viewer_protocol_policy")
-			if protocolPolicyAttr.IsNil() {
-				results.Add("Resource defines a CloudFront distribution that allows unencrypted communications (missing viewer_protocol_policy block).", defaultBehaviorBlock)
-				return
-			}
-			if protocolPolicyAttr.Equals("allow-all") {
-				results.Add("Resource defines a CloudFront distribution that allows unencrypted communications.", protocolPolicyAttr)
-				return
-			}
-
-			orderedBehaviorBlocks := resourceBlock.GetBlocks("ordered_cache_behavior")
-			for _, orderedBehaviorBlock := range orderedBehaviorBlocks {
-				orderedProtocolPolicyAttr := orderedBehaviorBlock.GetAttribute("viewer_protocol_policy")
-				if orderedProtocolPolicyAttr.IsNil() {
-					results.Add("Resource defines a CloudFront distribution that allows unencrypted communications (missing viewer_protocol_policy block).", orderedBehaviorBlock)
-				} else if orderedProtocolPolicyAttr.Equals("allow-all") {
-					results.Add("Resource defines a CloudFront distribution that allows unencrypted communications.", orderedProtocolPolicyAttr)
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule.go b/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule.go
index 3c0c0d1e5..c9cd0c22b 100644
--- a/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule.go
@@ -1,9 +1,7 @@
 package cloudfront
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/cloudfront"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -33,24 +31,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_cloudfront_distribution"},
 		Base:           cloudfront.CheckUseSecureTlsPolicy,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			viewerCertificateBlock := resourceBlock.GetBlock("viewer_certificate")
-			if viewerCertificateBlock.IsNil() {
-				results.Add("Resource defines outdated SSL/TLS policies (missing viewer_certificate block)", resourceBlock)
-				return
-			}
-
-			minVersionAttr := viewerCertificateBlock.GetAttribute("minimum_protocol_version")
-			if minVersionAttr.IsNil() {
-				results.Add("Resource defines outdated SSL/TLS policies (missing minimum_protocol_version attribute)", viewerCertificateBlock)
-				return
-			}
-
-			if minVersionAttr.NotEqual("TLSv1.2_2021") {
-				results.Add("Resource defines outdated SSL/TLS policies (not using TLSv1.2_2021)", minVersionAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/cloudtrail/enable_all_regions_rule.go b/internal/app/tfsec/rules/aws/cloudtrail/enable_all_regions_rule.go
index d071daa78..7707ac7ad 100644
--- a/internal/app/tfsec/rules/aws/cloudtrail/enable_all_regions_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudtrail/enable_all_regions_rule.go
@@ -1,9 +1,7 @@
 package cloudtrail
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/cloudtrail"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -45,19 +43,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_cloudtrail"},
 		Base:           cloudtrail.CheckEnableAllRegions,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("is_multi_region_trail") {
-				results.Add("Resource does not set multi region trail config.", resourceBlock)
-				return
-			}
-
-			multiRegionAttr := resourceBlock.GetAttribute("is_multi_region_trail")
-			if multiRegionAttr.IsFalse() {
-				results.Add("Resource does not enable multi region trail.", multiRegionAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/cloudtrail/enable_at_rest_encryption_rule.go b/internal/app/tfsec/rules/aws/cloudtrail/enable_at_rest_encryption_rule.go
index b79323835..98476dffa 100644
--- a/internal/app/tfsec/rules/aws/cloudtrail/enable_at_rest_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudtrail/enable_at_rest_encryption_rule.go
@@ -1,9 +1,7 @@
 package cloudtrail
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/cloudtrail"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -49,19 +47,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_cloudtrail"},
 		Base:           cloudtrail.CheckEnableAtRestEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("kms_key_id") {
-				results.Add("Resource does not have a kms_key_id set.", resourceBlock)
-				return
-			}
-
-			kmsKeyIdAttr := resourceBlock.GetAttribute("kms_key_id")
-			if kmsKeyIdAttr.IsEmpty() {
-				results.Add("Resource has a kms_key_id but it is not set.", kmsKeyIdAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/cloudtrail/enable_log_validation_rule.go b/internal/app/tfsec/rules/aws/cloudtrail/enable_log_validation_rule.go
index 9a728cc50..c693a3734 100644
--- a/internal/app/tfsec/rules/aws/cloudtrail/enable_log_validation_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudtrail/enable_log_validation_rule.go
@@ -1,9 +1,7 @@
 package cloudtrail
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/cloudtrail"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -48,17 +46,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_cloudtrail"},
 		Base:           cloudtrail.CheckEnableLogValidation,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if resourceBlock.MissingChild("enable_log_file_validation") {
-				results.Add("Resource does not enable log file validation.", resourceBlock)
-				return
-			}
-
-			logFileValidationAttr := resourceBlock.GetAttribute("enable_log_file_validation")
-			if logFileValidationAttr.IsFalse() {
-				results.Add("Resource does not enable log file validation.", logFileValidationAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/cloudwatch/log_group_customer_key_rule.go b/internal/app/tfsec/rules/aws/cloudwatch/log_group_customer_key_rule.go
index d1911b2ea..71cbc6bd2 100644
--- a/internal/app/tfsec/rules/aws/cloudwatch/log_group_customer_key_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudwatch/log_group_customer_key_rule.go
@@ -1,9 +1,7 @@
 package cloudwatch
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/cloudwatch"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -30,11 +28,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_cloudwatch_log_group"},
 		Base:           cloudwatch.CheckLogGroupCustomerKey,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if resourceBlock.MissingChild("kms_key_id") {
-				results.Add("Resource is only using default encryption", resourceBlock)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/codebuild/enable_encryption_rule.go b/internal/app/tfsec/rules/aws/codebuild/enable_encryption_rule.go
index 74145d5e5..5942db4fd 100644
--- a/internal/app/tfsec/rules/aws/codebuild/enable_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/codebuild/enable_encryption_rule.go
@@ -1,9 +1,7 @@
 package codebuild
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/codebuild"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -77,26 +75,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_codebuild_project"},
 		Base:           codebuild.CheckEnableEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			blocks := resourceBlock.GetBlocks("secondary_artifacts")
-			if artifact := resourceBlock.GetBlock("artifacts"); artifact.IsNotNil() {
-				blocks = append(blocks, artifact)
-			}
-
-			for _, artifactBlock := range blocks {
-				encryptionDisabledAttr := artifactBlock.GetAttribute("encryption_disabled")
-				if encryptionDisabledAttr.IsTrue() {
-					artifactTypeAttr := artifactBlock.GetAttribute("type")
-					if artifactTypeAttr.Equals("NO_ARTIFACTS", block.IgnoreCase) {
-						results.Add("CodeBuild project '%s' is configured to disable artifact encryption while no artifacts are produced", encryptionDisabledAttr)
-					} else {
-						results.Add("CodeBuild project '%s' does not encrypt produced artifacts", encryptionDisabledAttr)
-					}
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/config/aggregate_all_regions_rule.go b/internal/app/tfsec/rules/aws/config/aggregate_all_regions_rule.go
index 9024b09b4..1238744ab 100644
--- a/internal/app/tfsec/rules/aws/config/aggregate_all_regions_rule.go
+++ b/internal/app/tfsec/rules/aws/config/aggregate_all_regions_rule.go
@@ -1,9 +1,7 @@
 package config
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/config"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -37,25 +35,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_config_configuration_aggregator"},
 		Base:           config.CheckAggregateAllRegions,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			aggBlock := resourceBlock.GetFirstMatchingBlock("account_aggregation_source", "organization_aggregation_source")
-			if aggBlock.IsNil() {
-				results.Add("Resource should have account aggregation sources set", resourceBlock)
-				return
-			}
-
-			if aggBlock.MissingChild("all_regions") {
-				results.Add("Resource should have account aggregation sources to all regions", aggBlock)
-				return
-			}
-
-			allRegionsAttr := aggBlock.GetAttribute("all_regions")
-			if allRegionsAttr.IsFalse() {
-				results.Add("Resource has all_regions set to false", allRegionsAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/ebs/enable_volume_encryption_rule.go b/internal/app/tfsec/rules/aws/ebs/enable_volume_encryption_rule.go
index 217ea4a53..854f312e6 100644
--- a/internal/app/tfsec/rules/aws/ebs/enable_volume_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/ebs/enable_volume_encryption_rule.go
@@ -1,9 +1,7 @@
 package ebs
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/ebs"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -42,13 +40,5 @@ func init() {
 			"aws_ebs_volume",
 		},
 		Base: ebs.CheckEnableVolumeEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if encryptedAttr := resourceBlock.GetAttribute("encrypted"); encryptedAttr.IsNil() { // alert on use of default value
-				results.Add("Resource uses default value for encrypted", resourceBlock)
-			} else if encryptedAttr.IsFalse() {
-				results.Add("Resource does not have encrypted set to true", encryptedAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/ebs/encryption_customer_key_rule.go b/internal/app/tfsec/rules/aws/ebs/encryption_customer_key_rule.go
index a59d3050a..e8af952c0 100644
--- a/internal/app/tfsec/rules/aws/ebs/encryption_customer_key_rule.go
+++ b/internal/app/tfsec/rules/aws/ebs/encryption_customer_key_rule.go
@@ -1,9 +1,7 @@
 package ebs
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/ebs"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -46,25 +44,5 @@ func init() {
 			"aws_ebs_volume",
 		},
 		Base: ebs.CheckEncryptionCustomerKey,
-		CheckTerraform: func(resourceBlock block.Block, module block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("kms_key_id") {
-				results.Add("Resource does not use CMK", resourceBlock)
-				return
-			}
-
-			kmsKeyAttr := resourceBlock.GetAttribute("kms_key_id")
-			if kmsKeyAttr.IsDataBlockReference() {
-				kmsData, err := module.GetReferencedBlock(kmsKeyAttr, resourceBlock)
-				if err != nil {
-					return
-				}
-				keyIdAttr := kmsData.GetAttribute("key_id")
-				if keyIdAttr.IsNotNil() && keyIdAttr.StartsWith("alias/aws/") {
-					results.Add("Resource explicitly uses the default CMK", keyIdAttr)
-				}
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/efs/enable_at_rest_encryption_rule.go b/internal/app/tfsec/rules/aws/efs/enable_at_rest_encryption_rule.go
index 4f670e561..d9723f0f5 100644
--- a/internal/app/tfsec/rules/aws/efs/enable_at_rest_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/efs/enable_at_rest_encryption_rule.go
@@ -1,9 +1,7 @@
 package efs
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/efs"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -29,19 +27,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_efs_file_system"},
 		Base:           efs.CheckEnableAtRestEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			efsEnabledAttr := resourceBlock.GetAttribute("encrypted")
-			if efsEnabledAttr.IsNil() {
-				results.Add("Resource does not specify if encryption should be used.", resourceBlock)
-				return
-			}
-
-			if efsEnabledAttr.IsFalse() {
-				results.Add("Resource actively does not have encryption applied.", efsEnabledAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/elasticache/add_description_for_security_group_rule.go b/internal/app/tfsec/rules/aws/elasticache/add_description_for_security_group_rule.go
index 005cc05cb..c5ff50743 100644
--- a/internal/app/tfsec/rules/aws/elasticache/add_description_for_security_group_rule.go
+++ b/internal/app/tfsec/rules/aws/elasticache/add_description_for_security_group_rule.go
@@ -1,9 +1,7 @@
 package elasticache
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/elasticache"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -42,13 +40,5 @@ resource "aws_elasticache_security_group" "good_example" {
 			"aws_elasticache_security_group",
 		},
 		Base: elasticache.CheckAddDescriptionForSecurityGroup,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if descriptionAttr := resourceBlock.GetAttribute("description"); descriptionAttr.IsNil() { // alert on use of default value
-				results.Add("Resource uses default value for description", resourceBlock)
-			} else if descriptionAttr.IsEmpty() {
-				results.Add("Resource has description set to ", descriptionAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/elasticache/enable_backup_retention_rule.go b/internal/app/tfsec/rules/aws/elasticache/enable_backup_retention_rule.go
index 50b42a140..91766aeff 100644
--- a/internal/app/tfsec/rules/aws/elasticache/enable_backup_retention_rule.go
+++ b/internal/app/tfsec/rules/aws/elasticache/enable_backup_retention_rule.go
@@ -1,9 +1,7 @@
 package elasticache
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/elasticache"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -41,25 +39,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_elasticache_cluster"},
 		Base:           elasticache.CheckEnableBackupRetention,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			engineAttr := resourceBlock.GetAttribute("engine")
-			if engineAttr.IsNotNil() && engineAttr.Equals("redis", block.IgnoreCase) {
-				nodeTypeAttr := resourceBlock.GetAttribute("node_type")
-				if nodeTypeAttr.IsNotNil() && !nodeTypeAttr.Equals("cache.t1.micro") {
-					snapshotRetentionAttr := resourceBlock.GetAttribute("snapshot_retention_limit")
-					if snapshotRetentionAttr.IsNil() {
-						results.Add("Resource should have snapshot retention specified", resourceBlock)
-						return
-					}
-
-					if snapshotRetentionAttr.Equals(0) {
-						results.Add("Resource has snapshot retention set to 0", snapshotRetentionAttr)
-					}
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/elasticache/enable_in_transit_encryption_rule.go b/internal/app/tfsec/rules/aws/elasticache/enable_in_transit_encryption_rule.go
index 0b64df549..56d782d24 100644
--- a/internal/app/tfsec/rules/aws/elasticache/enable_in_transit_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/elasticache/enable_in_transit_encryption_rule.go
@@ -1,9 +1,7 @@
 package elasticache
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/elasticache"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -31,14 +29,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_elasticache_replication_group"},
 		Base:           elasticache.CheckEnableInTransitEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			encryptionAttr := resourceBlock.GetAttribute("transit_encryption_enabled")
-			if encryptionAttr.IsNil() {
-				results.Add("Resource defines an unencrypted Elasticache Replication Group (missing transit_encryption_enabled attribute).", resourceBlock)
-			} else if !encryptionAttr.IsTrue() {
-				results.Add("Resource defines an unencrypted Elasticache Replication Group (transit_encryption_enabled set to false).", encryptionAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/elasticache/encrypt_replication_group_rule.go b/internal/app/tfsec/rules/aws/elasticache/encrypt_replication_group_rule.go
index 747a0d3eb..d00954a1e 100644
--- a/internal/app/tfsec/rules/aws/elasticache/encrypt_replication_group_rule.go
+++ b/internal/app/tfsec/rules/aws/elasticache/encrypt_replication_group_rule.go
@@ -1,9 +1,7 @@
 package elasticache
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/elasticache"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -33,16 +31,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_elasticache_replication_group"},
 		Base:           elasticache.CheckEnableAtRestEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			encryptionAttr := resourceBlock.GetAttribute("at_rest_encryption_enabled")
-			if encryptionAttr.IsNil() {
-				results.Add("Resource defines an unencrypted Elasticache Replication Group (missing at_rest_encryption_enabled attribute).", resourceBlock)
-			} else if !encryptionAttr.IsTrue() {
-				results.Add("Resource defines an unencrypted Elasticache Replication Group (at_rest_encryption_enabled set to false).", encryptionAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/elb/drop_invalid_headers_rule.go b/internal/app/tfsec/rules/aws/elb/drop_invalid_headers_rule.go
index cb5c8f1c2..6788a01af 100644
--- a/internal/app/tfsec/rules/aws/elb/drop_invalid_headers_rule.go
+++ b/internal/app/tfsec/rules/aws/elb/drop_invalid_headers_rule.go
@@ -1,9 +1,7 @@
 package elb
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/elb"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -47,25 +45,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_alb", "aws_lb"},
 		Base:           elb.CheckDropInvalidHeaders,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.GetAttribute("load_balancer_type").IsNil() {
-				return
-			}
-
-			if resourceBlock.GetAttribute("load_balancer_type").Equals("application", block.IgnoreCase) {
-				if resourceBlock.MissingChild("drop_invalid_header_fields") {
-					results.Add("Resource does not drop invalid header fields", resourceBlock)
-					return
-				}
-
-				attr := resourceBlock.GetAttribute("drop_invalid_header_fields")
-				if attr.IsFalse() {
-					results.Add("Resource sets the drop_invalid_header_fields to false", attr)
-				}
-
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/elb/use_secure_tls_policy_rule.go b/internal/app/tfsec/rules/aws/elb/use_secure_tls_policy_rule.go
index dd930e503..8045f06e3 100644
--- a/internal/app/tfsec/rules/aws/elb/use_secure_tls_policy_rule.go
+++ b/internal/app/tfsec/rules/aws/elb/use_secure_tls_policy_rule.go
@@ -1,9 +1,7 @@
 package elb
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/elb"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -19,13 +17,21 @@ func init() {
 	scanner.RegisterCheckRule(rule.Rule{
 		LegacyID: "AWS010",
 		BadExample: []string{`
+ resource "aws_alb" "front_end" {
+ }
+
  resource "aws_alb_listener" "bad_example" {
+	load_balancer_arn = aws_alb.front_end.arn
  	ssl_policy = "ELBSecurityPolicy-TLS-1-1-2017-01"
  	protocol = "HTTPS"
  }
  `},
 		GoodExample: []string{`
+ resource "aws_alb" "front_end" {
+ }
+
  resource "aws_alb_listener" "good_example" {
+	load_balancer_arn = aws_alb.front_end.arn
  	ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
  	protocol = "HTTPS"
  }
@@ -36,17 +42,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_lb_listener", "aws_alb_listener"},
 		Base:           elb.CheckUseSecureTlsPolicy,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if sslPolicyAttr := resourceBlock.GetAttribute("ssl_policy"); sslPolicyAttr.IsString() {
-				for _, policy := range outdatedSSLPolicies {
-					if sslPolicyAttr.Equals(policy) {
-						results.Add("Resource is using an outdated SSL policy.", sslPolicyAttr)
-					}
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/kinesis/enable_in_transit_encryption_rule.go b/internal/app/tfsec/rules/aws/kinesis/enable_in_transit_encryption_rule.go
index 063f9176a..29b6dd5ec 100644
--- a/internal/app/tfsec/rules/aws/kinesis/enable_in_transit_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/kinesis/enable_in_transit_encryption_rule.go
@@ -1,15 +1,10 @@
 package kinesis
 
 import (
-	"strings"
-
 	"github.com/aquasecurity/defsec/rules/aws/kinesis"
 
-	"github.com/aquasecurity/defsec/rules"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
-	"github.com/zclconf/go-cty/cty"
 )
 
 func init() {
@@ -32,21 +27,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_kinesis_stream"},
 		Base:           kinesis.CheckEnableInTransitEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			encryptionTypeAttr := resourceBlock.GetAttribute("encryption_type")
-			if encryptionTypeAttr.IsNil() {
-				results.Add("Resource defines an unencrypted Kinesis Stream.", resourceBlock)
-			} else if encryptionTypeAttr.Type() == cty.String && strings.ToUpper(encryptionTypeAttr.Value().AsString()) != "KMS" {
-				results.Add("Resource defines an unencrypted Kinesis Stream.", encryptionTypeAttr)
-			} else {
-				keyIDAttr := resourceBlock.GetAttribute("kms_key_id")
-				if keyIDAttr.IsNil() {
-					results.Add("Resource defines a Kinesis Stream encrypted with the default Kinesis key.", resourceBlock)
-				} else if keyIDAttr.IsEmpty() || keyIDAttr.Equals("alias/aws/kinesis") {
-					results.Add("Resource defines a Kinesis Stream encrypted with the default Kinesis key.", keyIDAttr)
-				}
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/lambda/enable_tracing_rule.go b/internal/app/tfsec/rules/aws/lambda/enable_tracing_rule.go
index 90c4728e0..48caab128 100644
--- a/internal/app/tfsec/rules/aws/lambda/enable_tracing_rule.go
+++ b/internal/app/tfsec/rules/aws/lambda/enable_tracing_rule.go
@@ -1,9 +1,7 @@
 package lambda
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/lambda"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -94,7 +92,7 @@ func init() {
      }
    }
    tracing_config {
-     mode = "something"
+     mode = "Active"
    }
  }
  `},
@@ -108,15 +106,5 @@ func init() {
 			"aws_lambda_function",
 		},
 		Base: lambda.CheckEnableTracing,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if configBlock := resourceBlock.GetBlock("tracing_config"); configBlock.IsNil() {
-				results.Add("Resource uses default value for tracing_config.mode", resourceBlock)
-			} else if modeAttr := configBlock.GetAttribute("mode"); modeAttr.IsNil() {
-				results.Add("Resource uses default value for tracing_config.mode", configBlock)
-			} else if modeAttr.IsEmpty() {
-				results.Add("Resource has tracing_config.mode set to ", modeAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/lambda/restrict_source_arn_rule.go b/internal/app/tfsec/rules/aws/lambda/restrict_source_arn_rule.go
index e25557a37..e01fa5d1b 100644
--- a/internal/app/tfsec/rules/aws/lambda/restrict_source_arn_rule.go
+++ b/internal/app/tfsec/rules/aws/lambda/restrict_source_arn_rule.go
@@ -1,9 +1,7 @@
 package lambda
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/lambda"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -34,17 +32,5 @@ resource "aws_lambda_permission" "good_example" {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_lambda_permission"},
 		Base:           lambda.CheckRestrictSourceArn,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.HasChild("principal") {
-				if principalAttr := resourceBlock.GetAttribute("principal"); principalAttr.EndsWith("amazonaws.com") {
-					if resourceBlock.MissingChild("source_arn") {
-						results.Add("Resource missing source ARN but has *.amazonaws.com principal.", principalAttr)
-					}
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/mq/enable_audit_logging_rule.go b/internal/app/tfsec/rules/aws/mq/enable_audit_logging_rule.go
index 4b33ce807..c491baa78 100644
--- a/internal/app/tfsec/rules/aws/mq/enable_audit_logging_rule.go
+++ b/internal/app/tfsec/rules/aws/mq/enable_audit_logging_rule.go
@@ -1,9 +1,7 @@
 package mq
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/mq"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -66,15 +64,5 @@ func init() {
 			"aws_mq_broker",
 		},
 		Base: mq.CheckEnableAuditLogging,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if logsBlock := resourceBlock.GetBlock("logs"); logsBlock.IsNil() {
-				results.Add("Resource uses default value for logs.audit", resourceBlock)
-			} else if auditAttr := logsBlock.GetAttribute("audit"); auditAttr.IsNil() {
-				results.Add("Resource uses default value for logs.audit", logsBlock)
-			} else if auditAttr.IsFalse() {
-				results.Add("Resource does not have logs.audit set to true", auditAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/mq/enable_general_logging_rule.go b/internal/app/tfsec/rules/aws/mq/enable_general_logging_rule.go
index 79b59c018..e1de00043 100644
--- a/internal/app/tfsec/rules/aws/mq/enable_general_logging_rule.go
+++ b/internal/app/tfsec/rules/aws/mq/enable_general_logging_rule.go
@@ -1,9 +1,7 @@
 package mq
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/mq"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -66,15 +64,5 @@ func init() {
 			"aws_mq_broker",
 		},
 		Base: mq.CheckEnableGeneralLogging,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if logsBlock := resourceBlock.GetBlock("logs"); logsBlock.IsNil() {
-				results.Add("Resource uses default value for logs.general", resourceBlock)
-			} else if generalAttr := logsBlock.GetAttribute("general"); generalAttr.IsNil() {
-				results.Add("Resource uses default value for logs.general", logsBlock)
-			} else if generalAttr.IsFalse() {
-				results.Add("Resource does not have logs.general set to true", generalAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/mq/no_public_access_rule.go b/internal/app/tfsec/rules/aws/mq/no_public_access_rule.go
index 21d772ab5..e8c4a87aa 100644
--- a/internal/app/tfsec/rules/aws/mq/no_public_access_rule.go
+++ b/internal/app/tfsec/rules/aws/mq/no_public_access_rule.go
@@ -1,9 +1,7 @@
 package mq
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/mq"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -62,13 +60,5 @@ func init() {
 			"aws_mq_broker",
 		},
 		Base: mq.CheckNoPublicAccess,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if publiclyAccessibleAttr := resourceBlock.GetAttribute("publicly_accessible"); publiclyAccessibleAttr.IsNil() { // alert on use of default value
-				results.Add("Resource uses default value for publicly_accessible", resourceBlock)
-			} else if publiclyAccessibleAttr.IsTrue() {
-				results.Add("Resource does not have publicly_accessible set to false", publiclyAccessibleAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/neptune/enable_log_export_rule.go b/internal/app/tfsec/rules/aws/neptune/enable_log_export_rule.go
index 3c96cb361..29027e54a 100644
--- a/internal/app/tfsec/rules/aws/neptune/enable_log_export_rule.go
+++ b/internal/app/tfsec/rules/aws/neptune/enable_log_export_rule.go
@@ -1,9 +1,7 @@
 package neptune
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/neptune"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -44,13 +42,5 @@ func init() {
 			"aws_neptune_cluster",
 		},
 		Base: neptune.CheckEnableLogExport,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if enableCloudwatchLogsExportsAttr := resourceBlock.GetAttribute("enable_cloudwatch_logs_exports"); enableCloudwatchLogsExportsAttr.IsNil() {
-				results.Add("Resource uses default value for enable_cloudwatch_logs_exports", resourceBlock)
-			} else if enableCloudwatchLogsExportsAttr.NotContains("audit") {
-				results.Add("Resource should have audit in enable_cloudwatch_logs_exports", enableCloudwatchLogsExportsAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/neptune/enable_storage_encryption_rule.go b/internal/app/tfsec/rules/aws/neptune/enable_storage_encryption_rule.go
index 376bea93d..cf59edd58 100644
--- a/internal/app/tfsec/rules/aws/neptune/enable_storage_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/neptune/enable_storage_encryption_rule.go
@@ -1,9 +1,7 @@
 package neptune
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/neptune"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -32,6 +30,7 @@ func init() {
    iam_database_authentication_enabled = true
    apply_immediately                   = true
    storage_encrypted = true
+   kms_key_arn = "key-arn-sample"
  }
  `},
 		Links: []string{
@@ -44,13 +43,5 @@ func init() {
 			"aws_neptune_cluster",
 		},
 		Base: neptune.CheckEnableStorageEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if storageEncryptedAttr := resourceBlock.GetAttribute("storage_encrypted"); storageEncryptedAttr.IsNil() { // alert on use of default value
-				results.Add("Resource uses default value for storage_encrypted", resourceBlock)
-			} else if storageEncryptedAttr.IsFalse() {
-				results.Add("Resource does not have storage_encrypted set to true", storageEncryptedAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/redshift/encryption_customer_key_rule.go b/internal/app/tfsec/rules/aws/redshift/encryption_customer_key_rule.go
index 032339311..5d3203824 100644
--- a/internal/app/tfsec/rules/aws/redshift/encryption_customer_key_rule.go
+++ b/internal/app/tfsec/rules/aws/redshift/encryption_customer_key_rule.go
@@ -1,9 +1,7 @@
 package redshift
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/redshift"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -43,24 +41,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_redshift_cluster"},
 		Base:           redshift.CheckEncryptionCustomerKey,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("encrypted") {
-				results.Add("Resource does not have encryption enabled", resourceBlock)
-				return
-			}
-
-			encryptedAttr := resourceBlock.GetAttribute("encrypted")
-			if encryptedAttr.IsFalse() {
-				results.Add("Resource has encryption explicitly disabled", encryptedAttr)
-				return
-			}
-
-			if resourceBlock.MissingChild("kms_key_id") {
-				results.Add("Resource does not have a customer managed key specified", resourceBlock)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/redshift/non_default_vpc_deployment_rule.go b/internal/app/tfsec/rules/aws/redshift/non_default_vpc_deployment_rule.go
index 7adc0d915..a9ade6665 100644
--- a/internal/app/tfsec/rules/aws/redshift/non_default_vpc_deployment_rule.go
+++ b/internal/app/tfsec/rules/aws/redshift/non_default_vpc_deployment_rule.go
@@ -1,9 +1,7 @@
 package redshift
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/redshift"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -39,11 +37,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_redshift_cluster"},
 		Base:           redshift.CheckUsesVPC,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if resourceBlock.MissingChild("cluster_subnet_group_name") {
-				results.Add("Resource is being deployed outside of a VPC", resourceBlock)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/sns/enable_topic_encryption_rule.go b/internal/app/tfsec/rules/aws/sns/enable_topic_encryption_rule.go
index 660e48790..c5b38f50e 100644
--- a/internal/app/tfsec/rules/aws/sns/enable_topic_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/sns/enable_topic_encryption_rule.go
@@ -1,12 +1,9 @@
 package sns
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/sns"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
-	"github.com/zclconf/go-cty/cty"
 )
 
 func init() {
@@ -28,32 +25,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_sns_topic"},
 		Base:           sns.CheckEnableTopicEncryption,
-		CheckTerraform: func(resourceBlock block.Block, module block.Module) (results rules.Results) {
-
-			kmsKeyIDAttr := resourceBlock.GetAttribute("kms_master_key_id")
-			if kmsKeyIDAttr.IsNil() {
-				results.Add("Resource defines an unencrypted SNS topic.", resourceBlock)
-				return
-			} else if kmsKeyIDAttr.Type() == cty.String && kmsKeyIDAttr.Value().AsString() == "" {
-				results.Add("Resource defines an unencrypted SNS topic.", kmsKeyIDAttr)
-				return
-			}
-
-			if kmsKeyIDAttr.IsDataBlockReference() {
-
-				kmsData, err := module.GetReferencedBlock(kmsKeyIDAttr, resourceBlock)
-				if err != nil {
-					return
-				}
-
-				keyIdAttr := kmsData.GetAttribute("key_id")
-				if keyIdAttr.IsNotNil() && keyIdAttr.Equals("alias/aws/sns") {
-					results.Add("Resource explicitly uses the default CMK", keyIdAttr)
-				}
-
-			}
-
-			return results
-		},
 	})
 }
diff --git a/vendor/github.com/aquasecurity/defsec/rules/digitalocean/compute/no_public_egress.tf.go b/vendor/github.com/aquasecurity/defsec/rules/digitalocean/compute/no_public_egress.tf.go
index b3baea18a..0bcaae8e9 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/digitalocean/compute/no_public_egress.tf.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/digitalocean/compute/no_public_egress.tf.go
@@ -1,7 +1,7 @@
 package compute
 
 var terraformNoPublicEgressGoodExamples = []string{
-	`
+        `
  resource "digitalocean_firewall" "good_example" {
  	name = "only-22-80-and-443"
    
@@ -17,7 +17,7 @@ var terraformNoPublicEgressGoodExamples = []string{
 }
 
 var terraformNoPublicEgressBadExamples = []string{
-	`
+        `
  resource "digitalocean_firewall" "bad_example" {
  	name = "only-22-80-and-443"
    
@@ -33,7 +33,7 @@ var terraformNoPublicEgressBadExamples = []string{
 }
 
 var terraformNoPublicEgressLinks = []string{
-	`https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/firewall`,
+        `https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/firewall`,
 }
 
 var terraformNoPublicEgressRemediationMarkdown = ``
diff --git a/vendor/github.com/hashicorp/go-version/CHANGELOG.md b/vendor/github.com/hashicorp/go-version/CHANGELOG.md
index dbae7f7be..2020c4727 100644
--- a/vendor/github.com/hashicorp/go-version/CHANGELOG.md
+++ b/vendor/github.com/hashicorp/go-version/CHANGELOG.md
@@ -1,3 +1,10 @@
+# 1.4.0 (January 5, 2021)
+
+FEATURES:
+
+ - Introduce `MustConstraints()` ([#87](https://github.com/hashicorp/go-version/pull/87))
+ - `Constraints`: Introduce `Equals()` and `sort.Interface` methods ([#88](https://github.com/hashicorp/go-version/pull/88))
+
 # 1.3.0 (March 31, 2021)
 
 Please note that CHANGELOG.md does not exist in the source code prior to this release.
diff --git a/vendor/github.com/hashicorp/go-version/constraint.go b/vendor/github.com/hashicorp/go-version/constraint.go
index d05575961..1d8809028 100644
--- a/vendor/github.com/hashicorp/go-version/constraint.go
+++ b/vendor/github.com/hashicorp/go-version/constraint.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"reflect"
 	"regexp"
+	"sort"
 	"strings"
 )
 
@@ -11,30 +12,40 @@ import (
 // ">= 1.0".
 type Constraint struct {
 	f        constraintFunc
+	op       operator
 	check    *Version
 	original string
 }
 
+func (c *Constraint) Equals(con *Constraint) bool {
+	return c.op == con.op && c.check.Equal(con.check)
+}
+
 // Constraints is a slice of constraints. We make a custom type so that
 // we can add methods to it.
 type Constraints []*Constraint
 
 type constraintFunc func(v, c *Version) bool
 
-var constraintOperators map[string]constraintFunc
+var constraintOperators map[string]constraintOperation
+
+type constraintOperation struct {
+	op operator
+	f  constraintFunc
+}
 
 var constraintRegexp *regexp.Regexp
 
 func init() {
-	constraintOperators = map[string]constraintFunc{
-		"":   constraintEqual,
-		"=":  constraintEqual,
-		"!=": constraintNotEqual,
-		">":  constraintGreaterThan,
-		"<":  constraintLessThan,
-		">=": constraintGreaterThanEqual,
-		"<=": constraintLessThanEqual,
-		"~>": constraintPessimistic,
+	constraintOperators = map[string]constraintOperation{
+		"":   {op: equal, f: constraintEqual},
+		"=":  {op: equal, f: constraintEqual},
+		"!=": {op: notEqual, f: constraintNotEqual},
+		">":  {op: greaterThan, f: constraintGreaterThan},
+		"<":  {op: lessThan, f: constraintLessThan},
+		">=": {op: greaterThanEqual, f: constraintGreaterThanEqual},
+		"<=": {op: lessThanEqual, f: constraintLessThanEqual},
+		"~>": {op: pessimistic, f: constraintPessimistic},
 	}
 
 	ops := make([]string, 0, len(constraintOperators))
@@ -66,6 +77,16 @@ func NewConstraint(v string) (Constraints, error) {
 	return Constraints(result), nil
 }
 
+// MustConstraints is a helper that wraps a call to a function
+// returning (Constraints, error) and panics if error is non-nil.
+func MustConstraints(c Constraints, err error) Constraints {
+	if err != nil {
+		panic(err)
+	}
+
+	return c
+}
+
 // Check tests if a version satisfies all the constraints.
 func (cs Constraints) Check(v *Version) bool {
 	for _, c := range cs {
@@ -77,6 +98,56 @@ func (cs Constraints) Check(v *Version) bool {
 	return true
 }
 
+// Equals compares Constraints with other Constraints
+// for equality. This may not represent logical equivalence
+// of compared constraints.
+// e.g. even though '>0.1,>0.2' is logically equivalent
+// to '>0.2' it is *NOT* treated as equal.
+//
+// Missing operator is treated as equal to '=', whitespaces
+// are ignored and constraints are sorted before comaparison.
+func (cs Constraints) Equals(c Constraints) bool {
+	if len(cs) != len(c) {
+		return false
+	}
+
+	// make copies to retain order of the original slices
+	left := make(Constraints, len(cs))
+	copy(left, cs)
+	sort.Stable(left)
+	right := make(Constraints, len(c))
+	copy(right, c)
+	sort.Stable(right)
+
+	// compare sorted slices
+	for i, con := range left {
+		if !con.Equals(right[i]) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func (cs Constraints) Len() int {
+	return len(cs)
+}
+
+func (cs Constraints) Less(i, j int) bool {
+	if cs[i].op < cs[j].op {
+		return true
+	}
+	if cs[i].op > cs[j].op {
+		return false
+	}
+
+	return cs[i].check.LessThan(cs[j].check)
+}
+
+func (cs Constraints) Swap(i, j int) {
+	cs[i], cs[j] = cs[j], cs[i]
+}
+
 // Returns the string format of the constraints
 func (cs Constraints) String() string {
 	csStr := make([]string, len(cs))
@@ -107,8 +178,11 @@ func parseSingle(v string) (*Constraint, error) {
 		return nil, err
 	}
 
+	cop := constraintOperators[matches[1]]
+
 	return &Constraint{
-		f:        constraintOperators[matches[1]],
+		f:        cop.f,
+		op:       cop.op,
 		check:    check,
 		original: v,
 	}, nil
@@ -138,6 +212,18 @@ func prereleaseCheck(v, c *Version) bool {
 // Constraint functions
 //-------------------------------------------------------------------
 
+type operator rune
+
+const (
+	equal            operator = '='
+	notEqual         operator = '≠'
+	greaterThan      operator = '>'
+	lessThan         operator = '<'
+	greaterThanEqual operator = '≥'
+	lessThanEqual    operator = '≤'
+	pessimistic      operator = '~'
+)
+
 func constraintEqual(v, c *Version) bool {
 	return v.Equal(c)
 }
diff --git a/vendor/github.com/hashicorp/go-version/version.go b/vendor/github.com/hashicorp/go-version/version.go
index 8068834ec..116a74466 100644
--- a/vendor/github.com/hashicorp/go-version/version.go
+++ b/vendor/github.com/hashicorp/go-version/version.go
@@ -64,7 +64,6 @@ func newVersion(v string, pattern *regexp.Regexp) (*Version, error) {
 	}
 	segmentsStr := strings.Split(matches[1], ".")
 	segments := make([]int64, len(segmentsStr))
-	si := 0
 	for i, str := range segmentsStr {
 		val, err := strconv.ParseInt(str, 10, 64)
 		if err != nil {
@@ -72,8 +71,7 @@ func newVersion(v string, pattern *regexp.Regexp) (*Version, error) {
 				"Error parsing version: %s", err)
 		}
 
-		segments[i] = int64(val)
-		si++
+		segments[i] = val
 	}
 
 	// Even though we could support more than three segments, if we
@@ -92,7 +90,7 @@ func newVersion(v string, pattern *regexp.Regexp) (*Version, error) {
 		metadata: matches[10],
 		pre:      pre,
 		segments: segments,
-		si:       si,
+		si:       len(segmentsStr),
 		original: v,
 	}, nil
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ba36afc9e..77734b3bb 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -274,7 +274,7 @@ github.com/google/uuid
 # github.com/hashicorp/go-uuid v1.0.2
 ## explicit
 github.com/hashicorp/go-uuid
-# github.com/hashicorp/go-version v1.3.0
+# github.com/hashicorp/go-version v1.4.0
 ## explicit
 github.com/hashicorp/go-version
 # github.com/hashicorp/hcl/v2 v2.11.1


Test patch:
diff --git a/internal/app/tfsec/rules/aws/cloudfront/enable_logging_rule_test.go b/internal/app/tfsec/rules/aws/cloudfront/enable_logging_rule_test.go
index 5f21a9e66..fc050f0a8 100644
--- a/internal/app/tfsec/rules/aws/cloudfront/enable_logging_rule_test.go
+++ b/internal/app/tfsec/rules/aws/cloudfront/enable_logging_rule_test.go
@@ -31,6 +31,7 @@ func Test_AWSCloudfrontDistributionAccessLoggingEnabled(t *testing.T) {
  resource "aws_cloudfront_distribution" "good_example" {
  	// other config
  	logging_config {
+		 bucket = "mylogs.s3.amazonaws.com"
  	}
  }
  `,
diff --git a/internal/app/tfsec/rules/aws/elb/use_secure_tls_policy_rule_test.go b/internal/app/tfsec/rules/aws/elb/use_secure_tls_policy_rule_test.go
index 1f21ed6dd..4536e50b5 100644
--- a/internal/app/tfsec/rules/aws/elb/use_secure_tls_policy_rule_test.go
+++ b/internal/app/tfsec/rules/aws/elb/use_secure_tls_policy_rule_test.go
@@ -18,7 +18,11 @@ func Test_AWSOutdatedSSLPolicy(t *testing.T) {
 		{
 			name: "check aws_alb_listener with outdated policy",
 			source: `
+ resource "aws_alb" "front_end" {
+ }
+
  resource "aws_alb_listener" "my-resource" {
+	load_balancer_arn = aws_alb.front_end.arn
  	ssl_policy = "ELBSecurityPolicy-TLS-1-1-2017-01"
  	protocol = "HTTPS"
  }`,
@@ -27,7 +31,11 @@ func Test_AWSOutdatedSSLPolicy(t *testing.T) {
 		{
 			name: "check aws_lb_listener with outdated policy",
 			source: `
+ resource "aws_lb" "front_end" {
+ }
+
  resource "aws_lb_listener" "my-resource" {
+	load_balancer_arn = aws_lb.front_end.arn
  	ssl_policy = "ELBSecurityPolicy-TLS-1-1-2017-01"
  	protocol = "HTTPS"
  }`,
@@ -36,7 +44,11 @@ func Test_AWSOutdatedSSLPolicy(t *testing.T) {
 		{
 			name: "check aws_alb_listener with ok policy",
 			source: `
+ resource "aws_alb" "front_end" {
+ }
+
  resource "aws_alb_listener" "my-resource" {
+	load_balancer_arn = aws_alb.front_end.arn
  	ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
  	protocol = "HTTPS"
  }`,
diff --git a/internal/app/tfsec/rules/aws/lambda/restrict_source_arn_rule_test.go b/internal/app/tfsec/rules/aws/lambda/restrict_source_arn_rule_test.go
index f0ca93f9a..ca1950268 100644
--- a/internal/app/tfsec/rules/aws/lambda/restrict_source_arn_rule_test.go
+++ b/internal/app/tfsec/rules/aws/lambda/restrict_source_arn_rule_test.go
@@ -18,6 +18,29 @@ func Test_AWSCheckLambdaFunctionForSourceARN(t *testing.T) {
 		{
 			name: "Principal present with no source_arn",
 			source: `
+ resource "aws_lambda_function" "func" {
+   filename      = "lambda_function_payload.zip"
+   function_name = "lambda_function_name"
+   role          = aws_iam_role.iam_for_lambda.arn
+   handler       = "exports.test"
+ 
+   # The filebase64sha256() function is available in Terraform 0.11.12 and later
+   # For Terraform 0.11.11 and earlier, use the base64sha256() function and the file() function:
+   # source_code_hash = "${base64sha256(file("lambda_function_payload.zip"))}"
+   source_code_hash = filebase64sha256("lambda_function_payload.zip")
+ 
+   runtime = "nodejs12.x"
+ 
+   environment {
+     variables = {
+       foo = "bar"
+     }
+   }
+   tracing_config {
+     mode = "Active"
+   }
+ }
+
  resource "aws_lambda_permission" "with_sns" {
    statement_id  = "AllowExecutionFromSNS"
    action        = "lambda:InvokeFunction"
@@ -30,6 +53,29 @@ func Test_AWSCheckLambdaFunctionForSourceARN(t *testing.T) {
 		{
 			name: "Principal present and source_arn present",
 			source: `
+ resource "aws_lambda_function" "func" {
+   filename      = "lambda_function_payload.zip"
+   function_name = "lambda_function_name"
+   role          = aws_iam_role.iam_for_lambda.arn
+   handler       = "exports.test"
+ 
+   # The filebase64sha256() function is available in Terraform 0.11.12 and later
+   # For Terraform 0.11.11 and earlier, use the base64sha256() function and the file() function:
+   # source_code_hash = "${base64sha256(file("lambda_function_payload.zip"))}"
+   source_code_hash = filebase64sha256("lambda_function_payload.zip")
+ 
+   runtime = "nodejs12.x"
+ 
+   environment {
+     variables = {
+       foo = "bar"
+     }
+   }
+   tracing_config {
+     mode = "Active"
+   }
+ }
+
  resource "aws_lambda_permission" "with_sns" {
    statement_id  = "AllowExecutionFromSNS"
    action        = "lambda:InvokeFunction"
@@ -43,6 +89,29 @@ func Test_AWSCheckLambdaFunctionForSourceARN(t *testing.T) {
 		{
 			name: "No principal specified",
 			source: `
+ resource "aws_lambda_function" "func" {
+   filename      = "lambda_function_payload.zip"
+   function_name = "lambda_function_name"
+   role          = aws_iam_role.iam_for_lambda.arn
+   handler       = "exports.test"
+ 
+   # The filebase64sha256() function is available in Terraform 0.11.12 and later
+   # For Terraform 0.11.11 and earlier, use the base64sha256() function and the file() function:
+   # source_code_hash = "${base64sha256(file("lambda_function_payload.zip"))}"
+   source_code_hash = filebase64sha256("lambda_function_payload.zip")
+ 
+   runtime = "nodejs12.x"
+ 
+   environment {
+     variables = {
+       foo = "bar"
+     }
+   }
+   tracing_config {
+     mode = "Active"
+   }
+ }
+
  resource "aws_lambda_permission" "with_sns" {
    statement_id  = "AllowExecutionFromSNS"
    action        = "lambda:InvokeFunction"
diff --git a/internal/app/tfsec/rules/aws/sns/enable_topic_encryption_rule_test.go b/internal/app/tfsec/rules/aws/sns/enable_topic_encryption_rule_test.go
index cd5e12826..37ba955e0 100644
--- a/internal/app/tfsec/rules/aws/sns/enable_topic_encryption_rule_test.go
+++ b/internal/app/tfsec/rules/aws/sns/enable_topic_encryption_rule_test.go
@@ -26,13 +26,9 @@ func Test_AWSUnencryptedSNSTopic(t *testing.T) {
 		{
 			name: "check with default encryption key id specified for aws_sns_topic fails check",
 			source: `
- data "aws_kms_key" "by_alias" {
-   key_id = "alias/aws/sns"
- }
- 
  resource "aws_sns_topic" "test" {
    name              = "sns_ecnrypted"
-   kms_master_key_id = data.aws_kms_key.by_alias.arn
+   kms_master_key_id = "alias/aws/sns"
  }`,
 			mustIncludeResultCode: expectedCode,
 		},