Repository: tfsec/tfsec
Pull request #436 (2020-10-16 09:46:42)

Move the checks to the code number and the category


Patch:
diff --git a/internal/app/tfsec/checks/aws_acl.go b/internal/app/tfsec/checks/aws/aws001.go
similarity index 99%
rename from internal/app/tfsec/checks/aws_acl.go
rename to internal/app/tfsec/checks/aws/aws001.go
index 68c564fd6..9f8a70b8f 100644
--- a/internal/app/tfsec/checks/aws_acl.go
+++ b/internal/app/tfsec/checks/aws/aws001.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
+	"github.com/zclconf/go-cty/cty"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-	"github.com/zclconf/go-cty/cty"
 )
 
 // AWSBadBucketACL See https://github.com/tfsec/tfsec#included-checks for check info
diff --git a/internal/app/tfsec/checks/aws_bucket_logging.go b/internal/app/tfsec/checks/aws/aws002.go
similarity index 99%
rename from internal/app/tfsec/checks/aws_bucket_logging.go
rename to internal/app/tfsec/checks/aws/aws002.go
index ab911fb8b..ab1438f0a 100644
--- a/internal/app/tfsec/checks/aws_bucket_logging.go
+++ b/internal/app/tfsec/checks/aws/aws002.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
diff --git a/internal/app/tfsec/checks/aws_classic.go b/internal/app/tfsec/checks/aws/aws003.go
similarity index 99%
rename from internal/app/tfsec/checks/aws_classic.go
rename to internal/app/tfsec/checks/aws/aws003.go
index f199dac94..1ac4eb995 100644
--- a/internal/app/tfsec/checks/aws_classic.go
+++ b/internal/app/tfsec/checks/aws/aws003.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
diff --git a/internal/app/tfsec/checks/aws_http.go b/internal/app/tfsec/checks/aws/aws004.go
similarity index 89%
rename from internal/app/tfsec/checks/aws_http.go
rename to internal/app/tfsec/checks/aws/aws004.go
index ec0e0cc4d..b3dded9a2 100644
--- a/internal/app/tfsec/checks/aws_http.go
+++ b/internal/app/tfsec/checks/aws/aws004.go
@@ -1,12 +1,13 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
 // AWSPlainHTTP See https://github.com/tfsec/tfsec#included-checks for check info
@@ -26,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSPlainHTTP,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSPlainHTTPDescription,
-            Explanation: AWSPlainHTTPExplanation,
-            BadExample:  AWSPlainHTTPBadExample,
-            GoodExample: AWSPlainHTTPGoodExample,
-            Links: []string{},
+			Summary:     AWSPlainHTTPDescription,
+			Explanation: AWSPlainHTTPExplanation,
+			BadExample:  AWSPlainHTTPBadExample,
+			GoodExample: AWSPlainHTTPGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_not_internal.go b/internal/app/tfsec/checks/aws/aws005.go
similarity index 83%
rename from internal/app/tfsec/checks/aws_not_internal.go
rename to internal/app/tfsec/checks/aws/aws005.go
index 27b7fc6b2..63a03475e 100644
--- a/internal/app/tfsec/checks/aws_not_internal.go
+++ b/internal/app/tfsec/checks/aws/aws005.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSExternallyExposedLoadBalancer,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSExternallyExposedLoadBalancerDescription,
-            Explanation: AWSExternallyExposedLoadBalancerExplanation,
-            BadExample:  AWSExternallyExposedLoadBalancerBadExample,
-            GoodExample: AWSExternallyExposedLoadBalancerGoodExample,
-            Links: []string{},
+			Summary:     AWSExternallyExposedLoadBalancerDescription,
+			Explanation: AWSExternallyExposedLoadBalancerExplanation,
+			BadExample:  AWSExternallyExposedLoadBalancerBadExample,
+			GoodExample: AWSExternallyExposedLoadBalancerGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws/aws006.go b/internal/app/tfsec/checks/aws/aws006.go
new file mode 100644
index 000000000..237ad977c
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws006.go
@@ -0,0 +1,95 @@
+package aws
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+)
+
+// AWSOpenIngressSecurityGroupRule See https://github.com/tfsec/tfsec#included-checks for check info
+const AWSOpenIngressSecurityGroupRule scanner.RuleID = "AWS006"
+const AWSOpenIngressSecurityGroupRuleDescription scanner.RuleSummary = "An ingress security group rule allows traffic from `/0`."
+const AWSOpenIngressSecurityGroupRuleExplanation = `
+
+`
+const AWSOpenIngressSecurityGroupRuleBadExample = `
+
+`
+const AWSOpenIngressSecurityGroupRuleGoodExample = `
+
+`
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSOpenIngressSecurityGroupRule,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSOpenIngressSecurityGroupRuleDescription,
+			Explanation: AWSOpenIngressSecurityGroupRuleExplanation,
+			BadExample:  AWSOpenIngressSecurityGroupRuleBadExample,
+			GoodExample: AWSOpenIngressSecurityGroupRuleGoodExample,
+			Links:       []string{},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_security_group_rule"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			typeAttr := block.GetAttribute("type")
+			if typeAttr == nil || typeAttr.Type() != cty.String {
+				return nil
+			}
+
+			if typeAttr.Value().AsString() != "ingress" {
+				return nil
+			}
+
+			if cidrBlocksAttr := block.GetAttribute("cidr_blocks"); cidrBlocksAttr != nil {
+
+				if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
+					return nil
+				}
+
+				for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
+					if strings.HasSuffix(cidr.AsString(), "/0") {
+						return []scanner.Result{
+							check.NewResult(
+								fmt.Sprintf("Resource '%s' defines a fully open ingress security group rule.", block.Name()),
+								cidrBlocksAttr.Range(),
+								scanner.SeverityWarning,
+							),
+						}
+					}
+				}
+
+			}
+
+			if ipv6CidrBlocksAttr := block.GetAttribute("ipv6_cidr_blocks"); ipv6CidrBlocksAttr != nil {
+
+				if ipv6CidrBlocksAttr.Value().IsNull() || ipv6CidrBlocksAttr.Value().LengthInt() == 0 {
+					return nil
+				}
+
+				for _, cidr := range ipv6CidrBlocksAttr.Value().AsValueSlice() {
+					if strings.HasSuffix(cidr.AsString(), "/0") {
+						return []scanner.Result{
+							check.NewResultWithValueAnnotation(
+								fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", block.Name()),
+								ipv6CidrBlocksAttr.Range(),
+								ipv6CidrBlocksAttr,
+								scanner.SeverityWarning,
+							),
+						}
+					}
+				}
+
+			}
+
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws007.go b/internal/app/tfsec/checks/aws/aws007.go
new file mode 100644
index 000000000..78501b979
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws007.go
@@ -0,0 +1,81 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/zclconf/go-cty/cty"
+	"strings"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+// AWSOpenEgressSecurityGroupRule See https://github.com/tfsec/tfsec#included-checks for check info
+const AWSOpenEgressSecurityGroupRule scanner.RuleID = "AWS007"
+const AWSOpenEgressSecurityGroupRuleDescription scanner.RuleSummary = "An egress security group rule allows traffic to `/0`."
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSOpenEgressSecurityGroupRule,
+		Documentation: scanner.CheckDocumentation{
+			Summary: AWSOpenEgressSecurityGroupRuleDescription,
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_security_group_rule"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			typeAttr := block.GetAttribute("type")
+			if typeAttr == nil || typeAttr.Type() != cty.String {
+				return nil
+			}
+
+			if typeAttr.Value().AsString() != "egress" {
+				return nil
+			}
+
+			if cidrBlocksAttr := block.GetAttribute("cidr_blocks"); cidrBlocksAttr != nil {
+
+				if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
+					return nil
+				}
+
+				for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
+					if strings.HasSuffix(cidr.AsString(), "/0") {
+						return []scanner.Result{
+							check.NewResultWithValueAnnotation(
+								fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", block.Name()),
+								cidrBlocksAttr.Range(),
+								cidrBlocksAttr,
+								scanner.SeverityWarning,
+							),
+						}
+					}
+				}
+
+			}
+
+			if ipv6CidrBlocksAttr := block.GetAttribute("ipv6_cidr_blocks"); ipv6CidrBlocksAttr != nil {
+
+				if ipv6CidrBlocksAttr.Value().IsNull() || ipv6CidrBlocksAttr.Value().LengthInt() == 0 {
+					return nil
+				}
+
+				for _, cidr := range ipv6CidrBlocksAttr.Value().AsValueSlice() {
+					if strings.HasSuffix(cidr.AsString(), "/0") {
+						return []scanner.Result{
+							check.NewResultWithValueAnnotation(
+								fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", block.Name()),
+								ipv6CidrBlocksAttr.Range(),
+								ipv6CidrBlocksAttr,
+								scanner.SeverityWarning,
+							),
+						}
+					}
+				}
+
+			}
+
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws008.go b/internal/app/tfsec/checks/aws/aws008.go
new file mode 100644
index 000000000..203729ee0
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws008.go
@@ -0,0 +1,84 @@
+package aws
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+)
+
+// AWSOpenIngressSecurityGroupInlineRule See https://github.com/tfsec/tfsec#included-checks for check info
+const AWSOpenIngressSecurityGroupInlineRule scanner.RuleID = "AWS008"
+const AWSOpenIngressSecurityGroupInlineRuleDescription scanner.RuleSummary = "An inline ingress security group rule allows traffic from `/0`."
+const AWSOpenIngressSecurityGroupInlineRuleExplanation = `
+
+`
+const AWSOpenIngressSecurityGroupInlineRuleBadExample = `
+
+`
+const AWSOpenIngressSecurityGroupInlineRuleGoodExample = `
+
+`
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSOpenIngressSecurityGroupInlineRule,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSOpenIngressSecurityGroupInlineRuleDescription,
+			Explanation: AWSOpenIngressSecurityGroupInlineRuleExplanation,
+			BadExample:  AWSOpenIngressSecurityGroupInlineRuleBadExample,
+			GoodExample: AWSOpenIngressSecurityGroupInlineRuleGoodExample,
+			Links:       []string{},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_security_group"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			var results []scanner.Result
+
+			for _, directionBlock := range block.GetBlocks("ingress") {
+				if cidrBlocksAttr := directionBlock.GetAttribute("cidr_blocks"); cidrBlocksAttr != nil {
+
+					if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
+						return nil
+					}
+
+					for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
+						if strings.HasSuffix(cidr.AsString(), "/0") {
+							results = append(results,
+								check.NewResult(
+									fmt.Sprintf("Resource '%s' defines a fully open ingress security group.", block.Name()),
+									cidrBlocksAttr.Range(),
+									scanner.SeverityWarning,
+								),
+							)
+						}
+					}
+				}
+				if cidrBlocksAttr := directionBlock.GetAttribute("ipv6_cidr_blocks"); cidrBlocksAttr != nil {
+
+					if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
+						return nil
+					}
+
+					for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
+						if strings.HasSuffix(cidr.AsString(), "/0") {
+							results = append(results,
+								check.NewResult(
+									fmt.Sprintf("Resource '%s' defines a fully open ingress security group.", block.Name()),
+									cidrBlocksAttr.Range(),
+									scanner.SeverityWarning,
+								),
+							)
+						}
+					}
+				}
+			}
+
+			return results
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws009.go b/internal/app/tfsec/checks/aws/aws009.go
new file mode 100644
index 000000000..17c40ebd7
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws009.go
@@ -0,0 +1,72 @@
+package aws
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+// AWSOpenEgressSecurityGroupInlineRule See https://github.com/tfsec/tfsec#included-checks for check info
+const AWSOpenEgressSecurityGroupInlineRule scanner.RuleID = "AWS009"
+const AWSOpenEgressSecurityGroupInlineRuleDescription scanner.RuleSummary = "An inline egress security group rule allows traffic to `/0`."
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSOpenEgressSecurityGroupInlineRule,
+		Documentation: scanner.CheckDocumentation{
+			Summary: AWSOpenEgressSecurityGroupInlineRuleDescription,
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_security_group"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			var results []scanner.Result
+
+			for _, directionBlock := range block.GetBlocks("egress") {
+				if cidrBlocksAttr := directionBlock.GetAttribute("cidr_blocks"); cidrBlocksAttr != nil {
+
+					if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
+						return nil
+					}
+
+					for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
+						if strings.HasSuffix(cidr.AsString(), "/0") {
+							results = append(results,
+								check.NewResultWithValueAnnotation(
+									fmt.Sprintf("Resource '%s' defines a fully open egress security group.", block.Name()),
+									cidrBlocksAttr.Range(),
+									cidrBlocksAttr,
+									scanner.SeverityWarning,
+								),
+							)
+						}
+					}
+				}
+				if cidrBlocksAttr := directionBlock.GetAttribute("ipv6_cidr_blocks"); cidrBlocksAttr != nil {
+
+					if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
+						return nil
+					}
+
+					for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
+						if strings.HasSuffix(cidr.AsString(), "/0") {
+							results = append(results,
+								check.NewResultWithValueAnnotation(
+									fmt.Sprintf("Resource '%s' defines a fully open egress security group.", block.Name()),
+									cidrBlocksAttr.Range(),
+									cidrBlocksAttr,
+									scanner.SeverityWarning,
+								),
+							)
+						}
+					}
+				}
+			}
+
+			return results
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws_outdated_ssl.go b/internal/app/tfsec/checks/aws/aws010.go
similarity index 86%
rename from internal/app/tfsec/checks/aws_outdated_ssl.go
rename to internal/app/tfsec/checks/aws/aws010.go
index 6eb60772e..e679873e1 100644
--- a/internal/app/tfsec/checks/aws_outdated_ssl.go
+++ b/internal/app/tfsec/checks/aws/aws010.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -34,11 +34,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSOutdatedSSLPolicy,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSOutdatedSSLPolicyDescription,
-            Explanation: AWSOutdatedSSLPolicyExplanation,
-            BadExample:  AWSOutdatedSSLPolicyBadExample,
-            GoodExample: AWSOutdatedSSLPolicyGoodExample,
-            Links: []string{},
+			Summary:     AWSOutdatedSSLPolicyDescription,
+			Explanation: AWSOutdatedSSLPolicyExplanation,
+			BadExample:  AWSOutdatedSSLPolicyBadExample,
+			GoodExample: AWSOutdatedSSLPolicyGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_public.go b/internal/app/tfsec/checks/aws/aws011.go
similarity index 83%
rename from internal/app/tfsec/checks/aws_public.go
rename to internal/app/tfsec/checks/aws/aws011.go
index cfb180af2..10d9dc829 100644
--- a/internal/app/tfsec/checks/aws_public.go
+++ b/internal/app/tfsec/checks/aws/aws011.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSPubliclyAccessibleResource,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSPubliclyAccessibleResourceDescription,
-            Explanation: AWSPubliclyAccessibleResourceExplanation,
-            BadExample:  AWSPubliclyAccessibleResourceBadExample,
-            GoodExample: AWSPubliclyAccessibleResourceGoodExample,
-            Links: []string{},
+			Summary:     AWSPubliclyAccessibleResourceDescription,
+			Explanation: AWSPubliclyAccessibleResourceExplanation,
+			BadExample:  AWSPubliclyAccessibleResourceBadExample,
+			GoodExample: AWSPubliclyAccessibleResourceGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_public_ip.go b/internal/app/tfsec/checks/aws/aws012.go
similarity index 83%
rename from internal/app/tfsec/checks/aws_public_ip.go
rename to internal/app/tfsec/checks/aws/aws012.go
index 1acd4d89e..2367dea5d 100644
--- a/internal/app/tfsec/checks/aws_public_ip.go
+++ b/internal/app/tfsec/checks/aws/aws012.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSResourceHasPublicIP,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSResourceHasPublicIPDescription,
-            Explanation: AWSResourceHasPublicIPExplanation,
-            BadExample:  AWSResourceHasPublicIPBadExample,
-            GoodExample: AWSResourceHasPublicIPGoodExample,
-            Links: []string{},
+			Summary:     AWSResourceHasPublicIPDescription,
+			Explanation: AWSResourceHasPublicIPExplanation,
+			BadExample:  AWSResourceHasPublicIPBadExample,
+			GoodExample: AWSResourceHasPublicIPGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_task_definition_includes_sensitive_data.go b/internal/app/tfsec/checks/aws/aws013.go
similarity index 85%
rename from internal/app/tfsec/checks/aws_task_definition_includes_sensitive_data.go
rename to internal/app/tfsec/checks/aws/aws013.go
index 147fc204e..6b7c1d820 100644
--- a/internal/app/tfsec/checks/aws_task_definition_includes_sensitive_data.go
+++ b/internal/app/tfsec/checks/aws/aws013.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"encoding/json"
@@ -30,11 +30,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSTaskDefinitionWithSensitiveEnvironmentVariables,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSTaskDefinitionWithSensitiveEnvironmentVariablesDescription,
-            Explanation: AWSTaskDefinitionWithSensitiveEnvironmentVariablesExplanation,
-            BadExample:  AWSTaskDefinitionWithSensitiveEnvironmentVariablesBadExample,
-            GoodExample: AWSTaskDefinitionWithSensitiveEnvironmentVariablesGoodExample,
-            Links: []string{},
+			Summary:     AWSTaskDefinitionWithSensitiveEnvironmentVariablesDescription,
+			Explanation: AWSTaskDefinitionWithSensitiveEnvironmentVariablesExplanation,
+			BadExample:  AWSTaskDefinitionWithSensitiveEnvironmentVariablesBadExample,
+			GoodExample: AWSTaskDefinitionWithSensitiveEnvironmentVariablesGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_block_device.go b/internal/app/tfsec/checks/aws/aws014.go
similarity index 90%
rename from internal/app/tfsec/checks/aws_unencrypted_block_device.go
rename to internal/app/tfsec/checks/aws/aws014.go
index fabd729ef..5be8b9c3b 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_block_device.go
+++ b/internal/app/tfsec/checks/aws/aws014.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSLaunchConfigurationWithUnencryptedBlockDeviceDescription,
-            Explanation: AWSLaunchConfigurationWithUnencryptedBlockDeviceExplanation,
-            BadExample:  AWSLaunchConfigurationWithUnencryptedBlockDeviceBadExample,
-            GoodExample: AWSLaunchConfigurationWithUnencryptedBlockDeviceGoodExample,
-            Links: []string{},
+			Summary:     AWSLaunchConfigurationWithUnencryptedBlockDeviceDescription,
+			Explanation: AWSLaunchConfigurationWithUnencryptedBlockDeviceExplanation,
+			BadExample:  AWSLaunchConfigurationWithUnencryptedBlockDeviceBadExample,
+			GoodExample: AWSLaunchConfigurationWithUnencryptedBlockDeviceGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_sqs_queue.go b/internal/app/tfsec/checks/aws/aws015.go
similarity index 85%
rename from internal/app/tfsec/checks/aws_unencrypted_sqs_queue.go
rename to internal/app/tfsec/checks/aws/aws015.go
index 342a3acd3..d85cfa011 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_sqs_queue.go
+++ b/internal/app/tfsec/checks/aws/aws015.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedSQSQueue,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedSQSQueueDescription,
-            Explanation: AWSUnencryptedSQSQueueExplanation,
-            BadExample:  AWSUnencryptedSQSQueueBadExample,
-            GoodExample: AWSUnencryptedSQSQueueGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedSQSQueueDescription,
+			Explanation: AWSUnencryptedSQSQueueExplanation,
+			BadExample:  AWSUnencryptedSQSQueueBadExample,
+			GoodExample: AWSUnencryptedSQSQueueGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_sns_topic.go b/internal/app/tfsec/checks/aws/aws016.go
similarity index 85%
rename from internal/app/tfsec/checks/aws_unencrypted_sns_topic.go
rename to internal/app/tfsec/checks/aws/aws016.go
index 7c2d79b69..7e9f9f2c8 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_sns_topic.go
+++ b/internal/app/tfsec/checks/aws/aws016.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedSNSTopic,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedSNSTopicDescription,
-            Explanation: AWSUnencryptedSNSTopicExplanation,
-            BadExample:  AWSUnencryptedSNSTopicBadExample,
-            GoodExample: AWSUnencryptedSNSTopicGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedSNSTopicDescription,
+			Explanation: AWSUnencryptedSNSTopicExplanation,
+			BadExample:  AWSUnencryptedSNSTopicBadExample,
+			GoodExample: AWSUnencryptedSNSTopicGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_s3_bucket.go b/internal/app/tfsec/checks/aws/aws017.go
similarity index 89%
rename from internal/app/tfsec/checks/aws_unencrypted_s3_bucket.go
rename to internal/app/tfsec/checks/aws/aws017.go
index 7b78c59d8..36a8cae08 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_s3_bucket.go
+++ b/internal/app/tfsec/checks/aws/aws017.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -25,11 +25,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedS3Bucket,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedS3BucketDescription,
-            Explanation: AWSUnencryptedS3BucketExplanation,
-            BadExample:  AWSUnencryptedS3BucketBadExample,
-            GoodExample: AWSUnencryptedS3BucketGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedS3BucketDescription,
+			Explanation: AWSUnencryptedS3BucketExplanation,
+			BadExample:  AWSUnencryptedS3BucketBadExample,
+			GoodExample: AWSUnencryptedS3BucketGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_missing_description_in_security_group.go b/internal/app/tfsec/checks/aws/aws018.go
similarity index 86%
rename from internal/app/tfsec/checks/aws_missing_description_in_security_group.go
rename to internal/app/tfsec/checks/aws/aws018.go
index c880532c9..9405d5804 100644
--- a/internal/app/tfsec/checks/aws_missing_description_in_security_group.go
+++ b/internal/app/tfsec/checks/aws/aws018.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 	"github.com/zclconf/go-cty/cty"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
@@ -26,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSNoDescriptionInSecurityGroup,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSNoDescriptionInSecurityGroupDescription,
-            Explanation: AWSNoInSecurityGroupExplanation,
-            BadExample:  AWSNoInSecurityGroupBadExample,
-            GoodExample: AWSNoInSecurityGroupGoodExample,
-            Links: []string{},
+			Summary:     AWSNoDescriptionInSecurityGroupDescription,
+			Explanation: AWSNoInSecurityGroupExplanation,
+			BadExample:  AWSNoInSecurityGroupBadExample,
+			GoodExample: AWSNoInSecurityGroupGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_no_kms_key_autorotate.go b/internal/app/tfsec/checks/aws/aws019.go
similarity index 85%
rename from internal/app/tfsec/checks/aws_no_kms_key_autorotate.go
rename to internal/app/tfsec/checks/aws/aws019.go
index 109efe76b..cea3e879c 100644
--- a/internal/app/tfsec/checks/aws_no_kms_key_autorotate.go
+++ b/internal/app/tfsec/checks/aws/aws019.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 	"github.com/zclconf/go-cty/cty"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
@@ -26,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSNoKMSAutoRotate,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSNoKMSAutoRotateDescription,
-            Explanation: AWSNoKMSAutoRotateExplanation,
-            BadExample:  AWSNoKMSAutoRotateBadExample,
-            GoodExample: AWSNoKMSAutoRotateGoodExample,
-            Links: []string{},
+			Summary:     AWSNoKMSAutoRotateDescription,
+			Explanation: AWSNoKMSAutoRotateExplanation,
+			BadExample:  AWSNoKMSAutoRotateBadExample,
+			GoodExample: AWSNoKMSAutoRotateGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_cloudfront_communications.go b/internal/app/tfsec/checks/aws/aws020.go
similarity index 90%
rename from internal/app/tfsec/checks/aws_unencrypted_cloudfront_communications.go
rename to internal/app/tfsec/checks/aws/aws020.go
index a26c8cc6f..a16e8e0cb 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_cloudfront_communications.go
+++ b/internal/app/tfsec/checks/aws/aws020.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedCloudFrontCommunications,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedCloudFrontCommunicationsDescription,
-            Explanation: AWSUnencryptedCloudFrontCommunicationsExplanation,
-            BadExample:  AWSUnencryptedCloudFrontCommunicationsBadExample,
-            GoodExample: AWSUnencryptedCloudFrontCommunicationsGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedCloudFrontCommunicationsDescription,
+			Explanation: AWSUnencryptedCloudFrontCommunicationsExplanation,
+			BadExample:  AWSUnencryptedCloudFrontCommunicationsBadExample,
+			GoodExample: AWSUnencryptedCloudFrontCommunicationsGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_cloudfront_outdated_protocol.go b/internal/app/tfsec/checks/aws/aws021.go
similarity index 87%
rename from internal/app/tfsec/checks/aws_cloudfront_outdated_protocol.go
rename to internal/app/tfsec/checks/aws/aws021.go
index dfca18fb9..c93f480b3 100644
--- a/internal/app/tfsec/checks/aws_cloudfront_outdated_protocol.go
+++ b/internal/app/tfsec/checks/aws/aws021.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
+	"github.com/zclconf/go-cty/cty"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-	"github.com/zclconf/go-cty/cty"
 )
 
 // AWSCloudFrontOutdatedProtocol See https://github.com/tfsec/tfsec#included-checks for check info
@@ -25,11 +26,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSCloudFrontOutdatedProtocol,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSCloudFrontOutdatedProtocolDescription,
-            Explanation: AWSCloudFrontOutdatedProtocolExplanation,
-            BadExample:  AWSCloudFrontOutdatedProtocolBadExample,
-            GoodExample: AWSCloudFrontOutdatedProtocolGoodExample,
-            Links: []string{},
+			Summary:     AWSCloudFrontOutdatedProtocolDescription,
+			Explanation: AWSCloudFrontOutdatedProtocolExplanation,
+			BadExample:  AWSCloudFrontOutdatedProtocolBadExample,
+			GoodExample: AWSCloudFrontOutdatedProtocolGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_msk_broker_transit.go b/internal/app/tfsec/checks/aws/aws022.go
similarity index 91%
rename from internal/app/tfsec/checks/aws_unencrypted_msk_broker_transit.go
rename to internal/app/tfsec/checks/aws/aws022.go
index 31017d69a..f69d5b081 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_msk_broker_transit.go
+++ b/internal/app/tfsec/checks/aws/aws022.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -25,11 +25,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedMSKBroker,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedMSKBrokerDescription,
-            Explanation: AWSUnencryptedMSKBrokerExplanation,
-            BadExample:  AWSUnencryptedMSKBrokerBadExample,
-            GoodExample: AWSUnencryptedMSKBrokerGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedMSKBrokerDescription,
+			Explanation: AWSUnencryptedMSKBrokerExplanation,
+			BadExample:  AWSUnencryptedMSKBrokerBadExample,
+			GoodExample: AWSUnencryptedMSKBrokerGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_ecr_image_scan.go b/internal/app/tfsec/checks/aws/aws023.go
similarity index 85%
rename from internal/app/tfsec/checks/aws_ecr_image_scan.go
rename to internal/app/tfsec/checks/aws/aws023.go
index 114799a72..8c4b2f306 100644
--- a/internal/app/tfsec/checks/aws_ecr_image_scan.go
+++ b/internal/app/tfsec/checks/aws/aws023.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSEcrImageScanNotEnabled,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSEcrImageScanNotEnabledDescription,
-            Explanation: AWSEcrImageScanNotEnabledExplanation,
-            BadExample:  AWSEcrImageScanNotEnabledBadExample,
-            GoodExample: AWSEcrImageScanNotEnabledGoodExample,
-            Links: []string{},
+			Summary:     AWSEcrImageScanNotEnabledDescription,
+			Explanation: AWSEcrImageScanNotEnabledExplanation,
+			BadExample:  AWSEcrImageScanNotEnabledBadExample,
+			GoodExample: AWSEcrImageScanNotEnabledGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_kinesis_streams.go b/internal/app/tfsec/checks/aws/aws024.go
similarity index 85%
rename from internal/app/tfsec/checks/aws_unencrypted_kinesis_streams.go
rename to internal/app/tfsec/checks/aws/aws024.go
index fa07e799c..9c099c3be 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_kinesis_streams.go
+++ b/internal/app/tfsec/checks/aws/aws024.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedKinesisStream,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedKinesisStreamDescription,
-            Explanation: AWSUnencryptedKinesisStreamExplanation,
-            BadExample:  AWSUnencryptedKinesisStreamBadExample,
-            GoodExample: AWSUnencryptedKinesisStreamGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedKinesisStreamDescription,
+			Explanation: AWSUnencryptedKinesisStreamExplanation,
+			BadExample:  AWSUnencryptedKinesisStreamBadExample,
+			GoodExample: AWSUnencryptedKinesisStreamGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_api_gateway_domain_name_missing_security_policy.go b/internal/app/tfsec/checks/aws/aws025.go
similarity index 83%
rename from internal/app/tfsec/checks/aws_api_gateway_domain_name_missing_security_policy.go
rename to internal/app/tfsec/checks/aws/aws025.go
index 0a29890cc..0cf94c5d5 100644
--- a/internal/app/tfsec/checks/aws_api_gateway_domain_name_missing_security_policy.go
+++ b/internal/app/tfsec/checks/aws/aws025.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
+	"github.com/zclconf/go-cty/cty"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-	"github.com/zclconf/go-cty/cty"
 )
 
 // AWSApiGatewayDomainNameOutdatedSecurityPolicy See https://github.com/tfsec/tfsec#included-checks for check info
@@ -25,11 +26,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSApiGatewayDomainNameOutdatedSecurityPolicy,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSApiGatewayDomainNameOutdatedSecurityPolicyDescription,
-            Explanation: AWSApiGatewayDomainNameOutdatedSecurityPolicyExplanation,
-            BadExample:  AWSApiGatewayDomainNameOutdatedSecurityPolicyBadExample,
-            GoodExample: AWSApiGatewayDomainNameOutdatedSecurityPolicyGoodExample,
-            Links: []string{},
+			Summary:     AWSApiGatewayDomainNameOutdatedSecurityPolicyDescription,
+			Explanation: AWSApiGatewayDomainNameOutdatedSecurityPolicyExplanation,
+			BadExample:  AWSApiGatewayDomainNameOutdatedSecurityPolicyBadExample,
+			GoodExample: AWSApiGatewayDomainNameOutdatedSecurityPolicyGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_elasticsearch_domain.go b/internal/app/tfsec/checks/aws/aws031.go
similarity index 87%
rename from internal/app/tfsec/checks/aws_unencrypted_elasticsearch_domain.go
rename to internal/app/tfsec/checks/aws/aws031.go
index 9be1fe430..0d6874d2e 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_elasticsearch_domain.go
+++ b/internal/app/tfsec/checks/aws/aws031.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 	"github.com/zclconf/go-cty/cty"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
@@ -26,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedElasticsearchDomain,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedElasticsearchDomainDescription,
-            Explanation: AWSUnencryptedElasticsearchDomainExplanation,
-            BadExample:  AWSUnencryptedElasticsearchDomainBadExample,
-            GoodExample: AWSUnencryptedElasticsearchDomainGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedElasticsearchDomainDescription,
+			Explanation: AWSUnencryptedElasticsearchDomainExplanation,
+			BadExample:  AWSUnencryptedElasticsearchDomainBadExample,
+			GoodExample: AWSUnencryptedElasticsearchDomainGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_plaintext_node_to_node_elasticsearch_traffic.go b/internal/app/tfsec/checks/aws/aws032.go
similarity index 87%
rename from internal/app/tfsec/checks/aws_plaintext_node_to_node_elasticsearch_traffic.go
rename to internal/app/tfsec/checks/aws/aws032.go
index 36ed8d230..11cf54de4 100644
--- a/internal/app/tfsec/checks/aws_plaintext_node_to_node_elasticsearch_traffic.go
+++ b/internal/app/tfsec/checks/aws/aws032.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 	"github.com/zclconf/go-cty/cty"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
@@ -26,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSPlaintextNodeToNodeElasticsearchTraffic,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSPlaintextNodeToNodeElasticsearchTrafficDescription,
-            Explanation: AWSPlaintextNodeToNodeElasticsearchTrafficExplanation,
-            BadExample:  AWSPlaintextNodeToNodeElasticsearchTrafficBadExample,
-            GoodExample: AWSPlaintextNodeToNodeElasticsearchTrafficGoodExample,
-            Links: []string{},
+			Summary:     AWSPlaintextNodeToNodeElasticsearchTrafficDescription,
+			Explanation: AWSPlaintextNodeToNodeElasticsearchTrafficExplanation,
+			BadExample:  AWSPlaintextNodeToNodeElasticsearchTrafficBadExample,
+			GoodExample: AWSPlaintextNodeToNodeElasticsearchTrafficGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unenforced_https_elasticsearch_domain_endpoint.go b/internal/app/tfsec/checks/aws/aws033.go
similarity index 86%
rename from internal/app/tfsec/checks/aws_unenforced_https_elasticsearch_domain_endpoint.go
rename to internal/app/tfsec/checks/aws/aws033.go
index c3835bb59..4d1675da1 100644
--- a/internal/app/tfsec/checks/aws_unenforced_https_elasticsearch_domain_endpoint.go
+++ b/internal/app/tfsec/checks/aws/aws033.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 	"github.com/zclconf/go-cty/cty"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
@@ -27,11 +28,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnenforcedHTTPSElasticsearchDomainEndpoint,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnenforcedHTTPSElasticsearchDomainEndpointDescription,
-            Explanation: AWSUnenforcedHTTPSElasticsearchDomainEndpointExplanation,
-            BadExample:  AWSUnenforcedHTTPSElasticsearchDomainEndpointBadExample,
-            GoodExample: AWSUnenforcedHTTPSElasticsearchDomainEndpointGoodExample,
-            Links: []string{},
+			Summary:     AWSUnenforcedHTTPSElasticsearchDomainEndpointDescription,
+			Explanation: AWSUnenforcedHTTPSElasticsearchDomainEndpointExplanation,
+			BadExample:  AWSUnenforcedHTTPSElasticsearchDomainEndpointBadExample,
+			GoodExample: AWSUnenforcedHTTPSElasticsearchDomainEndpointGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_oudated_tls_policy_elasticsearch_domain_endpoint.go b/internal/app/tfsec/checks/aws/aws034.go
similarity index 84%
rename from internal/app/tfsec/checks/aws_oudated_tls_policy_elasticsearch_domain_endpoint.go
rename to internal/app/tfsec/checks/aws/aws034.go
index 104d7587b..dd0d99554 100644
--- a/internal/app/tfsec/checks/aws_oudated_tls_policy_elasticsearch_domain_endpoint.go
+++ b/internal/app/tfsec/checks/aws/aws034.go
@@ -1,11 +1,12 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 	"github.com/zclconf/go-cty/cty"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
@@ -27,11 +28,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSOutdatedTLSPolicyElasticsearchDomainEndpointDescription,
-            Explanation: AWSOutdatedTLSPolicyElasticsearchDomainEndpointExplanation,
-            BadExample:  AWSOutdatedTLSPolicyElasticsearchDomainEndpointBadExample,
-            GoodExample: AWSOutdatedTLSPolicyElasticsearchDomainEndpointGoodExample,
-            Links: []string{},
+			Summary:     AWSOutdatedTLSPolicyElasticsearchDomainEndpointDescription,
+			Explanation: AWSOutdatedTLSPolicyElasticsearchDomainEndpointExplanation,
+			BadExample:  AWSOutdatedTLSPolicyElasticsearchDomainEndpointBadExample,
+			GoodExample: AWSOutdatedTLSPolicyElasticsearchDomainEndpointGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_unencrypted_at_rest_elasticache_replication_group.go b/internal/app/tfsec/checks/aws/aws035.go
similarity index 79%
rename from internal/app/tfsec/checks/aws_unencrypted_at_rest_elasticache_replication_group.go
rename to internal/app/tfsec/checks/aws/aws035.go
index 5beda145c..d0d5d44ce 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_at_rest_elasticache_replication_group.go
+++ b/internal/app/tfsec/checks/aws/aws035.go
@@ -1,8 +1,9 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
@@ -25,11 +26,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedAtRestElasticacheReplicationGroup,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedAtRestElasticacheReplicationGroupDescription,
-            Explanation: AWSUnencryptedAtRestElasticacheReplicationGroupExplanation,
-            BadExample:  AWSUnencryptedAtRestElasticacheReplicationGroupBadExample,
-            GoodExample: AWSUnencryptedAtRestElasticacheReplicationGroupGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedAtRestElasticacheReplicationGroupDescription,
+			Explanation: AWSUnencryptedAtRestElasticacheReplicationGroupExplanation,
+			BadExample:  AWSUnencryptedAtRestElasticacheReplicationGroupBadExample,
+			GoodExample: AWSUnencryptedAtRestElasticacheReplicationGroupGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
@@ -45,7 +46,7 @@ func init() {
 						scanner.SeverityError,
 					),
 				}
-			} else if !isBooleanOrStringTrue(encryptionAttr) {
+			} else if !checks.IsBooleanOrStringTrue(encryptionAttr) {
 				return []scanner.Result{
 					check.NewResultWithValueAnnotation(
 						fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (at_rest_encryption_enabled set to false).", block.Name()),
diff --git a/internal/app/tfsec/checks/aws_unencrypted_in_transit_elasticache_replication_group.go b/internal/app/tfsec/checks/aws/aws036.go
similarity index 79%
rename from internal/app/tfsec/checks/aws_unencrypted_in_transit_elasticache_replication_group.go
rename to internal/app/tfsec/checks/aws/aws036.go
index 1657196b9..dfe76fcec 100644
--- a/internal/app/tfsec/checks/aws_unencrypted_in_transit_elasticache_replication_group.go
+++ b/internal/app/tfsec/checks/aws/aws036.go
@@ -1,8 +1,9 @@
-package checks
+package aws
 
 import (
 	"fmt"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
@@ -25,11 +26,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSUnencryptedInTransitElasticacheReplicationGroup,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSUnencryptedInTransitElasticacheReplicationGroupDescription,
-            Explanation: AWSUnencryptedInTransitElasticacheReplicationGroupExplanation,
-            BadExample:  AWSUnencryptedInTransitElasticacheReplicationGroupBadExample,
-            GoodExample: AWSUnencryptedInTransitElasticacheReplicationGroupGoodExample,
-            Links: []string{},
+			Summary:     AWSUnencryptedInTransitElasticacheReplicationGroupDescription,
+			Explanation: AWSUnencryptedInTransitElasticacheReplicationGroupExplanation,
+			BadExample:  AWSUnencryptedInTransitElasticacheReplicationGroupBadExample,
+			GoodExample: AWSUnencryptedInTransitElasticacheReplicationGroupGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
@@ -45,7 +46,7 @@ func init() {
 						scanner.SeverityError,
 					),
 				}
-			} else if !isBooleanOrStringTrue(encryptionAttr) {
+			} else if !checks.IsBooleanOrStringTrue(encryptionAttr) {
 				return []scanner.Result{
 					check.NewResultWithValueAnnotation(
 						fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (transit_encryption_enabled set to false).", block.Name()),
diff --git a/internal/app/tfsec/checks/aws/aws037.go b/internal/app/tfsec/checks/aws/aws037.go
new file mode 100644
index 000000000..c55ed8f23
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws037.go
@@ -0,0 +1,78 @@
+package aws
+
+import (
+	"fmt"
+
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+)
+
+const (
+	AWSIAMPasswordReusePrevention            scanner.RuleID      = "AWS037"
+	AWSIAMPasswordReusePreventionDescription scanner.RuleSummary = "IAM Password policy should prevent password reuse."
+
+	AWSIAMPasswordReusePreventionExplanation = `
+IAM account password policies should prevent the reuse of passwords. 
+
+The account password policy should be set to prevent using any of the last five used passwords.
+`
+	AWSIAMPasswordReusePreventionBadExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	password_reuse_prevention = 1
+	...
+}
+`
+	AWSIAMPasswordReusePreventionGoodExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	password_reuse_prevention = 5
+	...
+}
+`
+)
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSIAMPasswordReusePrevention,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSIAMPasswordReusePreventionDescription,
+			Explanation: AWSIAMPasswordReusePreventionExplanation,
+			BadExample:  AWSIAMPasswordReusePreventionBadExample,
+			GoodExample: AWSIAMPasswordReusePreventionGoodExample,
+			Links: []string{
+				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
+			},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_iam_account_password_policy"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+			if attr := block.GetAttribute("password_reuse_prevention"); attr == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' does not have a password reuse prevention count set.", block.Name()),
+						block.Range(),
+						scanner.SeverityWarning,
+					),
+				}
+			} else if attr.Value().Type() == cty.Number {
+				value, _ := attr.Value().AsBigFloat().Float64()
+				if value < 5 {
+					return []scanner.Result{
+						check.NewResult(
+							fmt.Sprintf("Resource '%s' has a password reuse count less than 5.", block.Name()),
+							block.Range(),
+							scanner.SeverityWarning,
+						),
+					}
+				}
+			}
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws038.go b/internal/app/tfsec/checks/aws/aws038.go
new file mode 100644
index 000000000..46a311353
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws038.go
@@ -0,0 +1,76 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+const (
+	AWSIAMPasswordExpiry            scanner.RuleID      = "AWS038"
+	AWSIAMPasswordExpiryDescription scanner.RuleSummary = "IAM Password policy should have expiry less than or equal to 90 days."
+
+	AWSIAMPasswordExpiryExplanation = `
+IAM account password policies should have a maximum age specified. 
+
+The account password policy should be set to expire passwords after 90 days or less.
+`
+	AWSIAMPasswordExpiryBadExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	// max_password_age not set
+	...
+}
+`
+	AWSIAMPasswordExpiryGoodExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	max_password_age = 90
+	...
+}
+`
+)
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSIAMPasswordExpiry,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSIAMPasswordExpiryDescription,
+			Explanation: AWSIAMPasswordExpiryExplanation,
+			BadExample:  AWSIAMPasswordExpiryBadExample,
+			GoodExample: AWSIAMPasswordExpiryGoodExample,
+			Links: []string{
+				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
+			},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_iam_account_password_policy"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+			if attr := block.GetAttribute("max_password_age"); attr == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' does not have a max password age set.", block.Name()),
+						block.Range(),
+						scanner.SeverityWarning,
+					),
+				}
+			} else if attr.Value().Type() == cty.Number {
+				value, _ := attr.Value().AsBigFloat().Float64()
+				if value > 90 {
+					return []scanner.Result{
+						check.NewResult(
+							fmt.Sprintf("Resource '%s' has a max age set which is greated than 90 days.", block.Name()),
+							block.Range(),
+							scanner.SeverityWarning,
+						),
+					}
+				}
+			}
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws039.go b/internal/app/tfsec/checks/aws/aws039.go
new file mode 100644
index 000000000..d18cc342e
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws039.go
@@ -0,0 +1,76 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+const (
+	AWSIAMPasswordMinimumLength            scanner.RuleID      = "AWS039"
+	AWSIAMPasswordMinimumLengthDescription scanner.RuleSummary = "IAM Password policy should have minimum password length of 14 or more characters."
+
+	AWSIAMPasswordMinimumLengthExplanation = `
+IAM account password policies should ensure that passwords have a minimum length. 
+
+The account password policy should be set to enforce minimum password length of at least 14 characters.
+`
+	AWSIAMPasswordMinimumLengthBadExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	// minimum_password_length not set
+	...
+}
+`
+	AWSIAMPasswordMinimumLengthGoodExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	minimum_password_length = 14
+	...
+}
+`
+)
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSIAMPasswordMinimumLength,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSIAMPasswordMinimumLengthDescription,
+			Explanation: AWSIAMPasswordMinimumLengthExplanation,
+			BadExample:  AWSIAMPasswordMinimumLengthBadExample,
+			GoodExample: AWSIAMPasswordMinimumLengthGoodExample,
+			Links: []string{
+				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
+			},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_iam_account_password_policy"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+			if attr := block.GetAttribute("minimum_password_length"); attr == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' does not have a minimum password length set.", block.Name()),
+						block.Range(),
+						scanner.SeverityWarning,
+					),
+				}
+			} else if attr.Value().Type() == cty.Number {
+				value, _ := attr.Value().AsBigFloat().Float64()
+				if value < 14 {
+					return []scanner.Result{
+						check.NewResult(
+							fmt.Sprintf("Resource '%s' has a minimum password length which is less than 14 characters.", block.Name()),
+							block.Range(),
+							scanner.SeverityWarning,
+						),
+					}
+				}
+			}
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws040.go b/internal/app/tfsec/checks/aws/aws040.go
new file mode 100644
index 000000000..b02a92e8a
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws040.go
@@ -0,0 +1,73 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+const (
+	AWSIAMPasswordRequiresSymbol            scanner.RuleID      = "AWS040"
+	AWSIAMPasswordRequiresSymbolDescription scanner.RuleSummary = "IAM Password policy should have requirement for at least one symbol in the password."
+
+	AWSIAMPasswordRequiresSymbolExplanation = `
+IAM account password policies should ensure that passwords content including a symbol.
+`
+	AWSIAMPasswordRequiresSymbolBadExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	// require_symbols not set
+	...
+}
+`
+	AWSIAMPasswordRequiresSymbolGoodExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	require_symbols = true
+	...
+}
+`
+)
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSIAMPasswordRequiresSymbol,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSIAMPasswordRequiresSymbolDescription,
+			Explanation: AWSIAMPasswordRequiresSymbolExplanation,
+			BadExample:  AWSIAMPasswordRequiresSymbolBadExample,
+			GoodExample: AWSIAMPasswordRequiresSymbolGoodExample,
+			Links: []string{
+				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
+			},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_iam_account_password_policy"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+			if attr := block.GetAttribute("require_symbols"); attr == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' does not require a symbol in the password.", block.Name()),
+						block.Range(),
+						scanner.SeverityWarning,
+					),
+				}
+			} else if attr.Value().Type() == cty.Bool {
+				if attr.Value().False() {
+					return []scanner.Result{
+						check.NewResult(
+							fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one symbol in the password.", block.Name()),
+							block.Range(),
+							scanner.SeverityWarning,
+						),
+					}
+				}
+			}
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws041.go b/internal/app/tfsec/checks/aws/aws041.go
new file mode 100644
index 000000000..9a3c15a97
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws041.go
@@ -0,0 +1,73 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+const (
+	AWSIAMPasswordRequiresNumber            scanner.RuleID      = "AWS041"
+	AWSIAMPasswordRequiresNumberDescription scanner.RuleSummary = "IAM Password policy should have requirement for at least one number in the password."
+
+	AWSIAMPasswordRequiresNumberExplanation = `
+IAM account password policies should ensure that passwords content including at least one number.
+`
+	AWSIAMPasswordRequiresNumberBadExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	// require_numbers not set
+	...
+}
+`
+	AWSIAMPasswordRequiresNumberGoodExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	require_numbers = true
+	...
+}
+`
+)
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSIAMPasswordRequiresNumber,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSIAMPasswordRequiresNumberDescription,
+			Explanation: AWSIAMPasswordRequiresNumberExplanation,
+			BadExample:  AWSIAMPasswordRequiresNumberBadExample,
+			GoodExample: AWSIAMPasswordRequiresNumberGoodExample,
+			Links: []string{
+				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
+			},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_iam_account_password_policy"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+			if attr := block.GetAttribute("require_numbers"); attr == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' does not require a number in the password.", block.Name()),
+						block.Range(),
+						scanner.SeverityWarning,
+					),
+				}
+			} else if attr.Value().Type() == cty.Bool {
+				if attr.Value().False() {
+					return []scanner.Result{
+						check.NewResult(
+							fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one number in the password.", block.Name()),
+							block.Range(),
+							scanner.SeverityWarning,
+						),
+					}
+				}
+			}
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws042.go b/internal/app/tfsec/checks/aws/aws042.go
new file mode 100644
index 000000000..77f64a6a2
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws042.go
@@ -0,0 +1,73 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+const (
+	AWSIAMPasswordRequiresLowercaseCharacter            scanner.RuleID      = "AWS042"
+	AWSIAMPasswordRequiresLowercaseCharacterDescription scanner.RuleSummary = "IAM Password policy should have requirement for at least one lowercase character."
+
+	AWSIAMPasswordRequiresLowercaseCharacterExplanation = `
+IAM account password policies should ensure that passwords content including at least one lowercase character.
+`
+	AWSIAMPasswordRequiresLowercaseCharacterBadExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	// require_lowercase_characters not set
+	...
+}
+`
+	AWSIAMPasswordRequiresLowercaseCharacterGoodExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	require_lowercase_characters = true
+	...
+}
+`
+)
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSIAMPasswordRequiresLowercaseCharacter,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSIAMPasswordRequiresLowercaseCharacterDescription,
+			Explanation: AWSIAMPasswordRequiresLowercaseCharacterExplanation,
+			BadExample:  AWSIAMPasswordRequiresLowercaseCharacterBadExample,
+			GoodExample: AWSIAMPasswordRequiresLowercaseCharacterGoodExample,
+			Links: []string{
+				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
+			},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_iam_account_password_policy"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+			if attr := block.GetAttribute("require_lowercase_characters"); attr == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' does not require a lowercase character in the password.", block.Name()),
+						block.Range(),
+						scanner.SeverityWarning,
+					),
+				}
+			} else if attr.Value().Type() == cty.Bool {
+				if attr.Value().False() {
+					return []scanner.Result{
+						check.NewResult(
+							fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least lowercase character in the password.", block.Name()),
+							block.Range(),
+							scanner.SeverityWarning,
+						),
+					}
+				}
+			}
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws/aws043.go b/internal/app/tfsec/checks/aws/aws043.go
new file mode 100644
index 000000000..9d3b42cfd
--- /dev/null
+++ b/internal/app/tfsec/checks/aws/aws043.go
@@ -0,0 +1,74 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+// AWSIAMPasswordRequiresUppercaseCharacter See https://github.com/tfsec/tfsec#included-checks for check info
+const (
+	AWSIAMPasswordRequiresUppercaseCharacter            scanner.RuleID      = "AWS043"
+	AWSIAMPasswordRequiresUppercaseCharacterDescription scanner.RuleSummary = "IAM Password policy should have requirement for at least one uppercase character."
+
+	AWSIAMPasswordRequiresUppercaseCharacterExplanation = `
+IAM account password policies should ensure that passwords content including at least one uppercase character.
+`
+	AWSIAMPasswordRequiresUppercaseCharacterBadExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	// require_uppercase_characters not set
+	...
+}
+`
+	AWSIAMPasswordRequiresUppercaseCharacterGoodExample = `
+resource "aws_iam_account_password_policy" "strict" {
+	...
+	require_uppercase_characters = true
+	...
+}
+`
+)
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AWSIAMPasswordRequiresUppercaseCharacter,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AWSIAMPasswordRequiresUppercaseCharacterDescription,
+			Explanation: AWSIAMPasswordRequiresUppercaseCharacterExplanation,
+			BadExample:  AWSIAMPasswordRequiresUppercaseCharacterBadExample,
+			GoodExample: AWSIAMPasswordRequiresUppercaseCharacterGoodExample,
+			Links: []string{
+				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
+			},
+		},
+		Provider:       scanner.AWSProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_iam_account_password_policy"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+			if attr := block.GetAttribute("require_uppercase_characters"); attr == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' does not require an uppercase character in the password.", block.Name()),
+						block.Range(),
+						scanner.SeverityWarning,
+					),
+				}
+			} else if attr.Value().Type() == cty.Bool {
+				if attr.Value().False() {
+					return []scanner.Result{
+						check.NewResult(
+							fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one uppercase character in the password.", block.Name()),
+							block.Range(),
+							scanner.SeverityWarning,
+						),
+					}
+				}
+			}
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/aws_provider.go b/internal/app/tfsec/checks/aws/aws044.go
similarity index 85%
rename from internal/app/tfsec/checks/aws_provider.go
rename to internal/app/tfsec/checks/aws/aws044.go
index 07ab616ca..690dd1702 100644
--- a/internal/app/tfsec/checks/aws_provider.go
+++ b/internal/app/tfsec/checks/aws/aws044.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSProviderHasAccessCredentials,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSProviderHasAccessCredentialsDescription,
-            Explanation: AWSProviderHasAccessCredentialsExplanation,
-            BadExample:  AWSProviderHasAccessCredentialsBadExample,
-            GoodExample: AWSProviderHasAccessCredentialsGoodExample,
-            Links: []string{},
+			Summary:     AWSProviderHasAccessCredentialsDescription,
+			Explanation: AWSProviderHasAccessCredentialsExplanation,
+			BadExample:  AWSProviderHasAccessCredentialsBadExample,
+			GoodExample: AWSProviderHasAccessCredentialsGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"provider"},
diff --git a/internal/app/tfsec/checks/aws_cloudfront_has_a_waf.go b/internal/app/tfsec/checks/aws/aws045.go
similarity index 81%
rename from internal/app/tfsec/checks/aws_cloudfront_has_a_waf.go
rename to internal/app/tfsec/checks/aws/aws045.go
index 2d7508e6f..8eb4c01ba 100644
--- a/internal/app/tfsec/checks/aws_cloudfront_has_a_waf.go
+++ b/internal/app/tfsec/checks/aws/aws045.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -24,11 +24,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSCloudFrontDoesNotHaveAWaf,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSCloudFrontDoesNotHaveAWafDescription,
-            Explanation: AWSCloudFrontDoesNotHaveAWafExplanation,
-            BadExample:  AWSCloudFrontDoesNotHaveAWafBadExample,
-            GoodExample: AWSCloudFrontDoesNotHaveAWafGoodExample,
-            Links: []string{},
+			Summary:     AWSCloudFrontDoesNotHaveAWafDescription,
+			Explanation: AWSCloudFrontDoesNotHaveAWafExplanation,
+			BadExample:  AWSCloudFrontDoesNotHaveAWafBadExample,
+			GoodExample: AWSCloudFrontDoesNotHaveAWafGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/aws_iam_policy_document.go b/internal/app/tfsec/checks/aws/aws046.go
similarity index 84%
rename from internal/app/tfsec/checks/aws_iam_policy_document.go
rename to internal/app/tfsec/checks/aws/aws046.go
index 57b28cf20..500f1781c 100644
--- a/internal/app/tfsec/checks/aws_iam_policy_document.go
+++ b/internal/app/tfsec/checks/aws/aws046.go
@@ -1,4 +1,4 @@
-package checks
+package aws
 
 import (
 	"fmt"
@@ -25,11 +25,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AWSIamPolicyWildcardActions,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AWSIamPolicyWildcardActionsDescription,
-            Explanation: AWSIamPolicyWildcardActionsExplanation,
-            BadExample:  AWSIamPolicyWildcardActionsBadExample,
-            GoodExample: AWSIamPolicyWildcardActionsGoodExample,
-            Links: []string{},
+			Summary:     AWSIamPolicyWildcardActionsDescription,
+			Explanation: AWSIamPolicyWildcardActionsExplanation,
+			BadExample:  AWSIamPolicyWildcardActionsBadExample,
+			GoodExample: AWSIamPolicyWildcardActionsGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"data"},
diff --git a/internal/app/tfsec/checks/aws_iam_password_policy_checks.go b/internal/app/tfsec/checks/aws_iam_password_policy_checks.go
deleted file mode 100644
index d81d851fe..000000000
--- a/internal/app/tfsec/checks/aws_iam_password_policy_checks.go
+++ /dev/null
@@ -1,469 +0,0 @@
-package checks
-
-import (
-	"fmt"
-
-	"github.com/zclconf/go-cty/cty"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
-)
-
-const (
-	AWSIAMPasswordReusePrevention            scanner.RuleID      = "AWS037"
-	AWSIAMPasswordReusePreventionDescription scanner.RuleSummary = "IAM Password policy should prevent password reuse."
-
-	AWSIAMPasswordReusePreventionExplanation = `
-IAM account password policies should prevent the reuse of passwords. 
-
-The account password policy should be set to prevent using any of the last five used passwords.
-`
-	AWSIAMPasswordReusePreventionBadExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	password_reuse_prevention = 1
-	...
-}
-`
-	AWSIAMPasswordReusePreventionGoodExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	password_reuse_prevention = 5
-	...
-}
-`
-)
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSIAMPasswordReusePrevention,
-		Documentation: scanner.CheckDocumentation{
-			Summary:     AWSIAMPasswordReusePreventionDescription,
-			Explanation: AWSIAMPasswordReusePreventionExplanation,
-			BadExample:  AWSIAMPasswordReusePreventionBadExample,
-			GoodExample: AWSIAMPasswordReusePreventionGoodExample,
-			Links: []string{
-				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
-				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
-			},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_iam_account_password_policy"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-			if attr := block.GetAttribute("password_reuse_prevention"); attr == nil {
-				return []scanner.Result{
-					check.NewResult(
-						fmt.Sprintf("Resource '%s' does not have a password reuse prevention count set.", block.Name()),
-						block.Range(),
-						scanner.SeverityWarning,
-					),
-				}
-			} else if attr.Value().Type() == cty.Number {
-				value, _ := attr.Value().AsBigFloat().Float64()
-				if value < 5 {
-					return []scanner.Result{
-						check.NewResult(
-							fmt.Sprintf("Resource '%s' has a password reuse count less than 5.", block.Name()),
-							block.Range(),
-							scanner.SeverityWarning,
-						),
-					}
-				}
-			}
-			return nil
-		},
-	})
-}
-
-const (
-	AWSIAMPasswordExpiry            scanner.RuleID      = "AWS038"
-	AWSIAMPasswordExpiryDescription scanner.RuleSummary = "IAM Password policy should have expiry less than or equal to 90 days."
-
-	AWSIAMPasswordExpiryExplanation = `
-IAM account password policies should have a maximum age specified. 
-
-The account password policy should be set to expire passwords after 90 days or less.
-`
-	AWSIAMPasswordExpiryBadExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	// max_password_age not set
-	...
-}
-`
-	AWSIAMPasswordExpiryGoodExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	max_password_age = 90
-	...
-}
-`
-)
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSIAMPasswordExpiry,
-		Documentation: scanner.CheckDocumentation{
-			Summary:     AWSIAMPasswordExpiryDescription,
-			Explanation: AWSIAMPasswordExpiryExplanation,
-			BadExample:  AWSIAMPasswordExpiryBadExample,
-			GoodExample: AWSIAMPasswordExpiryGoodExample,
-			Links: []string{
-				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
-				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
-			},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_iam_account_password_policy"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-			if attr := block.GetAttribute("max_password_age"); attr == nil {
-				return []scanner.Result{
-					check.NewResult(
-						fmt.Sprintf("Resource '%s' does not have a max password age set.", block.Name()),
-						block.Range(),
-						scanner.SeverityWarning,
-					),
-				}
-			} else if attr.Value().Type() == cty.Number {
-				value, _ := attr.Value().AsBigFloat().Float64()
-				if value > 90 {
-					return []scanner.Result{
-						check.NewResult(
-							fmt.Sprintf("Resource '%s' has a max age set which is greated than 90 days.", block.Name()),
-							block.Range(),
-							scanner.SeverityWarning,
-						),
-					}
-				}
-			}
-			return nil
-		},
-	})
-}
-
-const (
-	AWSIAMPasswordMinimumLength            scanner.RuleID      = "AWS039"
-	AWSIAMPasswordMinimumLengthDescription scanner.RuleSummary = "IAM Password policy should have minimum password length of 14 or more characters."
-
-	AWSIAMPasswordMinimumLengthExplanation = `
-IAM account password policies should ensure that passwords have a minimum length. 
-
-The account password policy should be set to enforce minimum password length of at least 14 characters.
-`
-	AWSIAMPasswordMinimumLengthBadExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	// minimum_password_length not set
-	...
-}
-`
-	AWSIAMPasswordMinimumLengthGoodExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	minimum_password_length = 14
-	...
-}
-`
-)
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSIAMPasswordMinimumLength,
-		Documentation: scanner.CheckDocumentation{
-			Summary:     AWSIAMPasswordMinimumLengthDescription,
-			Explanation: AWSIAMPasswordMinimumLengthExplanation,
-			BadExample:  AWSIAMPasswordMinimumLengthBadExample,
-			GoodExample: AWSIAMPasswordMinimumLengthGoodExample,
-			Links: []string{
-				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
-				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
-			},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_iam_account_password_policy"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-			if attr := block.GetAttribute("minimum_password_length"); attr == nil {
-				return []scanner.Result{
-					check.NewResult(
-						fmt.Sprintf("Resource '%s' does not have a minimum password length set.", block.Name()),
-						block.Range(),
-						scanner.SeverityWarning,
-					),
-				}
-			} else if attr.Value().Type() == cty.Number {
-				value, _ := attr.Value().AsBigFloat().Float64()
-				if value < 14 {
-					return []scanner.Result{
-						check.NewResult(
-							fmt.Sprintf("Resource '%s' has a minimum password length which is less than 14 characters.", block.Name()),
-							block.Range(),
-							scanner.SeverityWarning,
-						),
-					}
-				}
-			}
-			return nil
-		},
-	})
-}
-
-const (
-	AWSIAMPasswordRequiresSymbol            scanner.RuleID      = "AWS040"
-	AWSIAMPasswordRequiresSymbolDescription scanner.RuleSummary = "IAM Password policy should have requirement for at least one symbol in the password."
-
-	AWSIAMPasswordRequiresSymbolExplanation = `
-IAM account password policies should ensure that passwords content including a symbol.
-`
-	AWSIAMPasswordRequiresSymbolBadExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	// require_symbols not set
-	...
-}
-`
-	AWSIAMPasswordRequiresSymbolGoodExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	require_symbols = true
-	...
-}
-`
-)
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSIAMPasswordRequiresSymbol,
-		Documentation: scanner.CheckDocumentation{
-			Summary:     AWSIAMPasswordRequiresSymbolDescription,
-			Explanation: AWSIAMPasswordRequiresSymbolExplanation,
-			BadExample:  AWSIAMPasswordRequiresSymbolBadExample,
-			GoodExample: AWSIAMPasswordRequiresSymbolGoodExample,
-			Links: []string{
-				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
-				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
-			},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_iam_account_password_policy"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-			if attr := block.GetAttribute("require_symbols"); attr == nil {
-				return []scanner.Result{
-					check.NewResult(
-						fmt.Sprintf("Resource '%s' does not require a symbol in the password.", block.Name()),
-						block.Range(),
-						scanner.SeverityWarning,
-					),
-				}
-			} else if attr.Value().Type() == cty.Bool {
-				if attr.Value().False() {
-					return []scanner.Result{
-						check.NewResult(
-							fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one symbol in the password.", block.Name()),
-							block.Range(),
-							scanner.SeverityWarning,
-						),
-					}
-				}
-			}
-			return nil
-		},
-	})
-}
-
-const (
-	AWSIAMPasswordRequiresNumber            scanner.RuleID      = "AWS041"
-	AWSIAMPasswordRequiresNumberDescription scanner.RuleSummary = "IAM Password policy should have requirement for at least one number in the password."
-
-	AWSIAMPasswordRequiresNumberExplanation = `
-IAM account password policies should ensure that passwords content including at least one number.
-`
-	AWSIAMPasswordRequiresNumberBadExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	// require_numbers not set
-	...
-}
-`
-	AWSIAMPasswordRequiresNumberGoodExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	require_numbers = true
-	...
-}
-`
-)
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSIAMPasswordRequiresNumber,
-		Documentation: scanner.CheckDocumentation{
-			Summary:     AWSIAMPasswordRequiresNumberDescription,
-			Explanation: AWSIAMPasswordRequiresNumberExplanation,
-			BadExample:  AWSIAMPasswordRequiresNumberBadExample,
-			GoodExample: AWSIAMPasswordRequiresNumberGoodExample,
-			Links: []string{
-				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
-				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
-			},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_iam_account_password_policy"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-			if attr := block.GetAttribute("require_numbers"); attr == nil {
-				return []scanner.Result{
-					check.NewResult(
-						fmt.Sprintf("Resource '%s' does not require a number in the password.", block.Name()),
-						block.Range(),
-						scanner.SeverityWarning,
-					),
-				}
-			} else if attr.Value().Type() == cty.Bool {
-				if attr.Value().False() {
-					return []scanner.Result{
-						check.NewResult(
-							fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one number in the password.", block.Name()),
-							block.Range(),
-							scanner.SeverityWarning,
-						),
-					}
-				}
-			}
-			return nil
-		},
-	})
-}
-
-const (
-	AWSIAMPasswordRequiresLowercaseCharacter            scanner.RuleID      = "AWS042"
-	AWSIAMPasswordRequiresLowercaseCharacterDescription scanner.RuleSummary = "IAM Password policy should have requirement for at least one lowercase character."
-
-	AWSIAMPasswordRequiresLowercaseCharacterExplanation = `
-IAM account password policies should ensure that passwords content including at least one lowercase character.
-`
-	AWSIAMPasswordRequiresLowercaseCharacterBadExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	// require_lowercase_characters not set
-	...
-}
-`
-	AWSIAMPasswordRequiresLowercaseCharacterGoodExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	require_lowercase_characters = true
-	...
-}
-`
-)
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSIAMPasswordRequiresLowercaseCharacter,
-		Documentation: scanner.CheckDocumentation{
-			Summary:     AWSIAMPasswordRequiresLowercaseCharacterDescription,
-			Explanation: AWSIAMPasswordRequiresLowercaseCharacterExplanation,
-			BadExample:  AWSIAMPasswordRequiresLowercaseCharacterBadExample,
-			GoodExample: AWSIAMPasswordRequiresLowercaseCharacterGoodExample,
-			Links: []string{
-				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
-				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
-			},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_iam_account_password_policy"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-			if attr := block.GetAttribute("require_lowercase_characters"); attr == nil {
-				return []scanner.Result{
-					check.NewResult(
-						fmt.Sprintf("Resource '%s' does not require a lowercase character in the password.", block.Name()),
-						block.Range(),
-						scanner.SeverityWarning,
-					),
-				}
-			} else if attr.Value().Type() == cty.Bool {
-				if attr.Value().False() {
-					return []scanner.Result{
-						check.NewResult(
-							fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least lowercase character in the password.", block.Name()),
-							block.Range(),
-							scanner.SeverityWarning,
-						),
-					}
-				}
-			}
-			return nil
-		},
-	})
-}
-
-// AWSIAMPasswordRequiresUppercaseCharacter See https://github.com/tfsec/tfsec#included-checks for check info
-const (
-	AWSIAMPasswordRequiresUppercaseCharacter            scanner.RuleID      = "AWS043"
-	AWSIAMPasswordRequiresUppercaseCharacterDescription scanner.RuleSummary = "IAM Password policy should have requirement for at least one uppercase character."
-
-	AWSIAMPasswordRequiresUppercaseCharacterExplanation = `
-IAM account password policies should ensure that passwords content including at least one uppercase character.
-`
-	AWSIAMPasswordRequiresUppercaseCharacterBadExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	// require_uppercase_characters not set
-	...
-}
-`
-	AWSIAMPasswordRequiresUppercaseCharacterGoodExample = `
-resource "aws_iam_account_password_policy" "strict" {
-	...
-	require_uppercase_characters = true
-	...
-}
-`
-)
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSIAMPasswordRequiresUppercaseCharacter,
-		Documentation: scanner.CheckDocumentation{
-			Summary:     AWSIAMPasswordRequiresUppercaseCharacterDescription,
-			Explanation: AWSIAMPasswordRequiresUppercaseCharacterExplanation,
-			BadExample:  AWSIAMPasswordRequiresUppercaseCharacterBadExample,
-			GoodExample: AWSIAMPasswordRequiresUppercaseCharacterGoodExample,
-			Links: []string{
-				"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details",
-				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy",
-			},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_iam_account_password_policy"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-			if attr := block.GetAttribute("require_uppercase_characters"); attr == nil {
-				return []scanner.Result{
-					check.NewResult(
-						fmt.Sprintf("Resource '%s' does not require an uppercase character in the password.", block.Name()),
-						block.Range(),
-						scanner.SeverityWarning,
-					),
-				}
-			} else if attr.Value().Type() == cty.Bool {
-				if attr.Value().False() {
-					return []scanner.Result{
-						check.NewResult(
-							fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one uppercase character in the password.", block.Name()),
-							block.Range(),
-							scanner.SeverityWarning,
-						),
-					}
-				}
-			}
-			return nil
-		},
-	})
-}
diff --git a/internal/app/tfsec/checks/aws_open_security_group_rules.go b/internal/app/tfsec/checks/aws_open_security_group_rules.go
deleted file mode 100644
index 086fda99a..000000000
--- a/internal/app/tfsec/checks/aws_open_security_group_rules.go
+++ /dev/null
@@ -1,164 +0,0 @@
-package checks
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/zclconf/go-cty/cty"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
-)
-
-// AWSOpenIngressSecurityGroupRule See https://github.com/tfsec/tfsec#included-checks for check info
-const AWSOpenIngressSecurityGroupRule scanner.RuleID = "AWS006"
-const AWSOpenIngressSecurityGroupRuleDescription scanner.RuleSummary = "An ingress security group rule allows traffic from `/0`."
-const AWSOpenIngressSecurityGroupRuleExplanation = `
-
-`
-const AWSOpenIngressSecurityGroupRuleBadExample = `
-
-`
-const AWSOpenIngressSecurityGroupRuleGoodExample = `
-
-`
-
-// AWSOpenEgressSecurityGroupRule See https://github.com/tfsec/tfsec#included-checks for check info
-const AWSOpenEgressSecurityGroupRule scanner.RuleID = "AWS007"
-const AWSOpenEgressSecurityGroupRuleDescription scanner.RuleSummary = "An egress security group rule allows traffic to `/0`."
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSOpenIngressSecurityGroupRule,
-		Documentation: scanner.CheckDocumentation{
-			Summary: AWSOpenIngressSecurityGroupRuleDescription,
-            Explanation: AWSOpenIngressSecurityGroupRuleExplanation,
-            BadExample:  AWSOpenIngressSecurityGroupRuleBadExample,
-            GoodExample: AWSOpenIngressSecurityGroupRuleGoodExample,
-            Links: []string{},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_security_group_rule"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-
-			typeAttr := block.GetAttribute("type")
-			if typeAttr == nil || typeAttr.Type() != cty.String {
-				return nil
-			}
-
-			if typeAttr.Value().AsString() != "ingress" {
-				return nil
-			}
-
-			if cidrBlocksAttr := block.GetAttribute("cidr_blocks"); cidrBlocksAttr != nil {
-
-				if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
-					return nil
-				}
-
-				for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
-					if strings.HasSuffix(cidr.AsString(), "/0") {
-						return []scanner.Result{
-							check.NewResult(
-								fmt.Sprintf("Resource '%s' defines a fully open ingress security group rule.", block.Name()),
-								cidrBlocksAttr.Range(),
-								scanner.SeverityWarning,
-							),
-						}
-					}
-				}
-
-			}
-
-			if ipv6CidrBlocksAttr := block.GetAttribute("ipv6_cidr_blocks"); ipv6CidrBlocksAttr != nil {
-
-				if ipv6CidrBlocksAttr.Value().IsNull() || ipv6CidrBlocksAttr.Value().LengthInt() == 0 {
-					return nil
-				}
-
-				for _, cidr := range ipv6CidrBlocksAttr.Value().AsValueSlice() {
-					if strings.HasSuffix(cidr.AsString(), "/0") {
-						return []scanner.Result{
-							check.NewResultWithValueAnnotation(
-								fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", block.Name()),
-								ipv6CidrBlocksAttr.Range(),
-								ipv6CidrBlocksAttr,
-								scanner.SeverityWarning,
-							),
-						}
-					}
-				}
-
-			}
-
-			return nil
-		},
-	})
-
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSOpenEgressSecurityGroupRule,
-		Documentation: scanner.CheckDocumentation{
-			Summary: AWSOpenEgressSecurityGroupRuleDescription,
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_security_group_rule"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-
-			typeAttr := block.GetAttribute("type")
-			if typeAttr == nil || typeAttr.Type() != cty.String {
-				return nil
-			}
-
-			if typeAttr.Value().AsString() != "egress" {
-				return nil
-			}
-
-			if cidrBlocksAttr := block.GetAttribute("cidr_blocks"); cidrBlocksAttr != nil {
-
-				if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
-					return nil
-				}
-
-				for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
-					if strings.HasSuffix(cidr.AsString(), "/0") {
-						return []scanner.Result{
-							check.NewResultWithValueAnnotation(
-								fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", block.Name()),
-								cidrBlocksAttr.Range(),
-								cidrBlocksAttr,
-								scanner.SeverityWarning,
-							),
-						}
-					}
-				}
-
-			}
-
-			if ipv6CidrBlocksAttr := block.GetAttribute("ipv6_cidr_blocks"); ipv6CidrBlocksAttr != nil {
-
-				if ipv6CidrBlocksAttr.Value().IsNull() || ipv6CidrBlocksAttr.Value().LengthInt() == 0 {
-					return nil
-				}
-
-				for _, cidr := range ipv6CidrBlocksAttr.Value().AsValueSlice() {
-					if strings.HasSuffix(cidr.AsString(), "/0") {
-						return []scanner.Result{
-							check.NewResultWithValueAnnotation(
-								fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", block.Name()),
-								ipv6CidrBlocksAttr.Range(),
-								ipv6CidrBlocksAttr,
-								scanner.SeverityWarning,
-							),
-						}
-					}
-				}
-
-			}
-
-			return nil
-		},
-	})
-}
diff --git a/internal/app/tfsec/checks/aws_open_security_groups.go b/internal/app/tfsec/checks/aws_open_security_groups.go
deleted file mode 100644
index dae15414b..000000000
--- a/internal/app/tfsec/checks/aws_open_security_groups.go
+++ /dev/null
@@ -1,145 +0,0 @@
-package checks
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
-)
-
-// AWSOpenIngressSecurityGroupInlineRule See https://github.com/tfsec/tfsec#included-checks for check info
-const AWSOpenIngressSecurityGroupInlineRule scanner.RuleID = "AWS008"
-const AWSOpenIngressSecurityGroupInlineRuleDescription scanner.RuleSummary = "An inline ingress security group rule allows traffic from `/0`."
-const AWSOpenIngressSecurityGroupInlineRuleExplanation = `
-
-`
-const AWSOpenIngressSecurityGroupInlineRuleBadExample = `
-
-`
-const AWSOpenIngressSecurityGroupInlineRuleGoodExample = `
-
-`
-
-// AWSOpenEgressSecurityGroupInlineRule See https://github.com/tfsec/tfsec#included-checks for check info
-const AWSOpenEgressSecurityGroupInlineRule scanner.RuleID = "AWS009"
-const AWSOpenEgressSecurityGroupInlineRuleDescription scanner.RuleSummary = "An inline egress security group rule allows traffic to `/0`."
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSOpenIngressSecurityGroupInlineRule,
-		Documentation: scanner.CheckDocumentation{
-			Summary: AWSOpenIngressSecurityGroupInlineRuleDescription,
-            Explanation: AWSOpenIngressSecurityGroupInlineRuleExplanation,
-            BadExample:  AWSOpenIngressSecurityGroupInlineRuleBadExample,
-            GoodExample: AWSOpenIngressSecurityGroupInlineRuleGoodExample,
-            Links: []string{},
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_security_group"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-
-			var results []scanner.Result
-
-			for _, directionBlock := range block.GetBlocks("ingress") {
-				if cidrBlocksAttr := directionBlock.GetAttribute("cidr_blocks"); cidrBlocksAttr != nil {
-
-					if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
-						return nil
-					}
-
-					for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
-						if strings.HasSuffix(cidr.AsString(), "/0") {
-							results = append(results,
-								check.NewResult(
-									fmt.Sprintf("Resource '%s' defines a fully open ingress security group.", block.Name()),
-									cidrBlocksAttr.Range(),
-									scanner.SeverityWarning,
-								),
-							)
-						}
-					}
-				}
-				if cidrBlocksAttr := directionBlock.GetAttribute("ipv6_cidr_blocks"); cidrBlocksAttr != nil {
-
-					if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
-						return nil
-					}
-
-					for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
-						if strings.HasSuffix(cidr.AsString(), "/0") {
-							results = append(results,
-								check.NewResult(
-									fmt.Sprintf("Resource '%s' defines a fully open ingress security group.", block.Name()),
-									cidrBlocksAttr.Range(),
-									scanner.SeverityWarning,
-								),
-							)
-						}
-					}
-				}
-			}
-
-			return results
-		},
-	})
-
-	scanner.RegisterCheck(scanner.Check{
-		Code: AWSOpenEgressSecurityGroupInlineRule,
-		Documentation: scanner.CheckDocumentation{
-			Summary: AWSOpenEgressSecurityGroupInlineRuleDescription,
-		},
-		Provider:       scanner.AWSProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"aws_security_group"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-
-			var results []scanner.Result
-
-			for _, directionBlock := range block.GetBlocks("egress") {
-				if cidrBlocksAttr := directionBlock.GetAttribute("cidr_blocks"); cidrBlocksAttr != nil {
-
-					if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
-						return nil
-					}
-
-					for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
-						if strings.HasSuffix(cidr.AsString(), "/0") {
-							results = append(results,
-								check.NewResultWithValueAnnotation(
-									fmt.Sprintf("Resource '%s' defines a fully open egress security group.", block.Name()),
-									cidrBlocksAttr.Range(),
-									cidrBlocksAttr,
-									scanner.SeverityWarning,
-								),
-							)
-						}
-					}
-				}
-				if cidrBlocksAttr := directionBlock.GetAttribute("ipv6_cidr_blocks"); cidrBlocksAttr != nil {
-
-					if cidrBlocksAttr.Value().IsNull() || cidrBlocksAttr.Value().LengthInt() == 0 {
-						return nil
-					}
-
-					for _, cidr := range cidrBlocksAttr.Value().AsValueSlice() {
-						if strings.HasSuffix(cidr.AsString(), "/0") {
-							results = append(results,
-								check.NewResultWithValueAnnotation(
-									fmt.Sprintf("Resource '%s' defines a fully open egress security group.", block.Name()),
-									cidrBlocksAttr.Range(),
-									cidrBlocksAttr,
-									scanner.SeverityWarning,
-								),
-							)
-						}
-					}
-				}
-			}
-
-			return results
-		},
-	})
-}
diff --git a/internal/app/tfsec/checks/azurerm_open_network_security_rules.go b/internal/app/tfsec/checks/azure/azu001.go
similarity index 51%
rename from internal/app/tfsec/checks/azurerm_open_network_security_rules.go
rename to internal/app/tfsec/checks/azure/azu001.go
index e2a57f627..36e8290d7 100644
--- a/internal/app/tfsec/checks/azurerm_open_network_security_rules.go
+++ b/internal/app/tfsec/checks/azure/azu001.go
@@ -1,4 +1,4 @@
-package checks
+package azure
 
 import (
 	"fmt"
@@ -98,91 +98,3 @@ func init() {
 		},
 	})
 }
-
-
-const AzureOpenOutboundNetworkSecurityGroupRule scanner.RuleID = "AZU002"
-const AzureOpenOutboundNetworkSecurityGroupRuleDescription scanner.RuleSummary = "An outbound network security rule allows traffic to `/0`."
-const AzureOpenOutboundNetworkSecurityGroupRuleExplanation = `
-Network security rules should not use very broad subnets.
-
-Where possible, segements should be broken into smaller subnets.
-`
-const AzureOpenOutboundNetworkSecurityGroupRuleBadExample = `
-resource "azurerm_network_security_rule" "my-rule" {
-	direction = "Outbound"
-	source_address_prefix = "0.0.0.0/0"
-	access = "Allow"
-}`
-const AzureOpenOutboundNetworkSecurityGroupRuleGoodExample = `
-resource "azurerm_network_security_rule" "my-rule" {
-	direction = "Outbound"
-	destination_address_prefix = "10.0.0.0/16"
-	access = "Allow"
-}`
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: AzureOpenOutboundNetworkSecurityGroupRule,
-		Documentation: scanner.CheckDocumentation{
-			Summary:     AzureOpenOutboundNetworkSecurityGroupRuleDescription,
-			Explanation: AzureOpenOutboundNetworkSecurityGroupRuleExplanation,
-			BadExample:  AzureOpenOutboundNetworkSecurityGroupRuleBadExample,
-			GoodExample: AzureOpenOutboundNetworkSecurityGroupRuleGoodExample,
-			Links: []string{
-				"https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices",
-				"https://www.terraform.io/docs/providers/azurerm/r/network_security_rule.html",
-			},
-		},
-		Provider:       scanner.AzureProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"azurerm_network_security_rule"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-
-			directionAttr := block.GetAttribute("direction")
-			if directionAttr == nil || directionAttr.Type() != cty.String || directionAttr.Value().AsString() != "Outbound" {
-				return nil
-			}
-
-			if prefixAttr := block.GetAttribute("destination_address_prefix"); prefixAttr != nil && prefixAttr.Type() == cty.String {
-				if strings.HasSuffix(prefixAttr.Value().AsString(), "/0") || prefixAttr.Value().AsString() == "*" {
-					if accessAttr := block.GetAttribute("access"); accessAttr != nil && accessAttr.Value().AsString() == "Allow" {
-						return []scanner.Result{
-							check.NewResultWithValueAnnotation(
-								fmt.Sprintf(
-									"Resource '%s' defines a fully open %s network security group rule.",
-									block.Name(),
-									strings.ToLower(directionAttr.Value().AsString()),
-								),
-								prefixAttr.Range(),
-								prefixAttr,
-								scanner.SeverityWarning,
-							),
-						}
-					}
-				}
-			}
-
-			var results []scanner.Result
-
-			if prefixesAttr := block.GetAttribute("destination_address_prefixes"); prefixesAttr != nil && prefixesAttr.Value().LengthInt() > 0 {
-				for _, prefix := range prefixesAttr.Value().AsValueSlice() {
-					if strings.HasSuffix(prefix.AsString(), "/0") || prefix.AsString() == "*" {
-						if accessAttr := block.GetAttribute("access"); accessAttr != nil && accessAttr.Value().AsString() == "Allow" {
-							results = append(results,
-								check.NewResultWithValueAnnotation(
-									fmt.Sprintf("Resource '%s' defines a fully open %s security group rule.", block.Name(), prefix.AsString()),
-									prefixesAttr.Range(),
-									prefixesAttr,
-									scanner.SeverityWarning,
-								),
-							)
-						}
-					}
-				}
-
-			}
-
-			return results
-		},
-	})
-}
diff --git a/internal/app/tfsec/checks/azure/azu002.go b/internal/app/tfsec/checks/azure/azu002.go
new file mode 100644
index 000000000..c344f38a7
--- /dev/null
+++ b/internal/app/tfsec/checks/azure/azu002.go
@@ -0,0 +1,97 @@
+package azure
+
+import (
+	"fmt"
+	"github.com/zclconf/go-cty/cty"
+	"strings"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+const AzureOpenOutboundNetworkSecurityGroupRule scanner.RuleID = "AZU002"
+const AzureOpenOutboundNetworkSecurityGroupRuleDescription scanner.RuleSummary = "An outbound network security rule allows traffic to `/0`."
+const AzureOpenOutboundNetworkSecurityGroupRuleExplanation = `
+Network security rules should not use very broad subnets.
+
+Where possible, segements should be broken into smaller subnets.
+`
+const AzureOpenOutboundNetworkSecurityGroupRuleBadExample = `
+resource "azurerm_network_security_rule" "my-rule" {
+	direction = "Outbound"
+	source_address_prefix = "0.0.0.0/0"
+	access = "Allow"
+}`
+const AzureOpenOutboundNetworkSecurityGroupRuleGoodExample = `
+resource "azurerm_network_security_rule" "my-rule" {
+	direction = "Outbound"
+	destination_address_prefix = "10.0.0.0/16"
+	access = "Allow"
+}`
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AzureOpenOutboundNetworkSecurityGroupRule,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AzureOpenOutboundNetworkSecurityGroupRuleDescription,
+			Explanation: AzureOpenOutboundNetworkSecurityGroupRuleExplanation,
+			BadExample:  AzureOpenOutboundNetworkSecurityGroupRuleBadExample,
+			GoodExample: AzureOpenOutboundNetworkSecurityGroupRuleGoodExample,
+			Links: []string{
+				"https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices",
+				"https://www.terraform.io/docs/providers/azurerm/r/network_security_rule.html",
+			},
+		},
+		Provider:       scanner.AzureProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"azurerm_network_security_rule"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			directionAttr := block.GetAttribute("direction")
+			if directionAttr == nil || directionAttr.Type() != cty.String || directionAttr.Value().AsString() != "Outbound" {
+				return nil
+			}
+
+			if prefixAttr := block.GetAttribute("destination_address_prefix"); prefixAttr != nil && prefixAttr.Type() == cty.String {
+				if strings.HasSuffix(prefixAttr.Value().AsString(), "/0") || prefixAttr.Value().AsString() == "*" {
+					if accessAttr := block.GetAttribute("access"); accessAttr != nil && accessAttr.Value().AsString() == "Allow" {
+						return []scanner.Result{
+							check.NewResultWithValueAnnotation(
+								fmt.Sprintf(
+									"Resource '%s' defines a fully open %s network security group rule.",
+									block.Name(),
+									strings.ToLower(directionAttr.Value().AsString()),
+								),
+								prefixAttr.Range(),
+								prefixAttr,
+								scanner.SeverityWarning,
+							),
+						}
+					}
+				}
+			}
+
+			var results []scanner.Result
+
+			if prefixesAttr := block.GetAttribute("destination_address_prefixes"); prefixesAttr != nil && prefixesAttr.Value().LengthInt() > 0 {
+				for _, prefix := range prefixesAttr.Value().AsValueSlice() {
+					if strings.HasSuffix(prefix.AsString(), "/0") || prefix.AsString() == "*" {
+						if accessAttr := block.GetAttribute("access"); accessAttr != nil && accessAttr.Value().AsString() == "Allow" {
+							results = append(results,
+								check.NewResultWithValueAnnotation(
+									fmt.Sprintf("Resource '%s' defines a fully open %s security group rule.", block.Name(), prefix.AsString()),
+									prefixesAttr.Range(),
+									prefixesAttr,
+									scanner.SeverityWarning,
+								),
+							)
+						}
+					}
+				}
+
+			}
+
+			return results
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/azurerm_unencrypted_managed_disk.go b/internal/app/tfsec/checks/azure/azu003.go
similarity index 85%
rename from internal/app/tfsec/checks/azurerm_unencrypted_managed_disk.go
rename to internal/app/tfsec/checks/azure/azu003.go
index 5a688b12b..39169f09f 100644
--- a/internal/app/tfsec/checks/azurerm_unencrypted_managed_disk.go
+++ b/internal/app/tfsec/checks/azure/azu003.go
@@ -1,4 +1,4 @@
-package checks
+package azure
 
 import (
 	"fmt"
@@ -16,7 +16,7 @@ const AzureUnencryptedManagedDiskDescription scanner.RuleSummary = "Unencrypted
 const AzureUnencryptedManagedDiskExplanation = `
 Manage disks should be encrypted at rest
 `
-const AzureUnencryptedManagedDiskBadExample =  `
+const AzureUnencryptedManagedDiskBadExample = `
 resource "azurerm_managed_disk" "my-disk" {
 	encryption_settings {
 		enabled = false
@@ -33,11 +33,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AzureUnencryptedManagedDisk,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AzureUnencryptedManagedDiskDescription,
-            Explanation: AzureUnencryptedManagedDiskExplanation,
-            BadExample:  AzureUnencryptedManagedDiskBadExample,
-            GoodExample: AzureUnencryptedManagedDiskGoodExample,
-            Links: []string{
+			Summary:     AzureUnencryptedManagedDiskDescription,
+			Explanation: AzureUnencryptedManagedDiskExplanation,
+			BadExample:  AzureUnencryptedManagedDiskBadExample,
+			GoodExample: AzureUnencryptedManagedDiskGoodExample,
+			Links: []string{
 				"https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption",
 				"https://www.terraform.io/docs/providers/azurerm/r/managed_disk.html",
 			},
diff --git a/internal/app/tfsec/checks/azurerm_unencrypted_data_lake_store.go b/internal/app/tfsec/checks/azure/azu004.go
similarity index 86%
rename from internal/app/tfsec/checks/azurerm_unencrypted_data_lake_store.go
rename to internal/app/tfsec/checks/azure/azu004.go
index c4ec35ba7..849750538 100644
--- a/internal/app/tfsec/checks/azurerm_unencrypted_data_lake_store.go
+++ b/internal/app/tfsec/checks/azure/azu004.go
@@ -1,12 +1,13 @@
-package checks
+package azure
 
 import (
 	"fmt"
 
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
 // AzureUnencryptedDataLakeStore See https://github.com/tfsec/tfsec#included-checks for check info
@@ -28,11 +29,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AzureUnencryptedDataLakeStore,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AzureUnencryptedDataLakeStoreDescription,
-            Explanation: AzureUnencryptedDataLakeStoreExplanation,
-            BadExample:  AzureUnencryptedDataLakeStoreBadExample,
-            GoodExample: AzureUnencryptedDataLakeStoreGoodExample,
-            Links: []string{
+			Summary:     AzureUnencryptedDataLakeStoreDescription,
+			Explanation: AzureUnencryptedDataLakeStoreExplanation,
+			BadExample:  AzureUnencryptedDataLakeStoreBadExample,
+			GoodExample: AzureUnencryptedDataLakeStoreGoodExample,
+			Links: []string{
 				"https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-security-overview",
 				"https://www.terraform.io/docs/providers/azurerm/r/data_lake_store.html",
 			},
diff --git a/internal/app/tfsec/checks/azurerm_virtual_machine_with_password_authentication.go b/internal/app/tfsec/checks/azure/azu005.go
similarity index 87%
rename from internal/app/tfsec/checks/azurerm_virtual_machine_with_password_authentication.go
rename to internal/app/tfsec/checks/azure/azu005.go
index b1d023241..62afa8a59 100644
--- a/internal/app/tfsec/checks/azurerm_virtual_machine_with_password_authentication.go
+++ b/internal/app/tfsec/checks/azure/azu005.go
@@ -1,4 +1,4 @@
-package checks
+package azure
 
 import (
 	"fmt"
@@ -33,11 +33,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: AzureVMWithPasswordAuthentication,
 		Documentation: scanner.CheckDocumentation{
-			Summary: AzureVMWithPasswordAuthenticationDescription,
-            Explanation: AzureVMWithPasswordAuthenticationExplanation,
-            BadExample:  AzureVMWithPasswordAuthenticationBadExample,
-            GoodExample: AzureVMWithPasswordAuthenticationGoodExample,
-            Links: []string{
+			Summary:     AzureVMWithPasswordAuthenticationDescription,
+			Explanation: AzureVMWithPasswordAuthenticationExplanation,
+			BadExample:  AzureVMWithPasswordAuthenticationBadExample,
+			GoodExample: AzureVMWithPasswordAuthenticationGoodExample,
+			Links: []string{
 				"https://docs.microsoft.com/en-us/azure/virtual-machines/linux/create-ssh-keys-detailed",
 				"https://www.terraform.io/docs/providers/azurerm/r/virtual_machine.html",
 			},
diff --git a/internal/app/tfsec/checks/generic_sensitive_variables.go b/internal/app/tfsec/checks/general/gen001.go
similarity index 99%
rename from internal/app/tfsec/checks/generic_sensitive_variables.go
rename to internal/app/tfsec/checks/general/gen001.go
index 0df270138..19866b702 100644
--- a/internal/app/tfsec/checks/generic_sensitive_variables.go
+++ b/internal/app/tfsec/checks/general/gen001.go
@@ -1,4 +1,4 @@
-package checks
+package general
 
 import (
 	"fmt"
@@ -7,8 +7,9 @@ import (
 
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
 // GenericSensitiveVariables See https://github.com/tfsec/tfsec#included-checks for check info
diff --git a/internal/app/tfsec/checks/generic_sensitive_locals.go b/internal/app/tfsec/checks/general/gen002.go
similarity index 99%
rename from internal/app/tfsec/checks/generic_sensitive_locals.go
rename to internal/app/tfsec/checks/general/gen002.go
index 7e12b63ef..adaaacada 100644
--- a/internal/app/tfsec/checks/generic_sensitive_locals.go
+++ b/internal/app/tfsec/checks/general/gen002.go
@@ -1,4 +1,4 @@
-package checks
+package general
 
 import (
 	"fmt"
@@ -7,8 +7,9 @@ import (
 
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
 // GenericSensitiveLocals See https://github.com/tfsec/tfsec#included-checks for check info
diff --git a/internal/app/tfsec/checks/generic_sensitive_attributes.go b/internal/app/tfsec/checks/general/gen003.go
similarity index 99%
rename from internal/app/tfsec/checks/generic_sensitive_attributes.go
rename to internal/app/tfsec/checks/general/gen003.go
index fcf35e99e..3df57727b 100644
--- a/internal/app/tfsec/checks/generic_sensitive_attributes.go
+++ b/internal/app/tfsec/checks/general/gen003.go
@@ -1,4 +1,4 @@
-package checks
+package general
 
 import (
 	"fmt"
@@ -7,8 +7,9 @@ import (
 
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/zclconf/go-cty/cty"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 )
 
 // GenericSensitiveAttributes See https://github.com/tfsec/tfsec#included-checks for check info
diff --git a/internal/app/tfsec/checks/google_unencrypted_disk.go b/internal/app/tfsec/checks/google/gcp001.go
similarity index 84%
rename from internal/app/tfsec/checks/google_unencrypted_disk.go
rename to internal/app/tfsec/checks/google/gcp001.go
index 86d6e6a4b..5a8e86f17 100644
--- a/internal/app/tfsec/checks/google_unencrypted_disk.go
+++ b/internal/app/tfsec/checks/google/gcp001.go
@@ -1,4 +1,4 @@
-package checks
+package google
 
 import (
 	"fmt"
@@ -24,11 +24,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GoogleUnencryptedDisk,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GoogleUnencryptedDiskDescription,
-            Explanation: GoogleUnencryptedDiskExplanation,
-            BadExample:  GoogleUnencryptedDiskBadExample,
-            GoodExample: GoogleUnencryptedDiskGoodExample,
-            Links: []string{},
+			Summary:     GoogleUnencryptedDiskDescription,
+			Explanation: GoogleUnencryptedDiskExplanation,
+			BadExample:  GoogleUnencryptedDiskBadExample,
+			GoodExample: GoogleUnencryptedDiskGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.GCPProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/google_unencrypted_storage_bucket.go b/internal/app/tfsec/checks/google/gcp002.go
similarity index 80%
rename from internal/app/tfsec/checks/google_unencrypted_storage_bucket.go
rename to internal/app/tfsec/checks/google/gcp002.go
index f280c4f6f..39809f6ae 100644
--- a/internal/app/tfsec/checks/google_unencrypted_storage_bucket.go
+++ b/internal/app/tfsec/checks/google/gcp002.go
@@ -1,4 +1,4 @@
-package checks
+package google
 
 import (
 	"fmt"
@@ -24,11 +24,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GoogleUnencryptedStorageBucket,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GoogleUnencryptedStorageBucketDescription,
-            Explanation: GoogleUnencryptedStorageBucketExplanation,
-            BadExample:  GoogleUnencryptedStorageBucketBadExample,
-            GoodExample: GoogleUnencryptedStorageBucketGoodExample,
-            Links: []string{},
+			Summary:     GoogleUnencryptedStorageBucketDescription,
+			Explanation: GoogleUnencryptedStorageBucketExplanation,
+			BadExample:  GoogleUnencryptedStorageBucketBadExample,
+			GoodExample: GoogleUnencryptedStorageBucketGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.GCPProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/google/gcp003.go b/internal/app/tfsec/checks/google/gcp003.go
new file mode 100644
index 000000000..370178210
--- /dev/null
+++ b/internal/app/tfsec/checks/google/gcp003.go
@@ -0,0 +1,64 @@
+package google
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+)
+
+// GoogleOpenInboundFirewallRule See https://github.com/tfsec/tfsec#included-checks for check info
+const GoogleOpenInboundFirewallRule scanner.RuleID = "GCP003"
+const GoogleOpenInboundFirewallRuleDescription scanner.RuleSummary = "An inbound firewall rule allows traffic from `/0`."
+const GoogleOpenInboundFirewallRuleExplanation = `
+
+`
+const GoogleOpenInboundFirewallRuleBadExample = `
+
+`
+const GoogleOpenInboundFirewallRuleGoodExample = `
+
+`
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: GoogleOpenInboundFirewallRule,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     GoogleOpenInboundFirewallRuleDescription,
+			Explanation: GoogleOpenInboundFirewallRuleExplanation,
+			BadExample:  GoogleOpenInboundFirewallRuleBadExample,
+			GoodExample: GoogleOpenInboundFirewallRuleGoodExample,
+			Links:       []string{},
+		},
+		Provider:       scanner.GCPProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"google_compute_firewall"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			if sourceRanges := block.GetAttribute("source_ranges"); sourceRanges != nil {
+
+				if sourceRanges.Value().LengthInt() == 0 {
+					return nil
+				}
+
+				for _, cidr := range sourceRanges.Value().AsValueSlice() {
+					if strings.HasSuffix(cidr.AsString(), "/0") {
+						return []scanner.Result{
+							check.NewResult(
+								fmt.Sprintf("Resource '%s' defines a fully open inbound firewall rule.", block.Name()),
+								sourceRanges.Range(),
+								scanner.SeverityWarning,
+							),
+						}
+					}
+				}
+
+			}
+
+			return nil
+		},
+	})
+
+}
diff --git a/internal/app/tfsec/checks/google/gcp004.go b/internal/app/tfsec/checks/google/gcp004.go
new file mode 100644
index 000000000..0836c55ca
--- /dev/null
+++ b/internal/app/tfsec/checks/google/gcp004.go
@@ -0,0 +1,49 @@
+package google
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+// GoogleOpenOutboundFirewallRule See https://github.com/tfsec/tfsec#included-checks for check info
+const GoogleOpenOutboundFirewallRule scanner.RuleID = "GCP004"
+const GoogleOpenOutboundFirewallRuleDescription scanner.RuleSummary = "An outbound firewall rule allows traffic to `/0`."
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: GoogleOpenOutboundFirewallRule,
+		Documentation: scanner.CheckDocumentation{
+			Summary: GoogleOpenOutboundFirewallRuleDescription,
+		},
+		Provider:       scanner.GCPProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"google_compute_firewall"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			if destinationRanges := block.GetAttribute("destination_ranges"); destinationRanges != nil {
+
+				if destinationRanges.Value().LengthInt() == 0 {
+					return nil
+				}
+
+				for _, cidr := range destinationRanges.Value().AsValueSlice() {
+					if strings.HasSuffix(cidr.AsString(), "/0") {
+						return []scanner.Result{
+							check.NewResult(
+								fmt.Sprintf("Resource '%s' defines a fully open outbound firewall rule.", block.Name()),
+								destinationRanges.Range(),
+								scanner.SeverityWarning,
+							),
+						}
+					}
+				}
+
+			}
+
+			return nil
+		},
+	})
+}
diff --git a/internal/app/tfsec/checks/gke_abac_enabled.go b/internal/app/tfsec/checks/google/gcp005.go
similarity index 84%
rename from internal/app/tfsec/checks/gke_abac_enabled.go
rename to internal/app/tfsec/checks/google/gcp005.go
index d9e10e87d..adc7f3122 100644
--- a/internal/app/tfsec/checks/gke_abac_enabled.go
+++ b/internal/app/tfsec/checks/google/gcp005.go
@@ -1,4 +1,4 @@
-package checks
+package google
 
 import (
 	"fmt"
@@ -24,11 +24,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GkeAbacEnabled,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GkeAbacEnabledDescription,
-            Explanation: GkeAbacEnabledExplanation,
-            BadExample:  GkeAbacEnabledBadExample,
-            GoodExample: GkeAbacEnabledGoodExample,
-            Links: []string{},
+			Summary:     GkeAbacEnabledDescription,
+			Explanation: GkeAbacEnabledExplanation,
+			BadExample:  GkeAbacEnabledBadExample,
+			GoodExample: GkeAbacEnabledGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.GCPProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/gke_node_metadata_exposed.go b/internal/app/tfsec/checks/google/gcp006.go
similarity index 85%
rename from internal/app/tfsec/checks/gke_node_metadata_exposed.go
rename to internal/app/tfsec/checks/google/gcp006.go
index 2f8eaa6ba..3d2c346e1 100644
--- a/internal/app/tfsec/checks/gke_node_metadata_exposed.go
+++ b/internal/app/tfsec/checks/google/gcp006.go
@@ -1,4 +1,4 @@
-package checks
+package google
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GkeNodeMetadataExposed,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GkeNodeMetadataExposedDescription,
-            Explanation: GkeNodeMetadataExposedExplanation,
-            BadExample:  GkeNodeMetadataExposedBadExample,
-            GoodExample: GkeNodeMetadataExposedGoodExample,
-            Links: []string{},
+			Summary:     GkeNodeMetadataExposedDescription,
+			Explanation: GkeNodeMetadataExposedExplanation,
+			BadExample:  GkeNodeMetadataExposedBadExample,
+			GoodExample: GkeNodeMetadataExposedGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.GCPProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/gke_legacy_metadata_endpoints.go b/internal/app/tfsec/checks/google/gcp007.go
similarity index 84%
rename from internal/app/tfsec/checks/gke_legacy_metadata_endpoints.go
rename to internal/app/tfsec/checks/google/gcp007.go
index 9643de8b6..299c66f1b 100644
--- a/internal/app/tfsec/checks/gke_legacy_metadata_endpoints.go
+++ b/internal/app/tfsec/checks/google/gcp007.go
@@ -1,4 +1,4 @@
-package checks
+package google
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GkeLegacyMetadataEndpoints,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GkeLegacyMetadataEndpointsDescription,
-            Explanation: GkeLegacyMetadataEndpointsExplanation,
-            BadExample:  GkeLegacyMetadataEndpointsBadExample,
-            GoodExample: GkeLegacyMetadataEndpointsGoodExample,
-            Links: []string{},
+			Summary:     GkeLegacyMetadataEndpointsDescription,
+			Explanation: GkeLegacyMetadataEndpointsExplanation,
+			BadExample:  GkeLegacyMetadataEndpointsBadExample,
+			GoodExample: GkeLegacyMetadataEndpointsGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.GCPProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/gke_legacy_auth_enabled.go b/internal/app/tfsec/checks/google/gcp008.go
similarity index 91%
rename from internal/app/tfsec/checks/gke_legacy_auth_enabled.go
rename to internal/app/tfsec/checks/google/gcp008.go
index 780dd9c96..447073c1a 100644
--- a/internal/app/tfsec/checks/gke_legacy_auth_enabled.go
+++ b/internal/app/tfsec/checks/google/gcp008.go
@@ -1,4 +1,4 @@
-package checks
+package google
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GkeLegacyAuthEnabled,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GkeLegacyAuthEnabledDescription,
-            Explanation: GkeLegacyAuthEnabledExplanation,
-            BadExample:  GkeLegacyAuthEnabledBadExample,
-            GoodExample: GkeLegacyAuthEnabledGoodExample,
-            Links: []string{},
+			Summary:     GkeLegacyAuthEnabledDescription,
+			Explanation: GkeLegacyAuthEnabledExplanation,
+			BadExample:  GkeLegacyAuthEnabledBadExample,
+			GoodExample: GkeLegacyAuthEnabledGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.GCPProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/gke_enforce_psp.go b/internal/app/tfsec/checks/google/gcp009.go
similarity index 89%
rename from internal/app/tfsec/checks/gke_enforce_psp.go
rename to internal/app/tfsec/checks/google/gcp009.go
index 8fdd0eb51..38a644744 100644
--- a/internal/app/tfsec/checks/gke_enforce_psp.go
+++ b/internal/app/tfsec/checks/google/gcp009.go
@@ -1,11 +1,12 @@
-package checks
+package google
 
 import (
 	"fmt"
 
+	"github.com/zclconf/go-cty/cty"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-	"github.com/zclconf/go-cty/cty"
 )
 
 // GkeEnforcePSP See https://github.com/tfsec/tfsec#included-checks for check info
@@ -25,11 +26,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GkeEnforcePSP,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GkeEnforcePSPDescription,
-            Explanation: GkeEnforcePSPExplanation,
-            BadExample:  GkeEnforcePSPBadExample,
-            GoodExample: GkeEnforcePSPGoodExample,
-            Links: []string{},
+			Summary:     GkeEnforcePSPDescription,
+			Explanation: GkeEnforcePSPExplanation,
+			BadExample:  GkeEnforcePSPBadExample,
+			GoodExample: GkeEnforcePSPGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.GCPProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/gke_shielded_nodes_disabled.go b/internal/app/tfsec/checks/google/gcp010.go
similarity index 88%
rename from internal/app/tfsec/checks/gke_shielded_nodes_disabled.go
rename to internal/app/tfsec/checks/google/gcp010.go
index c43a5ab6d..c4823554a 100644
--- a/internal/app/tfsec/checks/gke_shielded_nodes_disabled.go
+++ b/internal/app/tfsec/checks/google/gcp010.go
@@ -1,4 +1,4 @@
-package checks
+package google
 
 import (
 	"fmt"
@@ -27,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GkeShieldedNodesDisabled,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GkeShieldedNodesDisabledDescription,
-            Explanation: GkeShieldedNodesDisabledExplanation,
-            BadExample:  GkeShieldedNodesDisabledBadExample,
-            GoodExample: GkeShieldedNodesDisabledGoodExample,
-            Links: []string{},
+			Summary:     GkeShieldedNodesDisabledDescription,
+			Explanation: GkeShieldedNodesDisabledExplanation,
+			BadExample:  GkeShieldedNodesDisabledBadExample,
+			GoodExample: GkeShieldedNodesDisabledGoodExample,
+			Links:       []string{},
 		},
 		Provider:       scanner.GCPProvider,
 		RequiredTypes:  []string{"resource"},
diff --git a/internal/app/tfsec/checks/google_user_iam_grant.go b/internal/app/tfsec/checks/google/gcp011.go
similarity index 91%
rename from internal/app/tfsec/checks/google_user_iam_grant.go
rename to internal/app/tfsec/checks/google/gcp011.go
index 7fdca32ed..c542cc931 100644
--- a/internal/app/tfsec/checks/google_user_iam_grant.go
+++ b/internal/app/tfsec/checks/google/gcp011.go
@@ -1,12 +1,13 @@
-package checks
+package google
 
 import (
 	"fmt"
 	"strings"
 
+	"github.com/zclconf/go-cty/cty"
+
 	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-	"github.com/zclconf/go-cty/cty"
 )
 
 // GoogleUserIAMGrant See https://github.com/tfsec/tfsec#included-checks for check info
@@ -26,11 +27,11 @@ func init() {
 	scanner.RegisterCheck(scanner.Check{
 		Code: GoogleUserIAMGrant,
 		Documentation: scanner.CheckDocumentation{
-			Summary: GoogleUserIAMGrantDescription,
-            Explanation: GoogleUserIAMGrantExplanation,
-            BadExample:  GoogleUserIAMGrantBadExample,
-            GoodExample: GoogleUserIAMGrantGoodExample,
-            Links: []string{},
+			Summary:     GoogleUserIAMGrantDescription,
+			Explanation: GoogleUserIAMGrantExplanation,
+			BadExample:  GoogleUserIAMGrantBadExample,
+			GoodExample: GoogleUserIAMGrantGoodExample,
+			Links:       []string{},
 		},
 		Provider:      scanner.GCPProvider,
 		RequiredTypes: []string{"resource", "data"},
diff --git a/internal/app/tfsec/checks/google_open_firewall_rules.go b/internal/app/tfsec/checks/google_open_firewall_rules.go
deleted file mode 100644
index 3cf49376c..000000000
--- a/internal/app/tfsec/checks/google_open_firewall_rules.go
+++ /dev/null
@@ -1,101 +0,0 @@
-package checks
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
-)
-
-// GoogleOpenInboundFirewallRule See https://github.com/tfsec/tfsec#included-checks for check info
-const GoogleOpenInboundFirewallRule scanner.RuleID = "GCP003"
-const GoogleOpenInboundFirewallRuleDescription scanner.RuleSummary = "An inbound firewall rule allows traffic from `/0`."
-const GoogleOpenInboundFirewallRuleExplanation = `
-
-`
-const GoogleOpenInboundFirewallRuleBadExample = `
-
-`
-const GoogleOpenInboundFirewallRuleGoodExample = `
-
-`
-
-// GoogleOpenOutboundFirewallRule See https://github.com/tfsec/tfsec#included-checks for check info
-const GoogleOpenOutboundFirewallRule scanner.RuleID = "GCP004"
-const GoogleOpenOutboundFirewallRuleDescription scanner.RuleSummary = "An outbound firewall rule allows traffic to `/0`."
-
-func init() {
-	scanner.RegisterCheck(scanner.Check{
-		Code: GoogleOpenInboundFirewallRule,
-		Documentation: scanner.CheckDocumentation{
-			Summary: GoogleOpenInboundFirewallRuleDescription,
-            Explanation: GoogleOpenInboundFirewallRuleExplanation,
-            BadExample:  GoogleOpenInboundFirewallRuleBadExample,
-            GoodExample: GoogleOpenInboundFirewallRuleGoodExample,
-            Links: []string{},
-		},
-		Provider:       scanner.GCPProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"google_compute_firewall"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-
-			if sourceRanges := block.GetAttribute("source_ranges"); sourceRanges != nil {
-
-				if sourceRanges.Value().LengthInt() == 0 {
-					return nil
-				}
-
-				for _, cidr := range sourceRanges.Value().AsValueSlice() {
-					if strings.HasSuffix(cidr.AsString(), "/0") {
-						return []scanner.Result{
-							check.NewResult(
-								fmt.Sprintf("Resource '%s' defines a fully open inbound firewall rule.", block.Name()),
-								sourceRanges.Range(),
-								scanner.SeverityWarning,
-							),
-						}
-					}
-				}
-
-			}
-
-			return nil
-		},
-	})
-
-	scanner.RegisterCheck(scanner.Check{
-		Code: GoogleOpenOutboundFirewallRule,
-		Documentation: scanner.CheckDocumentation{
-			Summary: GoogleOpenOutboundFirewallRuleDescription,
-		},
-		Provider:       scanner.GCPProvider,
-		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"google_compute_firewall"},
-		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
-
-			if destinationRanges := block.GetAttribute("destination_ranges"); destinationRanges != nil {
-
-				if destinationRanges.Value().LengthInt() == 0 {
-					return nil
-				}
-
-				for _, cidr := range destinationRanges.Value().AsValueSlice() {
-					if strings.HasSuffix(cidr.AsString(), "/0") {
-						return []scanner.Result{
-							check.NewResult(
-								fmt.Sprintf("Resource '%s' defines a fully open outbound firewall rule.", block.Name()),
-								destinationRanges.Range(),
-								scanner.SeverityWarning,
-							),
-						}
-					}
-				}
-
-			}
-
-			return nil
-		},
-	})
-}
diff --git a/internal/app/tfsec/checks/utils.go b/internal/app/tfsec/checks/utils.go
index 7404d8410..8a9726b7a 100644
--- a/internal/app/tfsec/checks/utils.go
+++ b/internal/app/tfsec/checks/utils.go
@@ -5,9 +5,9 @@ import (
 	"github.com/zclconf/go-cty/cty"
 )
 
-// isBooleanOrStringTrue returns true if the attribute is a boolean and is
+// IsBooleanOrStringTrue returns true if the attribute is a boolean and is
 // `true` or if the attribute is a string and is `"true"`.
-func isBooleanOrStringTrue(val *parser.Attribute) bool {
+func IsBooleanOrStringTrue(val *parser.Attribute) bool {
 	switch val.Type() {
 	case cty.Bool:
 		return val.Value().True()


Test patch:
diff --git a/internal/app/tfsec/aws_acl_test.go b/internal/app/tfsec/aws_acl_test.go
index fcfa36a52..400946690 100644
--- a/internal/app/tfsec/aws_acl_test.go
+++ b/internal/app/tfsec/aws_acl_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSACL(t *testing.T) {
@@ -23,7 +22,7 @@ resource "aws_s3_bucket" "my-bucket" {
 	acl = "public-read"
 	logging {}
 }`,
-			mustIncludeResultCode: checks.AWSBadBucketACL,
+			mustIncludeResultCode: aws.AWSBadBucketACL,
 		},
 		{
 			name: "check aws_s3_bucket with acl=public-read-write",
@@ -32,7 +31,7 @@ resource "aws_s3_bucket" "my-bucket" {
 	acl = "public-read-write"
 	logging {}
 }`,
-			mustIncludeResultCode: checks.AWSBadBucketACL,
+			mustIncludeResultCode: aws.AWSBadBucketACL,
 		},
 		{
 			name: "check aws_s3_bucket with acl=website",
@@ -40,7 +39,7 @@ resource "aws_s3_bucket" "my-bucket" {
 resource "aws_s3_bucket" "my-bucket" {
 	acl = "website"
 }`,
-			mustIncludeResultCode: checks.AWSBadBucketACL,
+			mustIncludeResultCode: aws.AWSBadBucketACL,
 		},
 		{
 			name: "check aws_s3_bucket with acl=private",
@@ -48,7 +47,7 @@ resource "aws_s3_bucket" "my-bucket" {
 resource "aws_s3_bucket" "my-bucket" {
 	acl = "private"
 }`,
-			mustExcludeResultCode: checks.AWSBadBucketACL,
+			mustExcludeResultCode: aws.AWSBadBucketACL,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_api_gateway_domain_name_missing_security_policy_test.go b/internal/app/tfsec/aws_api_gateway_domain_name_missing_security_policy_test.go
index 1165907da..4a2ba734d 100644
--- a/internal/app/tfsec/aws_api_gateway_domain_name_missing_security_policy_test.go
+++ b/internal/app/tfsec/aws_api_gateway_domain_name_missing_security_policy_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSMissingSecurityPolicy(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSMissingSecurityPolicy(t *testing.T) {
 resource "aws_api_gateway_domain_name" "my-resource" {
 	security_policy = "TLS_1_0"
 }`,
-			mustIncludeResultCode: checks.AWSApiGatewayDomainNameOutdatedSecurityPolicy,
+			mustIncludeResultCode: aws.AWSApiGatewayDomainNameOutdatedSecurityPolicy,
 		},
 		{
 			name: "check aws_api_gateway_domain_name with empty security policy",
@@ -30,7 +29,7 @@ resource "aws_api_gateway_domain_name" "my-resource" {
 resource "aws_api_gateway_domain_name" "my-resource" {
 	security_policy = ""
 }`,
-			mustIncludeResultCode: checks.AWSApiGatewayDomainNameOutdatedSecurityPolicy,
+			mustIncludeResultCode: aws.AWSApiGatewayDomainNameOutdatedSecurityPolicy,
 		},
 		{
 			name: "check aws_api_gateway_domain_name without security policy",
@@ -38,7 +37,7 @@ resource "aws_api_gateway_domain_name" "my-resource" {
 resource "aws_api_gateway_domain_name" "my-resource" {
  domain=""
 }`,
-			mustIncludeResultCode: checks.AWSApiGatewayDomainNameOutdatedSecurityPolicy,
+			mustIncludeResultCode: aws.AWSApiGatewayDomainNameOutdatedSecurityPolicy,
 		},
 		{
 			name: "check aws_api_gateway_domain_name with ok policy",
@@ -46,7 +45,7 @@ resource "aws_api_gateway_domain_name" "my-resource" {
 resource "aws_api_gateway_domain_name" "my-resource" {
 	security_policy = "TLS_1_2"
 }`,
-			mustExcludeResultCode: checks.AWSApiGatewayDomainNameOutdatedSecurityPolicy,
+			mustExcludeResultCode: aws.AWSApiGatewayDomainNameOutdatedSecurityPolicy,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_bucket_logging_test.go b/internal/app/tfsec/aws_bucket_logging_test.go
index 6dc416cef..3b4076845 100644
--- a/internal/app/tfsec/aws_bucket_logging_test.go
+++ b/internal/app/tfsec/aws_bucket_logging_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSBucketLogging(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSBucketLogging(t *testing.T) {
 resource "aws_s3_bucket" "my-bucket" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSNoBucketLogging,
+			mustIncludeResultCode: aws.AWSNoBucketLogging,
 		},
 		{
 			name: "check bucket with logging enabled",
@@ -32,7 +31,7 @@ resource "aws_s3_bucket" "my-bucket" {
 		target_bucket = "target-bucket"
 	}
 }`,
-			mustExcludeResultCode: checks.AWSNoBucketLogging,
+			mustExcludeResultCode: aws.AWSNoBucketLogging,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_classic_test.go b/internal/app/tfsec/aws_classic_test.go
index aaa779ce4..8a8eb5885 100644
--- a/internal/app/tfsec/aws_classic_test.go
+++ b/internal/app/tfsec/aws_classic_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSClassicUsage(t *testing.T) {
@@ -19,22 +18,22 @@ func Test_AWSClassicUsage(t *testing.T) {
 		{
 			name:                  "check aws_db_security_group",
 			source:                `resource "aws_db_security_group" "my-group" {}`,
-			mustIncludeResultCode: checks.AWSClassicUsage,
+			mustIncludeResultCode: aws.AWSClassicUsage,
 		},
 		{
 			name:                  "check aws_redshift_security_group",
 			source:                `resource "aws_redshift_security_group" "my-group" {}`,
-			mustIncludeResultCode: checks.AWSClassicUsage,
+			mustIncludeResultCode: aws.AWSClassicUsage,
 		},
 		{
 			name:                  "check aws_elasticache_security_group",
 			source:                `resource "aws_elasticache_security_group" "my-group" {}`,
-			mustIncludeResultCode: checks.AWSClassicUsage,
+			mustIncludeResultCode: aws.AWSClassicUsage,
 		},
 		{
 			name:                  "check for false positives",
 			source:                `resource "my_resource" "my-resource" {}`,
-			mustExcludeResultCode: checks.AWSClassicUsage,
+			mustExcludeResultCode: aws.AWSClassicUsage,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_cloudfront_does_not_have_waf_test.go b/internal/app/tfsec/aws_cloudfront_does_not_have_waf_test.go
index bca7efc83..3204d74a6 100644
--- a/internal/app/tfsec/aws_cloudfront_does_not_have_waf_test.go
+++ b/internal/app/tfsec/aws_cloudfront_does_not_have_waf_test.go
@@ -3,7 +3,7 @@ package tfsec
 import (
 	"testing"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 )
 
@@ -52,7 +52,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
     target_origin_id = "groupS3"
   }
 }`,
-			mustIncludeResultCode: checks.AWSCloudFrontDoesNotHaveAWaf,
+			mustIncludeResultCode: aws.AWSCloudFrontDoesNotHaveAWaf,
 		},
 		{
 			name: "check there is a waf web_acl_id for aws_cloudfront_distribution",
@@ -83,7 +83,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 
   web_acl_id = "waf_id"
 }`,
-			mustExcludeResultCode: checks.AWSCloudFrontDoesNotHaveAWaf,
+			mustExcludeResultCode: aws.AWSCloudFrontDoesNotHaveAWaf,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_cloudfront_outdated_protocol_test.go b/internal/app/tfsec/aws_cloudfront_outdated_protocol_test.go
index 9a4cd9795..9c750219e 100644
--- a/internal/app/tfsec/aws_cloudfront_outdated_protocol_test.go
+++ b/internal/app/tfsec/aws_cloudfront_outdated_protocol_test.go
@@ -3,7 +3,7 @@ package tfsec
 import (
 	"testing"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 )
 
@@ -20,7 +20,7 @@ func Test_AWSCloudFrontOutdatedProtocol(t *testing.T) {
 resource "aws_cloudfront_distribution" "s3_distribution" {
 
 }`,
-			mustIncludeResultCode: checks.AWSCloudFrontOutdatedProtocol,
+			mustIncludeResultCode: aws.AWSCloudFrontOutdatedProtocol,
 		},
 		{
 			name: "check no default minimum_protocol_version attribute in viewer_certificate block",
@@ -30,7 +30,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
     cloudfront_default_certificate = true
   }
 }`,
-			mustIncludeResultCode: checks.AWSCloudFrontOutdatedProtocol,
+			mustIncludeResultCode: aws.AWSCloudFrontOutdatedProtocol,
 		},
 		{
 			name: "check TLSv1.2_2019 not used",
@@ -41,7 +41,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 	minimum_protocol_version = "TLSv1.2_2018"
   }
 }`,
-			mustIncludeResultCode: checks.AWSCloudFrontOutdatedProtocol,
+			mustIncludeResultCode: aws.AWSCloudFrontOutdatedProtocol,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_http_test.go b/internal/app/tfsec/aws_http_test.go
index d0e68be34..2c96c0056 100644
--- a/internal/app/tfsec/aws_http_test.go
+++ b/internal/app/tfsec/aws_http_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSPlainHTTP(t *testing.T) {
@@ -22,14 +21,14 @@ func Test_AWSPlainHTTP(t *testing.T) {
 resource "aws_alb_listener" "my-listener" {
 	protocol = "HTTP"
 }`,
-			mustIncludeResultCode: checks.AWSPlainHTTP,
+			mustIncludeResultCode: aws.AWSPlainHTTP,
 		},
 		{
 			name: "check aws_alb_listener using plain HTTP (via non specification)",
 			source: `
 resource "aws_alb_listener" "my-listener" {
 }`,
-			mustIncludeResultCode: checks.AWSPlainHTTP,
+			mustIncludeResultCode: aws.AWSPlainHTTP,
 		},
 		{
 			name: "check aws_alb_listener using HTTPS",
@@ -37,7 +36,7 @@ resource "aws_alb_listener" "my-listener" {
 resource "aws_alb_listener" "my-listener" {
 	protocol = "HTTPS"
 }`,
-			mustExcludeResultCode: checks.AWSPlainHTTP,
+			mustExcludeResultCode: aws.AWSPlainHTTP,
 		},
 		{
 			name: "check aws_alb_listener using HTTP as redirect to HTTPS",
@@ -54,7 +53,7 @@ resource "aws_alb_listener" "my-listener" {
 		}
 	}
 }`,
-			mustExcludeResultCode: checks.AWSPlainHTTP,
+			mustExcludeResultCode: aws.AWSPlainHTTP,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_iam_password_policy_checks_test.go b/internal/app/tfsec/aws_iam_password_policy_checks_test.go
index 3989e4b8d..e1c75a571 100644
--- a/internal/app/tfsec/aws_iam_password_policy_checks_test.go
+++ b/internal/app/tfsec/aws_iam_password_policy_checks_test.go
@@ -3,7 +3,7 @@ package tfsec
 import (
 	"testing"
 
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 )
@@ -27,7 +27,7 @@ resource "aws_iam_account_password_policy" "strict" {
   require_symbols                = true
   allow_users_to_change_password = true
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordReusePrevention,
+			mustIncludeResultCode: aws.AWSIAMPasswordReusePrevention,
 		},
 		{
 			name: "check aws_iam_account_password_policy has password_reuse_prevention less than 5",
@@ -41,7 +41,7 @@ resource "aws_iam_account_password_policy" "strict" {
   allow_users_to_change_password = true
   password_reuse_prevention      = 4
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordReusePrevention,
+			mustIncludeResultCode: aws.AWSIAMPasswordReusePrevention,
 		},
 		{
 			name: "check aws_iam_account_password_policy has password_reuse_prevention greater than 5",
@@ -55,7 +55,7 @@ resource "aws_iam_account_password_policy" "strict" {
   allow_users_to_change_password = true
   password_reuse_prevention      = 5
 }`,
-			mustExcludeResultCode: checks.AWSIAMPasswordReusePrevention,
+			mustExcludeResultCode: aws.AWSIAMPasswordReusePrevention,
 		},
 	}
 
@@ -85,7 +85,7 @@ resource "aws_iam_account_password_policy" "strict" {
   require_symbols                = true
   allow_users_to_change_password = true
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordMinimumLength,
+			mustIncludeResultCode: aws.AWSIAMPasswordMinimumLength,
 		},
 		{
 			name: "check aws_iam_account_password_policy has minimum_password_length less than 14",
@@ -99,7 +99,7 @@ resource "aws_iam_account_password_policy" "strict" {
   allow_users_to_change_password = true
   password_reuse_prevention      = 4
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordMinimumLength,
+			mustIncludeResultCode: aws.AWSIAMPasswordMinimumLength,
 		},
 		{
 			name: "check aws_iam_account_password_policy has minimum_password_length greater than 14",
@@ -112,7 +112,7 @@ resource "aws_iam_account_password_policy" "strict" {
   require_symbols                = true
   allow_users_to_change_password = true
 }`,
-			mustExcludeResultCode: checks.AWSIAMPasswordMinimumLength,
+			mustExcludeResultCode: aws.AWSIAMPasswordMinimumLength,
 		},
 	}
 
@@ -137,7 +137,7 @@ func Test_AWSIamPasswordRequiresSymbol(t *testing.T) {
 			source: `
 resource "aws_iam_account_password_policy" "strict" {
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordRequiresSymbol,
+			mustIncludeResultCode: aws.AWSIAMPasswordRequiresSymbol,
 		},
 		{
 			name: "check aws_iam_account_password_policy require_symbols is set but not true",
@@ -145,7 +145,7 @@ resource "aws_iam_account_password_policy" "strict" {
 resource "aws_iam_account_password_policy" "strict" {
   require_symbols                = false
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordRequiresSymbol,
+			mustIncludeResultCode: aws.AWSIAMPasswordRequiresSymbol,
 		},
 		{
 			name: "check aws_iam_account_password_policy require_symbols is set to true",
@@ -153,7 +153,7 @@ resource "aws_iam_account_password_policy" "strict" {
 resource "aws_iam_account_password_policy" "strict" {
   require_symbols                = true
 }`,
-			mustExcludeResultCode: checks.AWSIAMPasswordRequiresSymbol,
+			mustExcludeResultCode: aws.AWSIAMPasswordRequiresSymbol,
 		},
 	}
 
@@ -178,7 +178,7 @@ func Test_AWSIamPasswordRequiresNumber(t *testing.T) {
 			source: `
 resource "aws_iam_account_password_policy" "strict" {
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordRequiresNumber,
+			mustIncludeResultCode: aws.AWSIAMPasswordRequiresNumber,
 		},
 		{
 			name: "check aws_iam_account_password_policy require_numbers is set but not true",
@@ -186,7 +186,7 @@ resource "aws_iam_account_password_policy" "strict" {
 resource "aws_iam_account_password_policy" "strict" {
   require_numbers                = false
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordRequiresNumber,
+			mustIncludeResultCode: aws.AWSIAMPasswordRequiresNumber,
 		},
 		{
 			name: "check aws_iam_account_password_policy require_numbers is set to true",
@@ -194,7 +194,7 @@ resource "aws_iam_account_password_policy" "strict" {
 resource "aws_iam_account_password_policy" "strict" {
   require_numbers                = true
 }`,
-			mustExcludeResultCode: checks.AWSIAMPasswordRequiresNumber,
+			mustExcludeResultCode: aws.AWSIAMPasswordRequiresNumber,
 		},
 	}
 
@@ -219,7 +219,7 @@ func Test_AWSIamPasswordRequiresUppercaseCharacter(t *testing.T) {
 			source: `
 resource "aws_iam_account_password_policy" "strict" {
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordRequiresUppercaseCharacter,
+			mustIncludeResultCode: aws.AWSIAMPasswordRequiresUppercaseCharacter,
 		},
 		{
 			name: "check aws_iam_account_password_policy require_uppercase_characters is set but not true",
@@ -227,7 +227,7 @@ resource "aws_iam_account_password_policy" "strict" {
 resource "aws_iam_account_password_policy" "strict" {
   require_uppercase_characters                = false
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordRequiresUppercaseCharacter,
+			mustIncludeResultCode: aws.AWSIAMPasswordRequiresUppercaseCharacter,
 		},
 		{
 			name: "check aws_iam_account_password_policy require_uppercase_characters is set to true",
@@ -235,7 +235,7 @@ resource "aws_iam_account_password_policy" "strict" {
 resource "aws_iam_account_password_policy" "strict" {
   require_uppercase_characters                = true
 }`,
-			mustExcludeResultCode: checks.AWSIAMPasswordRequiresUppercaseCharacter,
+			mustExcludeResultCode: aws.AWSIAMPasswordRequiresUppercaseCharacter,
 		},
 	}
 
@@ -260,7 +260,7 @@ func Test_AWSIamPasswordRequiresLowercaseCharacter(t *testing.T) {
 			source: `
 resource "aws_iam_account_password_policy" "strict" {
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordRequiresLowercaseCharacter,
+			mustIncludeResultCode: aws.AWSIAMPasswordRequiresLowercaseCharacter,
 		},
 		{
 			name: "check aws_iam_account_password_policy has require_lowercase_characters is set but not true",
@@ -268,7 +268,7 @@ resource "aws_iam_account_password_policy" "strict" {
 resource "aws_iam_account_password_policy" "strict" {
   require_lowercase_characters                = false
 }`,
-			mustIncludeResultCode: checks.AWSIAMPasswordRequiresLowercaseCharacter,
+			mustIncludeResultCode: aws.AWSIAMPasswordRequiresLowercaseCharacter,
 		},
 		{
 			name: "check aws_iam_account_password_policy has require_lowercase_characters is set to true",
@@ -276,7 +276,7 @@ resource "aws_iam_account_password_policy" "strict" {
 resource "aws_iam_account_password_policy" "strict" {
   require_lowercase_characters                = true
 }`,
-			mustExcludeResultCode: checks.AWSIAMPasswordRequiresLowercaseCharacter,
+			mustExcludeResultCode: aws.AWSIAMPasswordRequiresLowercaseCharacter,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_iam_policy_document_test.go b/internal/app/tfsec/aws_iam_policy_document_test.go
index f47d39059..65d49a9f1 100644
--- a/internal/app/tfsec/aws_iam_policy_document_test.go
+++ b/internal/app/tfsec/aws_iam_policy_document_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSIamPolicyDocument(t *testing.T) {
@@ -29,7 +28,7 @@ data "aws_iam_policy_document" "my-policy" {
     	]
 	}
 }`,
-			mustExcludeResultCode: checks.AWSIamPolicyWildcardActions,
+			mustExcludeResultCode: aws.AWSIamPolicyWildcardActions,
 		},
 		{
 			name: "check aws_iam_policy_document has wildcard actions.",
@@ -44,7 +43,7 @@ data "aws_iam_policy_document" "my-policy" {
     	]
 	}
 }`,
-			mustIncludeResultCode: checks.AWSIamPolicyWildcardActions,
+			mustIncludeResultCode: aws.AWSIamPolicyWildcardActions,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_missing_description_for_security_group_test.go b/internal/app/tfsec/aws_missing_description_for_security_group_test.go
index 8b46b01b8..1264fd7bf 100644
--- a/internal/app/tfsec/aws_missing_description_for_security_group_test.go
+++ b/internal/app/tfsec/aws_missing_description_for_security_group_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSMissingDescriptionForSecurityGroup(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSMissingDescriptionForSecurityGroup(t *testing.T) {
 resource "aws_security_group" "my-group" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSNoDescriptionInSecurityGroup,
+			mustIncludeResultCode: aws.AWSNoDescriptionInSecurityGroup,
 		},
 		{
 			name: "check aws_security_group_rule without description",
@@ -30,7 +29,7 @@ resource "aws_security_group" "my-group" {
 resource "aws_security_group_rule" "my-rule" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSNoDescriptionInSecurityGroup,
+			mustIncludeResultCode: aws.AWSNoDescriptionInSecurityGroup,
 		},
 		{
 			name: "check aws_security_group with description",
@@ -38,7 +37,7 @@ resource "aws_security_group_rule" "my-rule" {
 resource "aws_security_group" "my-group" {
 	description = "this is a group for allowing shiz"
 }`,
-			mustExcludeResultCode: checks.AWSNoDescriptionInSecurityGroup,
+			mustExcludeResultCode: aws.AWSNoDescriptionInSecurityGroup,
 		},
 		{
 			name: "check aws_security_group_rule with description",
@@ -46,7 +45,7 @@ resource "aws_security_group" "my-group" {
 resource "aws_security_group_rule" "my-rule" {
 	description = "this is a group for allowing shiz"
 }`,
-			mustExcludeResultCode: checks.AWSNoDescriptionInSecurityGroup,
+			mustExcludeResultCode: aws.AWSNoDescriptionInSecurityGroup,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_no_ecr_repository_scan_test.go b/internal/app/tfsec/aws_no_ecr_repository_scan_test.go
index 353fc418e..e833946e4 100644
--- a/internal/app/tfsec/aws_no_ecr_repository_scan_test.go
+++ b/internal/app/tfsec/aws_no_ecr_repository_scan_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSEcrImageScanNotEnabled(t *testing.T) {
@@ -18,7 +17,7 @@ func Test_AWSEcrImageScanNotEnabled(t *testing.T) {
 		{
 			name:                  "check ECR Image Scan disabled",
 			source:                `resource "aws_ecr_repository" "foo" {}`,
-			mustIncludeResultCode: checks.AWSEcrImageScanNotEnabled,
+			mustIncludeResultCode: aws.AWSEcrImageScanNotEnabled,
 		},
 		{
 			name: "check ECR Image Scan disabled",
@@ -31,7 +30,7 @@ resource "aws_ecr_repository" "foo" {
     scan_on_push = false
   }
 }`,
-			mustIncludeResultCode: checks.AWSEcrImageScanNotEnabled,
+			mustIncludeResultCode: aws.AWSEcrImageScanNotEnabled,
 		},
 		{
 			name: "check ECR Image Scan disabled",
@@ -44,7 +43,7 @@ resource "aws_ecr_repository" "foo" {
     scan_on_push = true
   }
 }`,
-			mustExcludeResultCode: checks.AWSEcrImageScanNotEnabled,
+			mustExcludeResultCode: aws.AWSEcrImageScanNotEnabled,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_no_kms_key_autorotate_test.go b/internal/app/tfsec/aws_no_kms_key_autorotate_test.go
index dec82992b..742af26f6 100644
--- a/internal/app/tfsec/aws_no_kms_key_autorotate_test.go
+++ b/internal/app/tfsec/aws_no_kms_key_autorotate_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSNoKmsKeyAutoRotate(t *testing.T) {
@@ -18,7 +17,7 @@ func Test_AWSNoKmsKeyAutoRotate(t *testing.T) {
 		{
 			name:                  "check KMS Key with auto-rotation not set",
 			source:                `resource "aws_kms_key" "kms_key" {}`,
-			mustIncludeResultCode: checks.AWSNoKMSAutoRotate,
+			mustIncludeResultCode: aws.AWSNoKMSAutoRotate,
 		},
 		{
 			name: "check KMS Key with auto-rotation disabled",
@@ -26,7 +25,7 @@ func Test_AWSNoKmsKeyAutoRotate(t *testing.T) {
 resource "aws_kms_key" "kms_key" {
 	enable_key_rotation = false
 }`,
-			mustIncludeResultCode: checks.AWSNoKMSAutoRotate,
+			mustIncludeResultCode: aws.AWSNoKMSAutoRotate,
 		},
 		{
 			name: "check KMS Key with auto-rotation enabled",
@@ -34,7 +33,7 @@ resource "aws_kms_key" "kms_key" {
 resource "aws_kms_key" "kms_key" {
 	enable_key_rotation = true
 }`,
-			mustExcludeResultCode: checks.AWSNoKMSAutoRotate,
+			mustExcludeResultCode: aws.AWSNoKMSAutoRotate,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_not_internal_test.go b/internal/app/tfsec/aws_not_internal_test.go
index 8b4e42663..6f2744ed9 100644
--- a/internal/app/tfsec/aws_not_internal_test.go
+++ b/internal/app/tfsec/aws_not_internal_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSNotInternal(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSNotInternal(t *testing.T) {
 resource "aws_alb" "my-resource" {
 	internal = false
 }`,
-			mustIncludeResultCode: checks.AWSExternallyExposedLoadBalancer,
+			mustIncludeResultCode: aws.AWSExternallyExposedLoadBalancer,
 		},
 		{
 			name: "check aws_elb when not internal",
@@ -30,7 +29,7 @@ resource "aws_alb" "my-resource" {
 resource "aws_elb" "my-resource" {
 	internal = false
 }`,
-			mustIncludeResultCode: checks.AWSExternallyExposedLoadBalancer,
+			mustIncludeResultCode: aws.AWSExternallyExposedLoadBalancer,
 		},
 		{
 			name: "check aws_lb when not internal",
@@ -38,14 +37,14 @@ resource "aws_elb" "my-resource" {
 resource "aws_lb" "my-resource" {
 	internal = false
 }`,
-			mustIncludeResultCode: checks.AWSExternallyExposedLoadBalancer,
+			mustIncludeResultCode: aws.AWSExternallyExposedLoadBalancer,
 		},
 		{
 			name: "check aws_lb when not explicitly marked as internal",
 			source: `
 resource "aws_lb" "my-resource" {
 }`,
-			mustIncludeResultCode: checks.AWSExternallyExposedLoadBalancer,
+			mustIncludeResultCode: aws.AWSExternallyExposedLoadBalancer,
 		},
 		{
 			name: "check aws_lb when explicitly marked as internal",
@@ -53,7 +52,7 @@ resource "aws_lb" "my-resource" {
 resource "aws_lb" "my-resource" {
 	internal = true
 }`,
-			mustExcludeResultCode: checks.AWSExternallyExposedLoadBalancer,
+			mustExcludeResultCode: aws.AWSExternallyExposedLoadBalancer,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_open_security_group_rule_test.go b/internal/app/tfsec/aws_open_security_group_rule_test.go
index cefcfc634..7da4e363c 100644
--- a/internal/app/tfsec/aws_open_security_group_rule_test.go
+++ b/internal/app/tfsec/aws_open_security_group_rule_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSOpenSecurityGroupRule(t *testing.T) {
@@ -23,7 +22,7 @@ resource "aws_security_group_rule" "my-rule" {
 	type = "ingress"
 	cidr_blocks = ["0.0.0.0/0"]
 }`,
-			mustIncludeResultCode: checks.AWSOpenIngressSecurityGroupRule,
+			mustIncludeResultCode: aws.AWSOpenIngressSecurityGroupRule,
 		},
 		{
 			name: "check aws_security_group_rule egress on 0.0.0.0/0",
@@ -32,7 +31,7 @@ resource "aws_security_group_rule" "my-rule" {
 	type = "egress"
 	cidr_blocks = ["0.0.0.0/0"]
 }`,
-			mustIncludeResultCode: checks.AWSOpenEgressSecurityGroupRule,
+			mustIncludeResultCode: aws.AWSOpenEgressSecurityGroupRule,
 		},
 		{
 			name: "check aws_security_group_rule egress on 0.0.0.0/0 in list",
@@ -41,7 +40,7 @@ resource "aws_security_group_rule" "my-rule" {
 	type = "egress"
 	cidr_blocks = ["10.0.0.0/16", "0.0.0.0/0"]
 }`,
-			mustIncludeResultCode: checks.AWSOpenEgressSecurityGroupRule,
+			mustIncludeResultCode: aws.AWSOpenEgressSecurityGroupRule,
 		},
 		{
 			name: "check aws_security_group_rule egress on 10.0.0.0/16",
@@ -50,7 +49,7 @@ resource "aws_security_group_rule" "my-rule" {
 	type = "egress"
 	cidr_blocks = ["10.0.0.0/16"]
 }`,
-			mustExcludeResultCode: checks.AWSOpenEgressSecurityGroupRule,
+			mustExcludeResultCode: aws.AWSOpenEgressSecurityGroupRule,
 		},
 		{
 			name: "check variable containing 0.0.0.0/0",
@@ -71,7 +70,7 @@ variable "blocks" {
 }
 
 `,
-			mustIncludeResultCode: checks.AWSOpenIngressSecurityGroupRule,
+			mustIncludeResultCode: aws.AWSOpenIngressSecurityGroupRule,
 		},
 		{
 			name: "check aws_security_group_rule ingress on ::/0",
@@ -80,7 +79,7 @@ resource "aws_security_group_rule" "my-rule" {
 	type = "ingress"
 	ipv6_cidr_blocks = ["::/0"]
 }`,
-			mustIncludeResultCode: checks.AWSOpenIngressSecurityGroupRule,
+			mustIncludeResultCode: aws.AWSOpenIngressSecurityGroupRule,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_open_security_group_test.go b/internal/app/tfsec/aws_open_security_group_test.go
index c04750d4e..c959ac06e 100644
--- a/internal/app/tfsec/aws_open_security_group_test.go
+++ b/internal/app/tfsec/aws_open_security_group_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSOpenSecurityGroup(t *testing.T) {
@@ -24,7 +23,7 @@ func Test_AWSOpenSecurityGroup(t *testing.T) {
 				cidr_blocks = ["0.0.0.0/0"]
 			}
 		}`,
-			mustIncludeResultCode: checks.AWSOpenIngressSecurityGroupInlineRule,
+			mustIncludeResultCode: aws.AWSOpenIngressSecurityGroupInlineRule,
 		},
 		{
 			name: "check aws_security_group egress on 0.0.0.0/0",
@@ -34,7 +33,7 @@ func Test_AWSOpenSecurityGroup(t *testing.T) {
 				cidr_blocks = ["0.0.0.0/0"]
 			}
 		}`,
-			mustIncludeResultCode: checks.AWSOpenEgressSecurityGroupInlineRule,
+			mustIncludeResultCode: aws.AWSOpenEgressSecurityGroupInlineRule,
 		},
 		{
 			name: "check aws_security_group egress on 0.0.0.0/0 in list",
@@ -44,7 +43,7 @@ func Test_AWSOpenSecurityGroup(t *testing.T) {
 				cidr_blocks = ["10.0.0.0/16", "0.0.0.0/0"]
 			}
 		}`,
-			mustIncludeResultCode: checks.AWSOpenEgressSecurityGroupInlineRule,
+			mustIncludeResultCode: aws.AWSOpenEgressSecurityGroupInlineRule,
 		},
 		{
 			name: "check aws_security_group egress on 10.0.0.0/16",
@@ -54,7 +53,7 @@ func Test_AWSOpenSecurityGroup(t *testing.T) {
 				cidr_blocks = ["10.0.0.0/16"]
 			}
 		}`,
-			mustExcludeResultCode: checks.AWSOpenEgressSecurityGroupInlineRule,
+			mustExcludeResultCode: aws.AWSOpenEgressSecurityGroupInlineRule,
 		},
 		{
 			name: "check dynamic blocks using for_each",
@@ -102,7 +101,7 @@ func Test_AWSOpenSecurityGroup(t *testing.T) {
 		 }
 		}
 					`,
-			mustIncludeResultCode: checks.AWSOpenIngressSecurityGroupInlineRule,
+			mustIncludeResultCode: aws.AWSOpenIngressSecurityGroupInlineRule,
 		},
 		{
 			name: "check aws_security_group multiple ingress on 0.0.0.0/0",
@@ -115,7 +114,7 @@ func Test_AWSOpenSecurityGroup(t *testing.T) {
 				cidr_blocks = ["0.0.0.0/0"]
 			}
 		}`,
-			mustIncludeResultCode: checks.AWSOpenIngressSecurityGroupInlineRule,
+			mustIncludeResultCode: aws.AWSOpenIngressSecurityGroupInlineRule,
 		},
 		{
 			name: "check dynamic values for cidr_blocks",
@@ -141,7 +140,7 @@ variable "cidr_2" {
   default = ["1.1.1.1/32"]
 }
 `,
-			mustIncludeResultCode: checks.AWSOpenEgressSecurityGroupInlineRule,
+			mustIncludeResultCode: aws.AWSOpenEgressSecurityGroupInlineRule,
 		},
 		{
 			name: "check aws_security_group ingress on ::/0",
@@ -151,7 +150,7 @@ variable "cidr_2" {
 				ipv6_cidr_blocks = ["0.0.0.0/0"]
 			}
 		}`,
-			mustIncludeResultCode: checks.AWSOpenIngressSecurityGroupInlineRule,
+			mustIncludeResultCode: aws.AWSOpenIngressSecurityGroupInlineRule,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_outdated_ssl_test.go b/internal/app/tfsec/aws_outdated_ssl_test.go
index 4dde41792..93d782cc7 100644
--- a/internal/app/tfsec/aws_outdated_ssl_test.go
+++ b/internal/app/tfsec/aws_outdated_ssl_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSOutdatedSSLPolicy(t *testing.T) {
@@ -23,7 +22,7 @@ resource "aws_alb_listener" "my-resource" {
 	ssl_policy = "ELBSecurityPolicy-TLS-1-1-2017-01"
 	protocol = "HTTPS"
 }`,
-			mustIncludeResultCode: checks.AWSOutdatedSSLPolicy,
+			mustIncludeResultCode: aws.AWSOutdatedSSLPolicy,
 		},
 		{
 			name: "check aws_lb_listener with outdated policy",
@@ -32,7 +31,7 @@ resource "aws_lb_listener" "my-resource" {
 	ssl_policy = "ELBSecurityPolicy-TLS-1-1-2017-01"
 	protocol = "HTTPS"
 }`,
-			mustIncludeResultCode: checks.AWSOutdatedSSLPolicy,
+			mustIncludeResultCode: aws.AWSOutdatedSSLPolicy,
 		},
 		{
 			name: "check aws_alb_listener with ok policy",
@@ -41,7 +40,7 @@ resource "aws_alb_listener" "my-resource" {
 	ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
 	protocol = "HTTPS"
 }`,
-			mustExcludeResultCode: checks.AWSOutdatedSSLPolicy,
+			mustExcludeResultCode: aws.AWSOutdatedSSLPolicy,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_outdated_tls_policy_elasticsearch_domain_endpoint_test.go b/internal/app/tfsec/aws_outdated_tls_policy_elasticsearch_domain_endpoint_test.go
index 087f35910..a2ac364be 100644
--- a/internal/app/tfsec/aws_outdated_tls_policy_elasticsearch_domain_endpoint_test.go
+++ b/internal/app/tfsec/aws_outdated_tls_policy_elasticsearch_domain_endpoint_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSOutdatedTLSPolicyElasticsearchDomainEndpoint(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSOutdatedTLSPolicyElasticsearchDomainEndpoint(t *testing.T) {
 resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
 	
 }`,
-			mustExcludeResultCode: checks.AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
+			mustExcludeResultCode: aws.AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
 		},
 		{
 			name: "check tls_security_policy for aws_elasticsearch_domain isn't the default",
@@ -34,7 +33,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
     enforce_https = true
   }
 }`,
-			mustIncludeResultCode: checks.AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
+			mustIncludeResultCode: aws.AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
 		},
 		{
 			name: "check tls_security_policy isn't set to TLsv1.0 for aws_elasticsearch_domain",
@@ -47,7 +46,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
     tls_security_policy = "Policy-Min-TLS-1-0-2019-07"
   }
 }`,
-			mustIncludeResultCode: checks.AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
+			mustIncludeResultCode: aws.AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
 		},
 		{
 			name: "check tls_security_policy is set to TLSv1.2 for aws_elasticsearch_domain",
@@ -60,7 +59,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
     tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
   }
 }`,
-			mustExcludeResultCode: checks.AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
+			mustExcludeResultCode: aws.AWSOutdatedTLSPolicyElasticsearchDomainEndpoint,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_plaintext_node_to_node_elasticsearch_traffic_test.go b/internal/app/tfsec/aws_plaintext_node_to_node_elasticsearch_traffic_test.go
index 7faae1ee4..0c06e26d0 100644
--- a/internal/app/tfsec/aws_plaintext_node_to_node_elasticsearch_traffic_test.go
+++ b/internal/app/tfsec/aws_plaintext_node_to_node_elasticsearch_traffic_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSPlaintextNodeToNodeElasticsearchTraffic(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSPlaintextNodeToNodeElasticsearchTraffic(t *testing.T) {
 resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSPlaintextNodeToNodeElasticsearchTraffic,
+			mustIncludeResultCode: aws.AWSPlaintextNodeToNodeElasticsearchTraffic,
 		},
 		{
 			name: "check false enabled attr aws_elasticsearch_domain",
@@ -34,7 +33,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
     enabled = false
   }
 }`,
-			mustIncludeResultCode: checks.AWSPlaintextNodeToNodeElasticsearchTraffic,
+			mustIncludeResultCode: aws.AWSPlaintextNodeToNodeElasticsearchTraffic,
 		},
 		{
 			name: "check true enabled attr aws_elasticsearch_domain",
@@ -46,7 +45,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
     enabled = true
   }
 }`,
-			mustExcludeResultCode: checks.AWSPlaintextNodeToNodeElasticsearchTraffic,
+			mustExcludeResultCode: aws.AWSPlaintextNodeToNodeElasticsearchTraffic,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_provider_test.go b/internal/app/tfsec/aws_provider_test.go
index c1fd943e2..4a11a1097 100644
--- a/internal/app/tfsec/aws_provider_test.go
+++ b/internal/app/tfsec/aws_provider_test.go
@@ -1,9 +1,10 @@
 package tfsec
 
 import (
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
-	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 	"testing"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
 )
 
 func Test_AWSProviderHasAccessCredentials(t *testing.T) {
@@ -20,7 +21,7 @@ func Test_AWSProviderHasAccessCredentials(t *testing.T) {
 provider "aws" {
   access_key = "abcd1234"
 }`,
-			mustIncludeResultCode: checks.AWSProviderHasAccessCredentials,
+			mustIncludeResultCode: aws.AWSProviderHasAccessCredentials,
 		},
 		{
 			name: "check aws provider has secret key specified",
@@ -28,7 +29,7 @@ provider "aws" {
 provider "aws" {
   secret_key = "abcd1234"
 }`,
-			mustIncludeResultCode: checks.AWSProviderHasAccessCredentials,
+			mustIncludeResultCode: aws.AWSProviderHasAccessCredentials,
 		},
 		{
 			name: "check aws provider has both access and secret key specified",
@@ -37,14 +38,14 @@ provider "aws" {
   access_key = "abcd1234"
   secret_key = "abcd1234"
 }`,
-			mustIncludeResultCode: checks.AWSProviderHasAccessCredentials,
+			mustIncludeResultCode: aws.AWSProviderHasAccessCredentials,
 		},
 		{
 			name: "check aws provider has neither access or secret key specified",
 			source: `
 provider "aws" {
 }`,
-			mustExcludeResultCode: checks.AWSProviderHasAccessCredentials,
+			mustExcludeResultCode: aws.AWSProviderHasAccessCredentials,
 		},
 	}
 
@@ -54,4 +55,4 @@ provider "aws" {
 			assertCheckCode(t, test.mustIncludeResultCode, test.mustExcludeResultCode, results)
 		})
 	}
-}
\ No newline at end of file
+}
diff --git a/internal/app/tfsec/aws_public_ip_test.go b/internal/app/tfsec/aws_public_ip_test.go
index 255eacfa2..ffe5da962 100644
--- a/internal/app/tfsec/aws_public_ip_test.go
+++ b/internal/app/tfsec/aws_public_ip_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSPublicIP(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSPublicIP(t *testing.T) {
 resource "aws_launch_configuration" "my-resource" {
 	associate_public_ip_address = true
 }`,
-			mustIncludeResultCode: checks.AWSResourceHasPublicIP,
+			mustIncludeResultCode: aws.AWSResourceHasPublicIP,
 		},
 		{
 			name: "check aws_instance with public ip associated",
@@ -30,7 +29,7 @@ resource "aws_launch_configuration" "my-resource" {
 resource "aws_instance" "my-resource" {
 	associate_public_ip_address = true
 }`,
-			mustIncludeResultCode: checks.AWSResourceHasPublicIP,
+			mustIncludeResultCode: aws.AWSResourceHasPublicIP,
 		},
 		{
 			name: "check aws_instance without public ip associated",
@@ -38,14 +37,14 @@ resource "aws_instance" "my-resource" {
 resource "aws_instance" "my-resource" {
 	associate_public_ip_address = false
 }`,
-			mustExcludeResultCode: checks.AWSResourceHasPublicIP,
+			mustExcludeResultCode: aws.AWSResourceHasPublicIP,
 		},
 		{
 			name: "check aws_instance without public ip explicitly associated",
 			source: `
 resource "aws_instance" "my-resource" {
 }`,
-			mustExcludeResultCode: checks.AWSResourceHasPublicIP,
+			mustExcludeResultCode: aws.AWSResourceHasPublicIP,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_public_test.go b/internal/app/tfsec/aws_public_test.go
index 4f588c5fc..90ca53133 100644
--- a/internal/app/tfsec/aws_public_test.go
+++ b/internal/app/tfsec/aws_public_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSPublic(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSPublic(t *testing.T) {
 resource "aws_db_instance" "my-resource" {
 	publicly_accessible = true
 }`,
-			mustIncludeResultCode: checks.AWSPubliclyAccessibleResource,
+			mustIncludeResultCode: aws.AWSPubliclyAccessibleResource,
 		},
 		{
 			name: "check aws_dms_replication_instance when publicly exposed",
@@ -30,7 +29,7 @@ resource "aws_db_instance" "my-resource" {
 resource "aws_dms_replication_instance" "my-resource" {
 	publicly_accessible = true
 }`,
-			mustIncludeResultCode: checks.AWSPubliclyAccessibleResource,
+			mustIncludeResultCode: aws.AWSPubliclyAccessibleResource,
 		},
 		{
 			name: "check aws_rds_cluster_instance when publicly exposed",
@@ -38,7 +37,7 @@ resource "aws_dms_replication_instance" "my-resource" {
 resource "aws_rds_cluster_instance" "my-resource" {
 	publicly_accessible = true
 }`,
-			mustIncludeResultCode: checks.AWSPubliclyAccessibleResource,
+			mustIncludeResultCode: aws.AWSPubliclyAccessibleResource,
 		},
 		{
 			name: "check aws_redshift_cluster when publicly exposed",
@@ -46,7 +45,7 @@ resource "aws_rds_cluster_instance" "my-resource" {
 resource "aws_redshift_cluster" "my-resource" {
 	publicly_accessible = true
 }`,
-			mustIncludeResultCode: checks.AWSPubliclyAccessibleResource,
+			mustIncludeResultCode: aws.AWSPubliclyAccessibleResource,
 		},
 		{
 			name: "check aws_redshift_cluster when not publicly exposed",
@@ -54,7 +53,7 @@ resource "aws_redshift_cluster" "my-resource" {
 resource "aws_redshift_cluster" "my-resource" {
 	publicly_accessible = false
 }`,
-			mustExcludeResultCode: checks.AWSPubliclyAccessibleResource,
+			mustExcludeResultCode: aws.AWSPubliclyAccessibleResource,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_task_definition_includes_sensitive_data_test.go b/internal/app/tfsec/aws_task_definition_includes_sensitive_data_test.go
index 75c05b655..8765ccacc 100644
--- a/internal/app/tfsec/aws_task_definition_includes_sensitive_data_test.go
+++ b/internal/app/tfsec/aws_task_definition_includes_sensitive_data_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSTaskDefinitionIncludesSensitiveData(t *testing.T) {
@@ -35,7 +34,7 @@ resource "aws_ecs_task_definition" "my-task" {
 EOF
 
 }`,
-			mustIncludeResultCode: checks.AWSTaskDefinitionWithSensitiveEnvironmentVariables,
+			mustIncludeResultCode: aws.AWSTaskDefinitionWithSensitiveEnvironmentVariables,
 		},
 		{
 			name: "check aws_ecs_task_definition when sensitive env vars are not included",
@@ -56,7 +55,7 @@ resource "aws_ecs_task_definition" "my-task" {
 EOF
 
 }`,
-			mustExcludeResultCode: checks.AWSTaskDefinitionWithSensitiveEnvironmentVariables,
+			mustExcludeResultCode: aws.AWSTaskDefinitionWithSensitiveEnvironmentVariables,
 		},
 		{
 			name: "check aws_ecs_task_definition when sensitive env vars are included but ignored",
@@ -78,7 +77,7 @@ resource "aws_ecs_task_definition" "my-task" {
 EOF
 
 }`,
-			mustExcludeResultCode: checks.AWSTaskDefinitionWithSensitiveEnvironmentVariables,
+			mustExcludeResultCode: aws.AWSTaskDefinitionWithSensitiveEnvironmentVariables,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_at_rest_elasticache_replication_group_test.go b/internal/app/tfsec/aws_unencrypted_at_rest_elasticache_replication_group_test.go
index 9c7239f44..d112a04c4 100644
--- a/internal/app/tfsec/aws_unencrypted_at_rest_elasticache_replication_group_test.go
+++ b/internal/app/tfsec/aws_unencrypted_at_rest_elasticache_replication_group_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedAtRestElasticacheReplicationGroup(t *testing.T) {
@@ -22,7 +21,7 @@ resource "aws_elasticache_replication_group" "my-resource" {
         replication_group_id = "foo"
         replication_group_description = "my foo cluster"
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedAtRestElasticacheReplicationGroup,
+			mustIncludeResultCode: aws.AWSUnencryptedAtRestElasticacheReplicationGroup,
 		},
 		{
 			name: "check aws_elasticache_replication_group with at_rest_encryption_enabled",
@@ -33,7 +32,7 @@ resource "aws_elasticache_replication_group" "my-resource" {
 
         at_rest_encryption_enabled = true
 }`,
-			mustExcludeResultCode: checks.AWSUnencryptedAtRestElasticacheReplicationGroup,
+			mustExcludeResultCode: aws.AWSUnencryptedAtRestElasticacheReplicationGroup,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_block_device_test.go b/internal/app/tfsec/aws_unencrypted_block_device_test.go
index 209c6b9e9..44b725130 100644
--- a/internal/app/tfsec/aws_unencrypted_block_device_test.go
+++ b/internal/app/tfsec/aws_unencrypted_block_device_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedBlockDevice(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSUnencryptedBlockDevice(t *testing.T) {
 resource "aws_launch_configuration" "my-launch-config" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustIncludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check no encryption configured for ebs_block_device",
@@ -30,7 +29,7 @@ resource "aws_launch_configuration" "my-launch-config" {
 resource "aws_launch_configuration" "my-launch-config" {
 	root_block_device {}
 }`,
-			mustIncludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustIncludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check no encryption configured for ebs_block_device",
@@ -41,7 +40,7 @@ resource "aws_launch_configuration" "my-launch-config" {
 	}
 	ebs_block_device {}
 }`,
-			mustIncludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustIncludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check encryption disabled for root_block_device",
@@ -51,7 +50,7 @@ resource "aws_launch_configuration" "my-launch-config" {
 		encrypted = false
 	}
 }`,
-			mustIncludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustIncludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check encryption disabled for ebs_block_device",
@@ -64,7 +63,7 @@ resource "aws_launch_configuration" "my-launch-config" {
 		encrypted = false
 	}
 }`,
-			mustIncludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustIncludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check encryption enabled for root_block_device",
@@ -74,7 +73,7 @@ resource "aws_launch_configuration" "my-launch-config" {
 		encrypted = true
 	}
 }`,
-			mustExcludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustExcludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check encryption enabled for root_block_device and ebs_block_device",
@@ -87,7 +86,7 @@ resource "aws_launch_configuration" "my-launch-config" {
 		encrypted = true
 	}
 }`,
-			mustExcludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustExcludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check encryption enabled by default for root_block_device",
@@ -101,7 +100,7 @@ resource "aws_launch_configuration" "my-launch-config" {
 
 	}
 }`,
-			mustExcludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustExcludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check encryption enabled by default for non-specified root_block_device",
@@ -113,7 +112,7 @@ resource "aws_ebs_encryption_by_default" "example" {
 resource "aws_launch_configuration" "my-launch-config" {
 
 }`,
-			mustExcludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustExcludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check encryption enabled by default for non-specified root_block_device and ebs_block_device",
@@ -125,7 +124,7 @@ resource "aws_ebs_encryption_by_default" "example" {
 resource "aws_launch_configuration" "my-launch-config" {
 	ebs_block_device{}
 }`,
-			mustExcludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustExcludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 		{
 			name: "check encryption enabled for one ebs_block_device and not for another",
@@ -141,7 +140,7 @@ resource "aws_launch_configuration" "my-launch-config" {
 		encrypted  = false
 	}
 }`,
-			mustIncludeResultCode: checks.AWSLaunchConfigurationWithUnencryptedBlockDevice,
+			mustIncludeResultCode: aws.AWSLaunchConfigurationWithUnencryptedBlockDevice,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_cloudfront_communications_test.go b/internal/app/tfsec/aws_unencrypted_cloudfront_communications_test.go
index d1176b4c1..6922358f5 100644
--- a/internal/app/tfsec/aws_unencrypted_cloudfront_communications_test.go
+++ b/internal/app/tfsec/aws_unencrypted_cloudfront_communications_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedCloudFrontCommunications(t *testing.T) {
@@ -21,7 +20,7 @@ func Test_AWSUnencryptedCloudFrontCommunications(t *testing.T) {
 resource "aws_cloudfront_distribution" "s3_distribution" {
 
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedCloudFrontCommunications,
+			mustIncludeResultCode: aws.AWSUnencryptedCloudFrontCommunications,
 		},
 		{
 			name: "check no default viewer_protocol_policy in default_cache_behavior",
@@ -31,7 +30,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 
 	  }
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedCloudFrontCommunications,
+			mustIncludeResultCode: aws.AWSUnencryptedCloudFrontCommunications,
 		},
 		{
 			name: "check viewer_protocol_policy include allows-all",
@@ -41,7 +40,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 	    viewer_protocol_policy = "allow-all"
 	  }
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedCloudFrontCommunications,
+			mustIncludeResultCode: aws.AWSUnencryptedCloudFrontCommunications,
 		},
 		{
 			name: "check no viewer_protocol_policy in ordered_cache_behavior",
@@ -56,7 +55,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 
 	}
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedCloudFrontCommunications,
+			mustIncludeResultCode: aws.AWSUnencryptedCloudFrontCommunications,
 		},
 		{
 			name: "check for allow-all in viewer_protocol_policy in orderd_cache_behavior ",
@@ -71,7 +70,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 		viewer_protocol_policy = "allow-all"
 	}
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedCloudFrontCommunications,
+			mustIncludeResultCode: aws.AWSUnencryptedCloudFrontCommunications,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_elasticearch_domain_test.go b/internal/app/tfsec/aws_unencrypted_elasticearch_domain_test.go
index 1cfb2c03b..3606fc9fe 100644
--- a/internal/app/tfsec/aws_unencrypted_elasticearch_domain_test.go
+++ b/internal/app/tfsec/aws_unencrypted_elasticearch_domain_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func TestAWSUnencryptedElasticsearchDomain(t *testing.T) {
@@ -22,7 +21,7 @@ func TestAWSUnencryptedElasticsearchDomain(t *testing.T) {
 resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedElasticsearchDomain,
+			mustIncludeResultCode: aws.AWSUnencryptedElasticsearchDomain,
 		},
 		{
 			name: "check false enabled attr aws_elasticsearch_domain",
@@ -32,7 +31,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
 
   encrypt_at_rest { }
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedElasticsearchDomain,
+			mustIncludeResultCode: aws.AWSUnencryptedElasticsearchDomain,
 		},
 		{
 			name: "check true enabled attr aws_elasticsearch_domain",
@@ -44,7 +43,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
     enabled = true
   }
 }`,
-			mustExcludeResultCode: checks.AWSUnencryptedElasticsearchDomain,
+			mustExcludeResultCode: aws.AWSUnencryptedElasticsearchDomain,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_in_transit_elasticache_replication_group_test.go b/internal/app/tfsec/aws_unencrypted_in_transit_elasticache_replication_group_test.go
index 9c523e8b6..8857e68a7 100644
--- a/internal/app/tfsec/aws_unencrypted_in_transit_elasticache_replication_group_test.go
+++ b/internal/app/tfsec/aws_unencrypted_in_transit_elasticache_replication_group_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedInTransitElasticacheReplicationGroup(t *testing.T) {
@@ -22,7 +21,7 @@ resource "aws_elasticache_replication_group" "my-resource" {
         replication_group_id = "foo"
         replication_group_description = "my foo cluster"
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedInTransitElasticacheReplicationGroup,
+			mustIncludeResultCode: aws.AWSUnencryptedInTransitElasticacheReplicationGroup,
 		},
 		{
 			name: "check aws_elasticache_replication_group with transit_encryption_enabled",
@@ -33,7 +32,7 @@ resource "aws_elasticache_replication_group" "my-resource" {
 
         transit_encryption_enabled = true
 }`,
-			mustExcludeResultCode: checks.AWSUnencryptedInTransitElasticacheReplicationGroup,
+			mustExcludeResultCode: aws.AWSUnencryptedInTransitElasticacheReplicationGroup,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_kinesis_streams_test.go b/internal/app/tfsec/aws_unencrypted_kinesis_streams_test.go
index 428d60a40..63835228a 100644
--- a/internal/app/tfsec/aws_unencrypted_kinesis_streams_test.go
+++ b/internal/app/tfsec/aws_unencrypted_kinesis_streams_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedKinesisStream(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSUnencryptedKinesisStream(t *testing.T) {
 resource "aws_kinesis_stream" "test_stream" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedKinesisStream,
+			mustIncludeResultCode: aws.AWSUnencryptedKinesisStream,
 		},
 		{
 			name: "check blank encryption key id specified for aws_sqs_queue",
@@ -30,7 +29,7 @@ resource "aws_kinesis_stream" "test_stream" {
 resource "aws_kinesis_stream" "test_stream" {
 	encryption_type = "NONE"
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedKinesisStream,
+			mustIncludeResultCode: aws.AWSUnencryptedKinesisStream,
 		},
 		{
 			name: "check encryption key id specified for aws_sqs_queue",
@@ -38,7 +37,7 @@ resource "aws_kinesis_stream" "test_stream" {
 resource "aws_kinesis_stream" "test_stream" {
 	encryption_type = "KMS"
 }`,
-			mustExcludeResultCode: checks.AWSUnencryptedKinesisStream,
+			mustExcludeResultCode: aws.AWSUnencryptedKinesisStream,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_msk_broker_transit_test.go b/internal/app/tfsec/aws_unencrypted_msk_broker_transit_test.go
index 3c9537077..f506c990e 100644
--- a/internal/app/tfsec/aws_unencrypted_msk_broker_transit_test.go
+++ b/internal/app/tfsec/aws_unencrypted_msk_broker_transit_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedMSKBroker(t *testing.T) {
@@ -18,7 +17,7 @@ func Test_AWSUnencryptedMSKBroker(t *testing.T) {
 		{
 			name:                  "check MSK broker with encryption_info not set",
 			source:                `resource "aws_msk_cluster" "msk-cluster" {}`,
-			mustIncludeResultCode: checks.AWSUnencryptedMSKBroker,
+			mustIncludeResultCode: aws.AWSUnencryptedMSKBroker,
 		},
 		{
 			name: "check MSK broker with encryption_in_transit not set",
@@ -31,7 +30,7 @@ resource "aws_msk_cluster" "msk-cluster" {
 		}
 	}
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedMSKBroker,
+			mustIncludeResultCode: aws.AWSUnencryptedMSKBroker,
 		},
 		{
 			name: "check MSK broker with client_broker not set",
@@ -42,7 +41,7 @@ resource "aws_msk_cluster" "msk-cluster" {
 		}
 	}
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedMSKBroker,
+			mustIncludeResultCode: aws.AWSUnencryptedMSKBroker,
 		},
 		{
 			name: "check MSK broker with client_broker set to PLAINTEXT",
@@ -54,7 +53,7 @@ resource "aws_msk_cluster" "msk-cluster" {
 		}
 	}
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedMSKBroker,
+			mustIncludeResultCode: aws.AWSUnencryptedMSKBroker,
 		},
 		{
 			name: "check MSK broker with client_broker set to TLS_PLAINTEXT",
@@ -66,7 +65,7 @@ resource "aws_msk_cluster" "msk-cluster" {
 		}
 	}
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedMSKBroker,
+			mustIncludeResultCode: aws.AWSUnencryptedMSKBroker,
 		},
 		{
 			name: "check MSK broker with client_broker set to TLS",
@@ -78,7 +77,7 @@ resource "aws_msk_cluster" "msk-cluster" {
 		}
 	}
 }`,
-			mustExcludeResultCode: checks.AWSUnencryptedMSKBroker,
+			mustExcludeResultCode: aws.AWSUnencryptedMSKBroker,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_s3_bucket_test.go b/internal/app/tfsec/aws_unencrypted_s3_bucket_test.go
index ce842b52d..90bce46bd 100644
--- a/internal/app/tfsec/aws_unencrypted_s3_bucket_test.go
+++ b/internal/app/tfsec/aws_unencrypted_s3_bucket_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedS3Bucket(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSUnencryptedS3Bucket(t *testing.T) {
 resource "aws_s3_bucket" "my-bucket" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedS3Bucket,
+			mustIncludeResultCode: aws.AWSUnencryptedS3Bucket,
 		},
 		{
 			name: "check no server_side_encryption_configuration aws_s3_bucket",
@@ -39,7 +38,7 @@ resource "aws_s3_bucket" "my-bucket" {
     }
   }
 }`,
-			mustExcludeResultCode: checks.AWSUnencryptedS3Bucket,
+			mustExcludeResultCode: aws.AWSUnencryptedS3Bucket,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_sns_topic_test.go b/internal/app/tfsec/aws_unencrypted_sns_topic_test.go
index cf2cfa71c..6503dfd3f 100644
--- a/internal/app/tfsec/aws_unencrypted_sns_topic_test.go
+++ b/internal/app/tfsec/aws_unencrypted_sns_topic_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedSNSTopic(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSUnencryptedSNSTopic(t *testing.T) {
 resource "aws_sns_topic" "my-topic" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedSNSTopic,
+			mustIncludeResultCode: aws.AWSUnencryptedSNSTopic,
 		},
 		{
 			name: "check blank encryption key id specified for aws_sns_topic",
@@ -30,7 +29,7 @@ resource "aws_sns_topic" "my-topic" {
 resource "aws_sns_topic" "my-topic" {
 	kms_master_key_id = ""
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedSNSTopic,
+			mustIncludeResultCode: aws.AWSUnencryptedSNSTopic,
 		},
 		{
 			name: "check encryption key id specified for aws_sns_topic",
@@ -38,7 +37,7 @@ resource "aws_sns_topic" "my-topic" {
 resource "aws_sns_topic" "my-topic" {
 	kms_master_key_id = "/blah"
 }`,
-			mustExcludeResultCode: checks.AWSUnencryptedSNSTopic,
+			mustExcludeResultCode: aws.AWSUnencryptedSNSTopic,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unencrypted_sqs_queue_test.go b/internal/app/tfsec/aws_unencrypted_sqs_queue_test.go
index 10b05806c..9f4b19607 100644
--- a/internal/app/tfsec/aws_unencrypted_sqs_queue_test.go
+++ b/internal/app/tfsec/aws_unencrypted_sqs_queue_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnencryptedSQSQueue(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSUnencryptedSQSQueue(t *testing.T) {
 resource "aws_sqs_queue" "my-queue" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedSQSQueue,
+			mustIncludeResultCode: aws.AWSUnencryptedSQSQueue,
 		},
 		{
 			name: "check blank encryption key id specified for aws_sqs_queue",
@@ -30,7 +29,7 @@ resource "aws_sqs_queue" "my-queue" {
 resource "aws_sqs_queue" "my-queue" {
 	kms_master_key_id = ""
 }`,
-			mustIncludeResultCode: checks.AWSUnencryptedSQSQueue,
+			mustIncludeResultCode: aws.AWSUnencryptedSQSQueue,
 		},
 		{
 			name: "check encryption key id specified for aws_sqs_queue",
@@ -38,7 +37,7 @@ resource "aws_sqs_queue" "my-queue" {
 resource "aws_sqs_queue" "my-queue" {
 	kms_master_key_id = "/blah"
 }`,
-			mustExcludeResultCode: checks.AWSUnencryptedSQSQueue,
+			mustExcludeResultCode: aws.AWSUnencryptedSQSQueue,
 		},
 	}
 
diff --git a/internal/app/tfsec/aws_unenforced_https_elasticsearch_domain_endpoint_test.go b/internal/app/tfsec/aws_unenforced_https_elasticsearch_domain_endpoint_test.go
index 1369e2d76..fa216e909 100644
--- a/internal/app/tfsec/aws_unenforced_https_elasticsearch_domain_endpoint_test.go
+++ b/internal/app/tfsec/aws_unenforced_https_elasticsearch_domain_endpoint_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/aws"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSUnenforcedHTTPSElasticsearchDomainEndpoint(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSUnenforcedHTTPSElasticsearchDomainEndpoint(t *testing.T) {
 resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
 	
 }`,
-			mustIncludeResultCode: checks.AWSUnenforcedHTTPSElasticsearchDomainEndpoint,
+			mustIncludeResultCode: aws.AWSUnenforcedHTTPSElasticsearchDomainEndpoint,
 		},
 		{
 			name: "check false enforce_https attr aws_elasticsearch_domain",
@@ -34,7 +33,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
     enforce_https = false
   }
 }`,
-			mustIncludeResultCode: checks.AWSUnenforcedHTTPSElasticsearchDomainEndpoint,
+			mustIncludeResultCode: aws.AWSUnenforcedHTTPSElasticsearchDomainEndpoint,
 		},
 		{
 			name: "check true enforce_https aws_elasticsearch_domain",
@@ -46,7 +45,7 @@ resource "aws_elasticsearch_domain" "my_elasticsearch_domain" {
     enforce_https = true
   }
 }`,
-			mustExcludeResultCode: checks.AWSUnenforcedHTTPSElasticsearchDomainEndpoint,
+			mustExcludeResultCode: aws.AWSUnenforcedHTTPSElasticsearchDomainEndpoint,
 		},
 	}
 
diff --git a/internal/app/tfsec/azurerm_open_network_security_rules_test.go b/internal/app/tfsec/azurerm_open_network_security_rules_test.go
index a7dc4dc59..4afc2cef0 100644
--- a/internal/app/tfsec/azurerm_open_network_security_rules_test.go
+++ b/internal/app/tfsec/azurerm_open_network_security_rules_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/azure"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AzureOpenNetworkSecurityGroupRule(t *testing.T) {
@@ -24,7 +23,7 @@ resource "azurerm_network_security_rule" "my-rule" {
 	source_address_prefix = "0.0.0.0/0"
 	access = "Allow"
 }`,
-			mustIncludeResultCode: checks.AzureOpenInboundNetworkSecurityGroupRule,
+			mustIncludeResultCode: azure.AzureOpenInboundNetworkSecurityGroupRule,
 		},
 		{
 			name: "check azurerm_network_security_rule inbound on *",
@@ -34,7 +33,7 @@ resource "azurerm_network_security_rule" "my-rule" {
 	source_address_prefix = "*"
 	access = "Allow"
 }`,
-			mustIncludeResultCode: checks.AzureOpenInboundNetworkSecurityGroupRule,
+			mustIncludeResultCode: azure.AzureOpenInboundNetworkSecurityGroupRule,
 		},
 		{
 			name: "check azurerm_network_security_rule inbound on 0.0.0.0/0 in list",
@@ -44,7 +43,7 @@ resource "azurerm_network_security_rule" "my-rule" {
 	source_address_prefixes = ["0.0.0.0/0"]
 	access = "Allow"
 }`,
-			mustIncludeResultCode: checks.AzureOpenInboundNetworkSecurityGroupRule,
+			mustIncludeResultCode: azure.AzureOpenInboundNetworkSecurityGroupRule,
 		},
 		{
 			name: "check azurerm_network_security_rule inbound on * in list",
@@ -54,7 +53,7 @@ resource "azurerm_network_security_rule" "my-rule" {
 	source_address_prefixes = ["*"]
 	access = "Allow"
 }`,
-			mustIncludeResultCode: checks.AzureOpenInboundNetworkSecurityGroupRule,
+			mustIncludeResultCode: azure.AzureOpenInboundNetworkSecurityGroupRule,
 		},
 		{
 			name: "check azurerm_network_security_rule outbound on 0.0.0.0/0",
@@ -64,7 +63,7 @@ resource "azurerm_network_security_rule" "my-rule" {
 	destination_address_prefix = "0.0.0.0/0"
 	access = "Allow"
 }`,
-			mustIncludeResultCode: checks.AzureOpenOutboundNetworkSecurityGroupRule,
+			mustIncludeResultCode: azure.AzureOpenOutboundNetworkSecurityGroupRule,
 		},
 		{
 			name: "check azurerm_network_security_rule outbound on 0.0.0.0/0 in list",
@@ -74,7 +73,7 @@ resource "azurerm_network_security_rule" "my-rule" {
 	destination_address_prefixes = ["0.0.0.0/0"]
 	access = "Allow"
 }`,
-			mustIncludeResultCode: checks.AzureOpenOutboundNetworkSecurityGroupRule,
+			mustIncludeResultCode: azure.AzureOpenOutboundNetworkSecurityGroupRule,
 		},
 		{
 			name: "check azurerm_network_security_rule outbound on 10.0.0.0/16",
@@ -84,7 +83,7 @@ resource "azurerm_network_security_rule" "my-rule" {
 	destination_address_prefix = "10.0.0.0/16"
 	access = "Allow"
 }`,
-			mustExcludeResultCode: checks.AzureOpenOutboundNetworkSecurityGroupRule,
+			mustExcludeResultCode: azure.AzureOpenOutboundNetworkSecurityGroupRule,
 		},
 		{
 			name: "check azurerm_network_security_rule inbound on 0.0.0.0/0",
@@ -94,7 +93,7 @@ resource "azurerm_network_security_rule" "my-rule" {
 	source_address_prefix = "0.0.0.0/0"
 	access = "Deny"
 }`,
-			mustExcludeResultCode: checks.AzureOpenInboundNetworkSecurityGroupRule,
+			mustExcludeResultCode: azure.AzureOpenInboundNetworkSecurityGroupRule,
 		},
 	}
 
diff --git a/internal/app/tfsec/azurerm_unencrypted_data_lake_store_test.go b/internal/app/tfsec/azurerm_unencrypted_data_lake_store_test.go
index 8c3cca827..75de24d14 100644
--- a/internal/app/tfsec/azurerm_unencrypted_data_lake_store_test.go
+++ b/internal/app/tfsec/azurerm_unencrypted_data_lake_store_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/azure"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AzureUnencryptedDataLakeStore(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AzureUnencryptedDataLakeStore(t *testing.T) {
 resource "azurerm_data_lake_store" "my-lake-store" {
 	encryption_state = "Disabled"
 }`,
-			mustIncludeResultCode: checks.AzureUnencryptedDataLakeStore,
+			mustIncludeResultCode: azure.AzureUnencryptedDataLakeStore,
 		},
 		{
 			name: "check azurerm_data_lake_store with encryption enabled",
@@ -30,7 +29,7 @@ resource "azurerm_data_lake_store" "my-lake-store" {
 resource "azurerm_data_lake_store" "my-lake-store" {
 	encryption_state = "Enabled"
 }`,
-			mustExcludeResultCode: checks.AzureUnencryptedDataLakeStore,
+			mustExcludeResultCode: azure.AzureUnencryptedDataLakeStore,
 		},
 		{
 			name: "check azurerm_data_lake_store with encryption enabled by default",
@@ -38,7 +37,7 @@ resource "azurerm_data_lake_store" "my-lake-store" {
 resource "azurerm_data_lake_store" "my-lake-store" {
 	
 }`,
-			mustExcludeResultCode: checks.AzureUnencryptedDataLakeStore,
+			mustExcludeResultCode: azure.AzureUnencryptedDataLakeStore,
 		},
 	}
 
diff --git a/internal/app/tfsec/azurerm_unencrypted_managed_disk_test.go b/internal/app/tfsec/azurerm_unencrypted_managed_disk_test.go
index 8b19fd437..bac2494b2 100644
--- a/internal/app/tfsec/azurerm_unencrypted_managed_disk_test.go
+++ b/internal/app/tfsec/azurerm_unencrypted_managed_disk_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/azure"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AzureUnencryptedManagedDisk(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AzureUnencryptedManagedDisk(t *testing.T) {
 resource "azurerm_managed_disk" "my-disk" {
 	
 }`,
-			mustIncludeResultCode: checks.AzureUnencryptedManagedDisk,
+			mustIncludeResultCode: azure.AzureUnencryptedManagedDisk,
 		},
 		{
 			name: "check azurerm_managed_disk with encryption disabled",
@@ -32,7 +31,7 @@ resource "azurerm_managed_disk" "my-disk" {
 		enabled = false
 	}
 }`,
-			mustIncludeResultCode: checks.AzureUnencryptedManagedDisk,
+			mustIncludeResultCode: azure.AzureUnencryptedManagedDisk,
 		},
 		{
 			name: "check azurerm_managed_disk with encryption enabled",
@@ -42,7 +41,7 @@ resource "azurerm_managed_disk" "my-disk" {
 		enabled = true
 	}
 }`,
-			mustExcludeResultCode: checks.AzureUnencryptedManagedDisk,
+			mustExcludeResultCode: azure.AzureUnencryptedManagedDisk,
 		},
 	}
 
diff --git a/internal/app/tfsec/azurerm_virtual_machine_with_password_authentication_test.go b/internal/app/tfsec/azurerm_virtual_machine_with_password_authentication_test.go
index fb04756a9..aaba89618 100644
--- a/internal/app/tfsec/azurerm_virtual_machine_with_password_authentication_test.go
+++ b/internal/app/tfsec/azurerm_virtual_machine_with_password_authentication_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/azure"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AzureVMWithPasswordAuth(t *testing.T) {
@@ -24,7 +23,7 @@ resource "azurerm_virtual_machine" "my-disk" {
 		disable_password_authentication = false
 	}
 }`,
-			mustIncludeResultCode: checks.AzureVMWithPasswordAuthentication,
+			mustIncludeResultCode: azure.AzureVMWithPasswordAuthentication,
 		},
 		{
 			name: "check azurerm_virtual_machine without password auth",
@@ -34,7 +33,7 @@ resource "azurerm_virtual_machine" "my-disk" {
 		disable_password_authentication = true
 	}
 }`,
-			mustExcludeResultCode: checks.AzureVMWithPasswordAuthentication,
+			mustExcludeResultCode: azure.AzureVMWithPasswordAuthentication,
 		},
 	}
 
diff --git a/internal/app/tfsec/checks/utils_test.go b/internal/app/tfsec/checks/utils_test.go
index 4728c3e0f..eed1d5fbd 100644
--- a/internal/app/tfsec/checks/utils_test.go
+++ b/internal/app/tfsec/checks/utils_test.go
@@ -48,7 +48,7 @@ func Test_isBooleanOrStringTrue(t *testing.T) {
 			},
 			nil,
 		)
-		if result := isBooleanOrStringTrue(attr); result != test.result {
+		if result := IsBooleanOrStringTrue(attr); result != test.result {
 			t.Errorf("expected %v got %v\n", test.val, result)
 		}
 	}
diff --git a/internal/app/tfsec/generic_sensitive_attributes_test.go b/internal/app/tfsec/generic_sensitive_attributes_test.go
index 2a0e98290..89a2dd58a 100644
--- a/internal/app/tfsec/generic_sensitive_attributes_test.go
+++ b/internal/app/tfsec/generic_sensitive_attributes_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/general"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSSensitiveAttributes(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSSensitiveAttributes(t *testing.T) {
 resource "evil_corp" "virtual_machine" {
 	root_password = "secret"
 }`,
-			mustIncludeResultCode: checks.GenericSensitiveAttributes,
+			mustIncludeResultCode: general.GenericSensitiveAttributes,
 		},
 		{
 			name: "check non-sensitive local",
@@ -30,7 +29,7 @@ resource "evil_corp" "virtual_machine" {
 resource "evil_corp" "virtual_machine" {
 	memory = 512
 }`,
-			mustExcludeResultCode: checks.GenericSensitiveAttributes,
+			mustExcludeResultCode: general.GenericSensitiveAttributes,
 		},
 		{
 			name: "avoid false positive for aws_efs_file_system",
@@ -38,7 +37,7 @@ resource "evil_corp" "virtual_machine" {
 resource "aws_efs_file_system" "myfs" {
 	creation_token = "something"
 }`,
-			mustExcludeResultCode: checks.GenericSensitiveAttributes,
+			mustExcludeResultCode: general.GenericSensitiveAttributes,
 		},
 	}
 
diff --git a/internal/app/tfsec/generic_sensitive_locals_test.go b/internal/app/tfsec/generic_sensitive_locals_test.go
index c1e1cb6ce..1fe6e01d2 100644
--- a/internal/app/tfsec/generic_sensitive_locals_test.go
+++ b/internal/app/tfsec/generic_sensitive_locals_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/general"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSSensitiveLocals(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSSensitiveLocals(t *testing.T) {
 locals {
 	password = "secret"
 }`,
-			mustIncludeResultCode: checks.GenericSensitiveLocals,
+			mustIncludeResultCode: general.GenericSensitiveLocals,
 		},
 		{
 			name: "check non-sensitive local",
@@ -30,7 +29,7 @@ locals {
 locals {
 	something = "something"
 }`,
-			mustExcludeResultCode: checks.GenericSensitiveLocals,
+			mustExcludeResultCode: general.GenericSensitiveLocals,
 		},
 	}
 
diff --git a/internal/app/tfsec/generic_sensitive_variables_test.go b/internal/app/tfsec/generic_sensitive_variables_test.go
index e3401ae7d..a13e12ed2 100644
--- a/internal/app/tfsec/generic_sensitive_variables_test.go
+++ b/internal/app/tfsec/generic_sensitive_variables_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/general"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_AWSSensitiveVariables(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_AWSSensitiveVariables(t *testing.T) {
 variable "db_password" {
 	default = "something"
 }`,
-			mustIncludeResultCode: checks.GenericSensitiveVariables,
+			mustIncludeResultCode: general.GenericSensitiveVariables,
 		},
 		{
 			name: "check sensitive variable without value",
@@ -30,7 +29,7 @@ variable "db_password" {
 variable "db_password" {
 	default = ""
 }`,
-			mustExcludeResultCode: checks.GenericSensitiveVariables,
+			mustExcludeResultCode: general.GenericSensitiveVariables,
 		},
 	}
 
diff --git a/internal/app/tfsec/gke_abac_enabled_test.go b/internal/app/tfsec/gke_abac_enabled_test.go
index fa7c56728..d8a8b373d 100644
--- a/internal/app/tfsec/gke_abac_enabled_test.go
+++ b/internal/app/tfsec/gke_abac_enabled_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GkeAbacEnabled(t *testing.T) {
@@ -23,7 +22,7 @@ resource "google_container_cluster" "gke" {
 	enable_legacy_abac = "true"
 	
 }`,
-			mustIncludeResultCode: checks.GkeAbacEnabled,
+			mustIncludeResultCode: google.GkeAbacEnabled,
 		},
 	}
 
diff --git a/internal/app/tfsec/gke_enforce_psp_test.go b/internal/app/tfsec/gke_enforce_psp_test.go
index d569ed29c..ea247da30 100644
--- a/internal/app/tfsec/gke_enforce_psp_test.go
+++ b/internal/app/tfsec/gke_enforce_psp_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GkeEnforcePSPTest(t *testing.T) {
@@ -24,7 +23,7 @@ resource "google_container_cluster" "gke" {
     enabled = "false"
   }
 }`,
-			mustIncludeResultCode: checks.GkeEnforcePSP,
+			mustIncludeResultCode: google.GkeEnforcePSP,
 		},
 		{
 			name: "check google_container_cluster with pod_security_policy_config block not set",
@@ -32,7 +31,7 @@ resource "google_container_cluster" "gke" {
 resource "google_container_cluster" "gke" {
 
 }`,
-			mustIncludeResultCode: checks.GkeEnforcePSP,
+			mustIncludeResultCode: google.GkeEnforcePSP,
 		},
 		{
 			name: "check google_container_cluster with pod_security_policy_config.enabled set to true",
@@ -42,7 +41,7 @@ resource "google_container_cluster" "gke" {
     enabled = "true"
   }
 }`,
-			mustExcludeResultCode: checks.GkeEnforcePSP,
+			mustExcludeResultCode: google.GkeEnforcePSP,
 		},
 	}
 
diff --git a/internal/app/tfsec/gke_legacy_auth_enabled_test.go b/internal/app/tfsec/gke_legacy_auth_enabled_test.go
index 61d308414..e8f9488f5 100644
--- a/internal/app/tfsec/gke_legacy_auth_enabled_test.go
+++ b/internal/app/tfsec/gke_legacy_auth_enabled_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GkeLegacyAuthEnabled(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_GkeLegacyAuthEnabled(t *testing.T) {
 resource "google_container_cluster" "gke" {
 
 }`,
-			mustIncludeResultCode: checks.GkeLegacyAuthEnabled,
+			mustIncludeResultCode: google.GkeLegacyAuthEnabled,
 		},
 		{
 			name: "check google_container_cluster with master_auth static user/pass disabled",
@@ -33,7 +32,7 @@ resource "google_container_cluster" "gke" {
     password = ""
 	}
 }`,
-			mustExcludeResultCode: checks.GkeLegacyAuthEnabled,
+			mustExcludeResultCode: google.GkeLegacyAuthEnabled,
 		},
 		{
 			name: "check google_container_cluster with client cert enabled and master_auth static user/pass disabled",
@@ -47,7 +46,7 @@ resource "google_container_cluster" "gke" {
     }
 	}
 }`,
-			mustIncludeResultCode: checks.GkeLegacyAuthEnabled,
+			mustIncludeResultCode: google.GkeLegacyAuthEnabled,
 		},
 	}
 
diff --git a/internal/app/tfsec/gke_legacy_metadata_endpoints_test.go b/internal/app/tfsec/gke_legacy_metadata_endpoints_test.go
index ba20560eb..3d8bbede5 100644
--- a/internal/app/tfsec/gke_legacy_metadata_endpoints_test.go
+++ b/internal/app/tfsec/gke_legacy_metadata_endpoints_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GkeLegacyMetadataEndpoints(t *testing.T) {
@@ -24,7 +23,7 @@ resource "google_container_cluster" "gke" {
     disable-legacy-endpoints = false
   }
 }`,
-			mustIncludeResultCode: checks.GkeLegacyMetadataEndpoints,
+			mustIncludeResultCode: google.GkeLegacyMetadataEndpoints,
 		},
 		{
 			name: "check google_container_cluster with metadata.disable-legacy-endpoints set to true",
@@ -34,7 +33,7 @@ resource "google_container_cluster" "gke" {
     disable-legacy-endpoints = true
   }
 }`,
-			mustExcludeResultCode: checks.GkeLegacyMetadataEndpoints,
+			mustExcludeResultCode: google.GkeLegacyMetadataEndpoints,
 		},
 	}
 
diff --git a/internal/app/tfsec/gke_node_metadata_exposed_test.go b/internal/app/tfsec/gke_node_metadata_exposed_test.go
index f1a46411e..2397d4906 100644
--- a/internal/app/tfsec/gke_node_metadata_exposed_test.go
+++ b/internal/app/tfsec/gke_node_metadata_exposed_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GkeNodeMetadataExposed(t *testing.T) {
@@ -24,7 +23,7 @@ resource "google_container_cluster" "gke" {
 		node_metadata = "EXPOSE"
 		}
 }`,
-			mustIncludeResultCode: checks.GkeNodeMetadataExposed,
+			mustIncludeResultCode: google.GkeNodeMetadataExposed,
 		},
 		{
 			name: "check google_container_cluster with workload_metadata_config.node_metadata set to UNSPECIFIED",
@@ -34,7 +33,7 @@ resource "google_container_cluster" "gke" {
 		node_metadata = "UNSPECIFIED"
 		}
 }`,
-			mustIncludeResultCode: checks.GkeNodeMetadataExposed,
+			mustIncludeResultCode: google.GkeNodeMetadataExposed,
 		},
 	}
 
diff --git a/internal/app/tfsec/gke_shielded_nodes_disabled_test.go b/internal/app/tfsec/gke_shielded_nodes_disabled_test.go
index 0545c152a..999ade13a 100644
--- a/internal/app/tfsec/gke_shielded_nodes_disabled_test.go
+++ b/internal/app/tfsec/gke_shielded_nodes_disabled_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GkeShieldedNodesDisabled(t *testing.T) {
@@ -23,14 +22,14 @@ resource "google_container_cluster" "gke" {
 	enable_shielded_nodes = "false"
 
 }`,
-			mustIncludeResultCode: checks.GkeShieldedNodesDisabled,
+			mustIncludeResultCode: google.GkeShieldedNodesDisabled,
 		},
 		{
 			name: "check google_container_cluster with enable_shielded_nodes not set",
 			source: `
 resource "google_container_cluster" "gke" {
 }`,
-			mustIncludeResultCode: checks.GkeShieldedNodesDisabled,
+			mustIncludeResultCode: google.GkeShieldedNodesDisabled,
 		},
 		{
 			name: "check google_container_cluster with enable_shielded_nodes set to true",
@@ -39,7 +38,7 @@ resource "google_container_cluster" "gke" {
 	enable_shielded_nodes = "true"
 
 }`,
-			mustExcludeResultCode: checks.GkeShieldedNodesDisabled,
+			mustExcludeResultCode: google.GkeShieldedNodesDisabled,
 		},
 	}
 
diff --git a/internal/app/tfsec/google_open_firewall_rule_test.go b/internal/app/tfsec/google_open_firewall_rule_test.go
index 36a087059..b1f19fedc 100644
--- a/internal/app/tfsec/google_open_firewall_rule_test.go
+++ b/internal/app/tfsec/google_open_firewall_rule_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GoogleOpenInboundFirewallRule(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_GoogleOpenInboundFirewallRule(t *testing.T) {
 resource "google_compute_firewall" "my-firewall" {
 	source_ranges = ["0.0.0.0/0"]
 }`,
-			mustIncludeResultCode: checks.GoogleOpenInboundFirewallRule,
+			mustIncludeResultCode: google.GoogleOpenInboundFirewallRule,
 		},
 		{
 			name: "check google_compute_firewall ingress on /32",
@@ -30,7 +29,7 @@ resource "google_compute_firewall" "my-firewall" {
 resource "google_compute_firewall" "my-firewall" {
 	source_ranges = ["1.2.3.4/32"]
 }`,
-			mustExcludeResultCode: checks.GoogleOpenInboundFirewallRule,
+			mustExcludeResultCode: google.GoogleOpenInboundFirewallRule,
 		},
 	}
 
@@ -57,7 +56,7 @@ func Test_GoogleOpenOutboundFirewallRule(t *testing.T) {
 resource "google_compute_firewall" "my-firewall" {
 	destination_ranges = ["0.0.0.0/0"]
 }`,
-			mustIncludeResultCode: checks.GoogleOpenOutboundFirewallRule,
+			mustIncludeResultCode: google.GoogleOpenOutboundFirewallRule,
 		},
 		{
 			name: "check google_compute_firewall egress on /32",
@@ -65,7 +64,7 @@ resource "google_compute_firewall" "my-firewall" {
 resource "google_compute_firewall" "my-firewall" {
 	destination_ranges = ["1.2.3.4/32"]
 }`,
-			mustExcludeResultCode: checks.GoogleOpenOutboundFirewallRule,
+			mustExcludeResultCode: google.GoogleOpenOutboundFirewallRule,
 		},
 	}
 
diff --git a/internal/app/tfsec/google_unencrypted_disk_test.go b/internal/app/tfsec/google_unencrypted_disk_test.go
index 738bf9450..a4fcc509b 100644
--- a/internal/app/tfsec/google_unencrypted_disk_test.go
+++ b/internal/app/tfsec/google_unencrypted_disk_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GoogleUnencryptedDisk(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_GoogleUnencryptedDisk(t *testing.T) {
 resource "google_compute_disk" "my-disk" {
 	
 }`,
-			mustIncludeResultCode: checks.GoogleUnencryptedDisk,
+			mustIncludeResultCode: google.GoogleUnencryptedDisk,
 		},
 		{
 			name: "check google_compute_disk with empty disk_encryption_key block",
@@ -30,7 +29,7 @@ resource "google_compute_disk" "my-disk" {
 resource "google_compute_disk" "my-disk" {
 	disk_encryption_key {}
 }`,
-			mustIncludeResultCode: checks.GoogleUnencryptedDisk,
+			mustIncludeResultCode: google.GoogleUnencryptedDisk,
 		},
 		{
 			name: "check google_compute_disk with raw key encryption",
@@ -40,7 +39,7 @@ resource "google_compute_disk" "my-disk" {
 		raw_key = "something"
 	}
 }`,
-			mustExcludeResultCode: checks.GoogleUnencryptedDisk,
+			mustExcludeResultCode: google.GoogleUnencryptedDisk,
 		},
 		{
 			name: "check google_compute_disk with kms link",
@@ -50,7 +49,7 @@ resource "google_compute_disk" "my-disk" {
 		kms_key_self_link = "something"
 	}
 }`,
-			mustExcludeResultCode: checks.GoogleUnencryptedDisk,
+			mustExcludeResultCode: google.GoogleUnencryptedDisk,
 		},
 	}
 
diff --git a/internal/app/tfsec/google_unencrypted_storage_bucket_test.go b/internal/app/tfsec/google_unencrypted_storage_bucket_test.go
index 1f18255c6..6f8b28db7 100644
--- a/internal/app/tfsec/google_unencrypted_storage_bucket_test.go
+++ b/internal/app/tfsec/google_unencrypted_storage_bucket_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GoogleUnencryptedStorageBucket(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_GoogleUnencryptedStorageBucket(t *testing.T) {
 resource "google_storage_bucket" "my-bucket" {
 	
 }`,
-			mustIncludeResultCode: checks.GoogleUnencryptedStorageBucket,
+			mustIncludeResultCode: google.GoogleUnencryptedStorageBucket,
 		},
 		{
 			name: "check google_storage_bucket with no encryption kms key name",
@@ -30,7 +29,7 @@ resource "google_storage_bucket" "my-bucket" {
 resource "google_storage_bucket" "my-bucket" {
 	encryption {}	
 }`,
-			mustExcludeResultCode: checks.GoogleUnencryptedStorageBucket,
+			mustExcludeResultCode: google.GoogleUnencryptedStorageBucket,
 		},
 		{
 			name: "check google_storage_bucket with non-empty encryption kms key name",
@@ -40,7 +39,7 @@ resource "google_storage_bucket" "my-bucket" {
 		default_kms_key_name = "my-key"
 	}	
 }`,
-			mustExcludeResultCode: checks.GoogleUnencryptedStorageBucket,
+			mustExcludeResultCode: google.GoogleUnencryptedStorageBucket,
 		},
 	}
 
diff --git a/internal/app/tfsec/google_user_iam_grant_test.go b/internal/app/tfsec/google_user_iam_grant_test.go
index 158c75d3f..8664b3650 100644
--- a/internal/app/tfsec/google_user_iam_grant_test.go
+++ b/internal/app/tfsec/google_user_iam_grant_test.go
@@ -3,9 +3,8 @@ package tfsec
 import (
 	"testing"
 
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks/google"
 	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
-
-	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
 )
 
 func Test_GoogleUserIAMGrant(t *testing.T) {
@@ -24,7 +23,7 @@ resource "google_project_iam_binding" "project-binding" {
 		"user:test@example.com",
 		]
 }`,
-			mustIncludeResultCode: checks.GoogleUserIAMGrant,
+			mustIncludeResultCode: google.GoogleUserIAMGrant,
 		},
 		{
 			name: "check google_project_iam_binding with grant to user identity",
@@ -34,7 +33,7 @@ resource "google_project_iam_binding" "project-binding" {
 		"group:test@example.com",
 		]
 }`,
-			mustExcludeResultCode: checks.GoogleUserIAMGrant,
+			mustExcludeResultCode: google.GoogleUserIAMGrant,
 		},
 		{
 			name: "check google_project_iam_member with grant to user identity",
@@ -42,7 +41,7 @@ resource "google_project_iam_binding" "project-binding" {
 resource "google_project_iam_member" "project-member" {
 	member = "user:test@example.com"
 }`,
-			mustIncludeResultCode: checks.GoogleUserIAMGrant,
+			mustIncludeResultCode: google.GoogleUserIAMGrant,
 		},
 		{
 			name: "check google_storage_bucket_iam_binding with grant to user identity",
@@ -52,7 +51,7 @@ resource "google_storage_bucket_iam_binding" "bucket-binding" {
 		"user:test@example.com",
 		]
 }`,
-			mustIncludeResultCode: checks.GoogleUserIAMGrant,
+			mustIncludeResultCode: google.GoogleUserIAMGrant,
 		},
 		{
 			name: "check google_storage_bucket_iam_member with grant to user identity",
@@ -60,7 +59,7 @@ resource "google_storage_bucket_iam_binding" "bucket-binding" {
 resource "google_storage_bucket_iam_member" "bucket-member" {
 	member = "user:test@example.com"
 }`,
-			mustIncludeResultCode: checks.GoogleUserIAMGrant,
+			mustIncludeResultCode: google.GoogleUserIAMGrant,
 		},
 		{
 			name: "check google_storage_bucket_iam_member with grant to service account identity",
@@ -68,7 +67,7 @@ resource "google_storage_bucket_iam_member" "bucket-member" {
 resource "google_storage_bucket_iam_member" "bucket-member" {
 	member = "serviceAccount:test@example.com"
 }`,
-			mustExcludeResultCode: checks.GoogleUserIAMGrant,
+			mustExcludeResultCode: google.GoogleUserIAMGrant,
 		},
 		{
 			name: "check data.google_iam_policy with grant to user",
@@ -81,7 +80,7 @@ data "google_iam_policy" "test-policy" {
 		]
 	}
 }`,
-			mustIncludeResultCode: checks.GoogleUserIAMGrant,
+			mustIncludeResultCode: google.GoogleUserIAMGrant,
 		},
 	}