Repository: bridgecrewio/checkov

Issue:
Add new check: ECS ensure container insights is enabled 
https://www.terraform.io/docs/providers/aws/r/ecs_cluster.html
ClusterSettings: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-cluster.html#cfn-ecs-cluster-clustersettings

	https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-cluster-clustersetting.html

Discussion:

Patch:
diff --git a/HomebrewFormula/checkov.rb b/HomebrewFormula/checkov.rb
index 9bc8c3dbb..d9063232a 100644
--- a/HomebrewFormula/checkov.rb
+++ b/HomebrewFormula/checkov.rb
@@ -3,8 +3,8 @@ class Checkov < Formula
 
   desc "Shiny new formula"
   homepage "https://github.com/bridgecrewio/checkov"
-  url "https://files.pythonhosted.org/packages/39/95/ec3974401fd2ad984915cd0d4c9905aedc541a08757101d1bb8189fd2266/checkov-1.0.314.tar.gz"
-  sha256 "ed5cc0ee3ee0151a761366949b8d209f475887c752323eed7c25c4652d48e6ee"
+  url "https://files.pythonhosted.org/packages/d9/f2/63baae6e6040b7568b6e6f7fb035730fc518fc68c3d909627c641aa352e8/checkov-1.0.316.tar.gz"
+  sha256 "934f14cec79bec2bf4d952ce6916bc99580cad39f8d4ba1269c1e2676ea1d040"
 
   depends_on "python3"
 
diff --git a/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py b/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py
new file mode 100644
index 000000000..683db2a89
--- /dev/null
+++ b/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py
@@ -0,0 +1,27 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class ECSClusterContainerInsights(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure container insights are enabled on ECS cluster"
+        id = "CKV_AWS_65"
+        supported_resources = ['AWS::ECS::Cluster']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        """
+            Looks for container insights configuration on ECS cluster:
+            https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-cluster.html#cfn-ecs-cluster-clustersettings
+        :param conf: AWS::ECS::Cluster configuration
+        :return: <CheckResult>
+        """
+        if 'Properties' in conf.keys():
+            if 'ClusterSettings' in conf['Properties'].keys():
+                for setting in conf['Properties']['ClusterSettings']:
+                    if setting['Name'] == 'containerInsights' and setting['Value'] == 'enabled':
+                        return CheckResult.PASSED
+        return CheckResult.FAILED
+
+check = ECSClusterContainerInsights()
diff --git a/checkov/cloudformation/checks/resource/aws/RDSEncryption.py b/checkov/cloudformation/checks/resource/aws/RDSEncryption.py
new file mode 100644
index 000000000..49aa1d638
--- /dev/null
+++ b/checkov/cloudformation/checks/resource/aws/RDSEncryption.py
@@ -0,0 +1,26 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class RDSEncryption(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure all data stored in the RDS is securely encrypted at rest"
+        id = "CKV_AWS_16"
+        supported_resources = ['AWS::RDS::DBInstance']
+        categories = [CheckCategories.ENCRYPTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        """
+            Looks for encryption configuration on RDS instance:
+            https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html
+        :param conf: AWS::RDS::DBInstance configuration
+        :return: <CheckResult>
+        """
+        if 'Properties' in conf.keys():
+            if 'StorageEncrypted' in conf['Properties'].keys():
+                if conf['Properties']['StorageEncrypted'] == True:
+                    return CheckResult.PASSED
+        return CheckResult.FAILED
+
+check = RDSEncryption()
diff --git a/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py b/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py
new file mode 100644
index 000000000..f3851aa5a
--- /dev/null
+++ b/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py
@@ -0,0 +1,26 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class RDSPubliclyAccessible(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure all data stored in the RDS bucket is not public accessible"
+        id = "CKV_AWS_17"
+        supported_resources = ['AWS::RDS::DBInstance']
+        categories = [CheckCategories.NETWORKING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        """
+            Looks for publicy accessible configuration on RDS instance:
+            https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html
+        :param conf: AWS::RDS::DBInstance configuration
+        :return: <CheckResult>
+        """
+        if 'Properties' in conf.keys():
+            if 'PubliclyAccessible' in conf['Properties'].keys():
+                if conf['Properties']['PubliclyAccessible'] == True:
+                    return CheckResult.FAILED
+        return CheckResult.PASSED
+
+check = RDSPubliclyAccessible()
diff --git a/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py b/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py
new file mode 100644
index 000000000..f59004c91
--- /dev/null
+++ b/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py
@@ -0,0 +1,26 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class RedshiftClusterEncryption(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure all data stored in the Redshift cluster is securely encrypted at rest"
+        id = "CKV_AWS_64"
+        supported_resources = ['AWS::Redshift::Cluster']
+        categories = [CheckCategories.ENCRYPTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        """
+            Looks for encryption configuration at Redshift cluster:
+            https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-redshift-cluster.html
+        :param conf: AWS::Redshift::Cluster configuration
+        :return: <CheckResult>
+        """
+        if 'Properties' in conf.keys():
+            if 'Encrypted' in conf['Properties'].keys():
+                if conf['Properties']['Encrypted'] == True:
+                    return CheckResult.PASSED
+        return CheckResult.FAILED
+
+check = RedshiftClusterEncryption()
diff --git a/checkov/common/bridgecrew/platform_errors.py b/checkov/common/bridgecrew/platform_errors.py
new file mode 100644
index 000000000..a5b61c328
--- /dev/null
+++ b/checkov/common/bridgecrew/platform_errors.py
@@ -0,0 +1,6 @@
+class BridgecrewAuthError(Exception):
+    def __init__(self):
+        self.message = "Authorization error accessing Bridgecrew.cloud api. Please check bc-api-key"
+
+    def __str__(self):
+        return 'BCAuthError, {0} '.format(self.message)
diff --git a/checkov/common/bridgecrew/platform_integration.py b/checkov/common/bridgecrew/platform_integration.py
index 2c74d4d78..5e5e651c6 100644
--- a/checkov/common/bridgecrew/platform_integration.py
+++ b/checkov/common/bridgecrew/platform_integration.py
@@ -8,10 +8,14 @@ from urllib3.exceptions import HTTPError
 from botocore.exceptions import ClientError
 from json import JSONDecodeError
 import dpath.util
+
+from checkov.common.bridgecrew.platform_errors import BridgecrewAuthError
 from checkov.common.models.consts import SUPPORTED_FILE_EXTENSIONS
 from .wrapper import reduce_scan_reports, persist_checks_results, enrich_and_persist_checks_metadata
 import os
 
+UNAUTHORIZED_MESSAGE = 'User is not authorized to access this resource with an explicit deny'
+
 logging.basicConfig(level=logging.INFO)
 # define a Handler which writes INFO messages or higher to the sys.stderr
 console = logging.StreamHandler()
@@ -50,6 +54,9 @@ class BcPlatformIntegration(object):
             request = http.request("POST", INTEGRATIONS_API_URL, body=json.dumps({"repoId": repo_id}),
                                    headers={"Authorization": bc_api_key, "Content-Type": "application/json"})
             response = json.loads(request.data.decode("utf8"))
+            if 'Message' in response:
+                if response['Message'] == UNAUTHORIZED_MESSAGE:
+                    raise BridgecrewAuthError()
             repo_full_path = response["path"]
             self.bucket, self.repo_path = repo_full_path.split("/", 1)
             self.timestamp = self.repo_path.split("/")[-1]
diff --git a/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py b/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py
new file mode 100644
index 000000000..87c47a193
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py
@@ -0,0 +1,24 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck
+
+
+class ECSClusterContainerInsights(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure container insights are enabled on ECS cluster"
+        id = "CKV_AWS_65"
+        supported_resources = ['aws_ecs_cluster']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        print(conf)
+        if 'setting' in conf.keys():
+            setting_conf = conf['setting']
+            for setting in setting_conf:
+                print(setting)
+                if setting['name'] == ['containerInsights'] and setting['value'] == ['enabled']:
+                    return CheckResult.PASSED
+        return CheckResult.FAILED
+
+
+check = ECSClusterContainerInsights()
diff --git a/checkov/terraform/checks/resource/aws/RedshiftClusterEncryption.py b/checkov/terraform/checks/resource/aws/RedshiftClusterEncryption.py
new file mode 100644
index 000000000..6e78b79dd
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/RedshiftClusterEncryption.py
@@ -0,0 +1,17 @@
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+from checkov.common.models.enums import CheckCategories
+
+
+class RedshiftClusterEncryption(BaseResourceValueCheck):
+    def __init__(self):
+        name = "Ensure all data stored in the Redshift cluster is securely encrypted at rest"
+        id = "CKV_AWS_64"
+        supported_resources = ['aws_redshift_cluster']
+        categories = [CheckCategories.ENCRYPTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "encryption"
+
+
+check = RedshiftClusterEncryption()
diff --git a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
index 2e6e8cb2a..63d34cb75 100644
--- a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
+++ b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
@@ -1,8 +1,9 @@
-from checkov.common.models.enums import CheckResult, CheckCategories
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckCategories
+from checkov.common.models.consts import ANY_VALUE
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
-class AKSApiServerAuthorizedIpRanges(BaseResourceCheck):
+class AKSApiServerAuthorizedIpRanges(BaseResourceValueCheck):
     def __init__(self):
         name = "Ensure AKS has an API Server Authorized IP Ranges enabled"
         id = "CKV_AZURE_6"
@@ -10,10 +11,11 @@ class AKSApiServerAuthorizedIpRanges(BaseResourceCheck):
         categories = [CheckCategories.KUBERNETES]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
-        if len(conf.get('api_server_authorized_ip_ranges', [[]])[0]) > 0:
-            return CheckResult.PASSED
-        return CheckResult.FAILED
+    def get_inspected_key(self):
+        return 'api_server_authorized_ip_ranges/[0]/[0]'
+
+    def get_expected_value(self):
+        return ANY_VALUE
 
 
 check = AKSApiServerAuthorizedIpRanges()
diff --git a/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py b/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py
index bb1f76017..cba40062a 100644
--- a/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py
+++ b/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py
@@ -1,8 +1,9 @@
-from checkov.common.models.enums import CheckResult, CheckCategories
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckCategories
+from checkov.common.models.consts import ANY_VALUE
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
-class AKSNetworkPolicy(BaseResourceCheck):
+class AKSNetworkPolicy(BaseResourceValueCheck):
     def __init__(self):
         name = "Ensure AKS cluster has Network Policy configured"
         id = "CKV_AZURE_7"
@@ -10,10 +11,11 @@ class AKSNetworkPolicy(BaseResourceCheck):
         categories = [CheckCategories.KUBERNETES]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
-        if 'network_profile' in conf and conf['network_profile'][0].get('network_policy'):
-            return CheckResult.PASSED
-        return CheckResult.FAILED
+    def get_inspected_key(self):
+        return 'network_profile/[0]/network_policy'
+
+    def get_expected_value(self):
+        return ANY_VALUE
 
 
 check = AKSNetworkPolicy()
diff --git a/checkov/terraform/checks/resource/azure/AKSRbacEnabled.py b/checkov/terraform/checks/resource/azure/AKSRbacEnabled.py
index 49f8bb707..34ce00295 100644
--- a/checkov/terraform/checks/resource/azure/AKSRbacEnabled.py
+++ b/checkov/terraform/checks/resource/azure/AKSRbacEnabled.py
@@ -1,8 +1,8 @@
-from checkov.common.models.enums import CheckResult, CheckCategories
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
-class AKSRbacEnabled(BaseResourceCheck):
+class AKSRbacEnabled(BaseResourceValueCheck):
     def __init__(self):
         name = "Ensure RBAC is enabled on AKS clusters"
         id = "CKV_AZURE_5"
@@ -10,10 +10,8 @@ class AKSRbacEnabled(BaseResourceCheck):
         categories = [CheckCategories.KUBERNETES]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
-        if 'role_based_access_control' not in conf or conf['role_based_access_control'][0]['enabled'][0]:
-            return CheckResult.PASSED
-        return CheckResult.FAILED
+    def get_inspected_key(self):
+        return 'role_based_access_control/[0]/enabled/[0]'
 
 
 check = AKSRbacEnabled()
diff --git a/checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py b/checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py
index 404bb0593..676c2ed66 100644
--- a/checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py
+++ b/checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py
@@ -1,8 +1,8 @@
-from checkov.common.models.enums import CheckResult, CheckCategories
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
-class StorageAccountsTransportEncryption(BaseResourceCheck):
+class StorageAccountsTransportEncryption(BaseResourceValueCheck):
     def __init__(self):
         name = "Ensure that 'Secure transfer required' is set to 'Enabled'"
         id = "CKV_AZURE_3"
@@ -10,18 +10,8 @@ class StorageAccountsTransportEncryption(BaseResourceCheck):
         categories = [CheckCategories.ENCRYPTION]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
-        """
-            Looks for traffic encryption configuration at azurerm_storage_account:
-            https://www.terraform.io/docs/providers/azurerm/r/storage_account.html
-        :param conf: azure_instance configuration
-        :return: <CheckResult>
-        """
-        if 'enable_https_traffic_only' in conf.keys():
-            config = conf['enable_https_traffic_only'][0]
-            if config:
-                return CheckResult.PASSED
-        return CheckResult.FAILED
+    def get_inspected_key(self):
+        return 'enable_https_traffic_only'
 
 
 check = StorageAccountsTransportEncryption()
diff --git a/checkov/version.py b/checkov/version.py
index 2fea5e4c9..1f62c3c33 100644
--- a/checkov/version.py
+++ b/checkov/version.py
@@ -1,1 +1,1 @@
-version = '1.0.314'
+version = '1.0.317'
diff --git a/docs/3.Scans/resource-scans.md b/docs/3.Scans/resource-scans.md
index 593dd3f8a..2bc760475 100644
--- a/docs/3.Scans/resource-scans.md
+++ b/docs/3.Scans/resource-scans.md
@@ -8,283 +8,287 @@ nav_order: 1
 
 |     | Id          | Type              | Entity                                | Policy                                                                                                                                                                                                   | IaC            |
 |-----|-------------|-------------------|---------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|
-|   0 | CKV_AWS_42  | resource          | aws_efs_file_system                   | Ensure EFS is securely encrypted                                                                                                                                                                         | Terraform      |
-|   1 | CKV_AWS_47  | resource          | aws_dax_cluster                       | Ensure DAX is encrypted at rest (default is unencrypted)                                                                                                                                                 | Terraform      |
-|   2 | CKV_AWS_33  | resource          | aws_ecr_repository                    | Ensure ECR image scanning on push is enabled                                                                                                                                                             | Terraform      |
-|   3 | CKV_AWS_51  | resource          | aws_ecr_repository                    | Ensure ECR Image Tags are immutable                                                                                                                                                                      | Terraform      |
-|   4 | CKV_AWS_56  | resource          | aws_s3_bucket_public_access_block     | Ensure S3 bucket has 'restrict_public_bucket' enabled                                                                                                                                                    | Terraform      |
-|   5 | CKV_AWS_54  | resource          | aws_s3_bucket_public_access_block     | Ensure S3 bucket has block public policy enabled                                                                                                                                                         | Terraform      |
-|   6 | CKV_AWS_55  | resource          | aws_s3_bucket_public_access_block     | Ensure S3 bucket has ignore public ACLs enabled                                                                                                                                                          | Terraform      |
-|   7 | CKV_AWS_53  | resource          | aws_s3_bucket_public_access_block     | Ensure S3 bucket has block public ACLS enabled                                                                                                                                                           | Terraform      |
-|   8 | CKV_AWS_38  | resource          | aws_eks_cluster                       | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0                                                                                                                                            | Terraform      |
-|   9 | CKV_AWS_37  | resource          | aws_eks_cluster                       | Ensure Amazon EKS control plane logging enabled for all log types                                                                                                                                        | Terraform      |
-|  10 | CKV_AWS_39  | resource          | aws_eks_cluster                       | Ensure Amazon EKS public endpoint disabled                                                                                                                                                               | Terraform      |
-|  11 | CKV_AWS_58  | resource          | aws_eks_cluster                       | Ensure EKS Cluster has Secrets Encryption Enabled                                                                                                                                                        | Terraform      |
-|  12 | CKV_AWS_8   | resource          | aws_launch_configuration              | Ensure all data stored in the Launch configuration EBS is securely encrypted                                                                                                                             | Terraform      |
-|  13 | CKV_AWS_8   | resource          | aws_instance                          | Ensure all data stored in the Launch configuration EBS is securely encrypted                                                                                                                             | Terraform      |
-|  14 | CKV_AWS_46  | resource          | aws_instance                          | Ensure no hard coded AWS access key and and secret key exists in EC2 user data                                                                                                                           | Terraform      |
-|  15 | CKV_AWS_61  | resource          | aws_iam_role                          | Ensure IAM role allows only specific principals in account to assume it                                                                                                                                  | Terraform      |
-|  16 | CKV_AWS_60  | resource          | aws_iam_role                          | Ensure IAM role allows only specific services or principals to assume it                                                                                                                                 | Terraform      |
-|  17 | CKV_AWS_62  | resource          | aws_iam_role_policy                   | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-|  18 | CKV_AWS_63  | resource          | aws_iam_role_policy                   | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
-|  19 | CKV_AWS_62  | resource          | aws_iam_user_policy                   | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-|  20 | CKV_AWS_40  | resource          | aws_iam_user_policy                   | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
-|  21 | CKV_AWS_63  | resource          | aws_iam_user_policy                   | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
-|  22 | CKV_AWS_62  | resource          | aws_iam_group_policy                  | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-|  23 | CKV_AWS_63  | resource          | aws_iam_group_policy                  | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
-|  24 | CKV_AWS_62  | resource          | aws_iam_policy                        | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-|  25 | CKV_AWS_63  | resource          | aws_iam_policy                        | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
-|  26 | CKV_AWS_21  | resource          | aws_s3_bucket                         | Ensure all data stored in the S3 bucket have versioning enabled                                                                                                                                          | Terraform      |
-|  27 | CKV_AWS_57  | resource          | aws_s3_bucket                         | S3 Bucket has an ACL defined which allows public WRITE access.                                                                                                                                           | Terraform      |
-|  28 | CKV_AWS_19  | resource          | aws_s3_bucket                         | Ensure all data stored in the S3 bucket is securely encrypted at rest                                                                                                                                    | Terraform      |
-|  29 | CKV_AWS_52  | resource          | aws_s3_bucket                         | Ensure S3 bucket has MFA delete enabled                                                                                                                                                                  | Terraform      |
-|  30 | CKV_AWS_18  | resource          | aws_s3_bucket                         | Ensure the S3 bucket has access logging enabled                                                                                                                                                          | Terraform      |
-|  31 | CKV_AWS_20  | resource          | aws_s3_bucket                         | S3 Bucket has an ACL defined which allows public READ access.                                                                                                                                            | Terraform      |
-|  32 | CKV_AWS_24  | resource          | aws_security_group                    | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22                                                                                                                                        | Terraform      |
-|  33 | CKV_AWS_23  | resource          | aws_security_group                    | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
-|  34 | CKV_AWS_25  | resource          | aws_security_group                    | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389                                                                                                                                      | Terraform      |
-|  35 | CKV_AWS_13  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy prevents password reuse                                                                                                                                                       | Terraform      |
-|  36 | CKV_AWS_9   | resource          | aws_iam_account_password_policy       | Ensure IAM password policy expires passwords within 90 days or less                                                                                                                                      | Terraform      |
-|  37 | CKV_AWS_11  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires at least one lowercase letter                                                                                                                                        | Terraform      |
-|  38 | CKV_AWS_10  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires minimum length of 14 or greater                                                                                                                                      | Terraform      |
-|  39 | CKV_AWS_14  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires at least one symbol                                                                                                                                                  | Terraform      |
-|  40 | CKV_AWS_12  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires at least one number                                                                                                                                                  | Terraform      |
-|  41 | CKV_AWS_15  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires at least one uppercase letter                                                                                                                                        | Terraform      |
-|  42 | CKV_AWS_45  | resource          | aws_lambda_function                   | Ensure no hard coded AWS access key and and secret key exists in lambda environment                                                                                                                      | Terraform      |
-|  43 | CKV_AWS_50  | resource          | aws_lambda_function                   | X-ray tracing is enabled for Lambda                                                                                                                                                                      | Terraform      |
-|  44 | CKV_AWS_22  | resource          | aws_sagemaker_notebook_instance       | Ensure all data stored in the Sagemaker is securely encrypted at rest                                                                                                                                    | Terraform      |
-|  45 | CKV_AWS_29  | resource          | aws_elasticache_replication_group     | Ensure all data stored in the Elasticache Replication Group  is securely encrypted at rest                                                                                                               | Terraform      |
-|  46 | CKV_AWS_31  | resource          | aws_elasticache_replication_group     | Ensure all data stored in the Elasticache Replication Group  is securely encrypted at transit and has auth token                                                                                         | Terraform      |
-|  47 | CKV_AWS_30  | resource          | aws_elasticache_replication_group     | Ensure all data stored in the Elasticache Replication Group  is securely encrypted at transit                                                                                                            | Terraform      |
-|  48 | CKV_AWS_27  | resource          | aws_sqs_queue                         | Ensure all data stored in the SQS queue is encrypted                                                                                                                                                     | Terraform      |
-|  49 | CKV_AWS_23  | resource          | aws_security_group_rule               | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
-|  50 | CKV_AWS_23  | resource          | aws_db_security_group                 | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
-|  51 | CKV_AWS_23  | resource          | aws_elasticache_security_group        | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
-|  52 | CKV_AWS_23  | resource          | aws_redshift_security_group           | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
-|  53 | CKV_AWS_32  | resource          | aws_ecr_repository_policy             | Ensure ECR policy is not set to public                                                                                                                                                                   | Terraform      |
-|  54 | CKV_AWS_7   | resource          | aws_kms_key                           | Ensure rotation for customer created CMKs is enabled                                                                                                                                                     | Terraform      |
-|  55 | CKV_AWS_28  | resource          | aws_dynamodb_table                    | Ensure Dynamodb point in time recovery (backup) is enabled                                                                                                                                               | Terraform      |
-|  56 | CKV_AWS_44  | resource          | aws_neptune_cluster                   | Ensure Neptune storage is securely encrypted                                                                                                                                                             | Terraform      |
-|  57 | CKV_AWS_17  | resource          | aws_db_instance                       | Ensure all data stored in the RDS bucket is not public accessible                                                                                                                                        | Terraform      |
-|  58 | CKV_AWS_16  | resource          | aws_db_instance                       | Ensure all data stored in the RDS is securely encrypted at rest                                                                                                                                          | Terraform      |
-|  59 | CKV_AWS_17  | resource          | aws_rds_cluster_instance              | Ensure all data stored in the RDS bucket is not public accessible                                                                                                                                        | Terraform      |
-|  60 | CKV_AWS_6   | resource          | aws_elasticsearch_domain              | Ensure all Elasticsearch has node-to-node encryption enabled                                                                                                                                             | Terraform      |
-|  61 | CKV_AWS_5   | resource          | aws_elasticsearch_domain              | Ensure all data stored in the Elasticsearch is securely encrypted at rest                                                                                                                                | Terraform      |
-|  62 | CKV_AWS_40  | resource          | aws_iam_user_policy_attachment        | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
-|  63 | CKV_AWS_40  | resource          | aws_iam_policy_attachment             | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
-|  64 | CKV_AWS_43  | resource          | aws_kinesis_stream                    | Ensure Kinesis Stream is securely encrypted                                                                                                                                                              | Terraform      |
-|  65 | CKV_AWS_26  | resource          | aws_sns_topic                         | Ensure all data stored in the SNS topic is encrypted                                                                                                                                                     | Terraform      |
-|  66 | CKV_AWS_59  | resource          | aws_api_gateway_method                | Ensure there is no open access to back-end resources through API                                                                                                                                         | Terraform      |
-|  67 | CKV_AWS_35  | resource          | aws_cloudtrail                        | Ensure CloudTrail logs are encrypted at rest using KMS CMKs                                                                                                                                              | Terraform      |
-|  68 | CKV_AWS_36  | resource          | aws_cloudtrail                        | Ensure CloudTrail log file validation is enabled                                                                                                                                                         | Terraform      |
-|  69 | CKV_AWS_48  | resource          | aws_mq_broker                         | Ensure MQ Broker logging is enabled                                                                                                                                                                      | Terraform      |
-|  70 | CKV_AWS_2   | resource          | aws_alb_listener                      | Ensure ALB protocol is HTTPS                                                                                                                                                                             | Terraform      |
-|  71 | CKV_AWS_2   | resource          | aws_lb_listener                       | Ensure ALB protocol is HTTPS                                                                                                                                                                             | Terraform      |
-|  72 | CKV_AWS_3   | resource          | aws_ebs_volume                        | Ensure all data stored in the EBS is securely encrypted                                                                                                                                                  | Terraform      |
-|  73 | CKV_AWS_34  | resource          | aws_cloudfront_distribution           | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS                                                                                                                                      | Terraform      |
-|  74 | CKV_AWS_4   | resource          | aws_ebs_snapshot                      | Ensure all data stored in the EBS Snapshot is securely encrypted                                                                                                                                         | Terraform      |
-|  75 | CKV_GCP_21  | resource          | google_container_cluster              | Ensure Kubernetes Clusters are configured with Labels                                                                                                                                                    | Terraform      |
-|  76 | CKV_GCP_12  | resource          | google_container_cluster              | Ensure Network Policy is enabled on Kubernetes Engine Clusters                                                                                                                                           | Terraform      |
-|  77 | CKV_GCP_18  | resource          | google_container_cluster              | Ensure GKE Control Plane is not public                                                                                                                                                                   | Terraform      |
-|  78 | CKV_GCP_20  | resource          | google_container_cluster              | Ensure master authorized networks is set to enabled in GKE clusters                                                                                                                                      | Terraform      |
-|  79 | CKV_GCP_19  | resource          | google_container_cluster              | Ensure GKE basic auth is disabled                                                                                                                                                                        | Terraform      |
-|  80 | CKV_GCP_8   | resource          | google_container_cluster              | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters                                                                                                                            | Terraform      |
-|  81 | CKV_GCP_24  | resource          | google_container_cluster              | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters                                                                                                                         | Terraform      |
-|  82 | CKV_GCP_1   | resource          | google_container_cluster              | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters                                                                                                                               | Terraform      |
-|  83 | CKV_GCP_23  | resource          | google_container_cluster              | Ensure Kubernetes Cluster is created with Alias IP ranges enabled                                                                                                                                        | Terraform      |
+|   0 | CKV_AWS_21  | resource          | aws_s3_bucket                         | Ensure all data stored in the S3 bucket have versioning enabled                                                                                                                                          | Terraform      |
+|   1 | CKV_AWS_52  | resource          | aws_s3_bucket                         | Ensure S3 bucket has MFA delete enabled                                                                                                                                                                  | Terraform      |
+|   2 | CKV_AWS_19  | resource          | aws_s3_bucket                         | Ensure all data stored in the S3 bucket is securely encrypted at rest                                                                                                                                    | Terraform      |
+|   3 | CKV_AWS_20  | resource          | aws_s3_bucket                         | S3 Bucket has an ACL defined which allows public READ access.                                                                                                                                            | Terraform      |
+|   4 | CKV_AWS_18  | resource          | aws_s3_bucket                         | Ensure the S3 bucket has access logging enabled                                                                                                                                                          | Terraform      |
+|   5 | CKV_AWS_57  | resource          | aws_s3_bucket                         | S3 Bucket has an ACL defined which allows public WRITE access.                                                                                                                                           | Terraform      |
+|   6 | CKV_AWS_58  | resource          | aws_eks_cluster                       | Ensure EKS Cluster has Secrets Encryption Enabled                                                                                                                                                        | Terraform      |
+|   7 | CKV_AWS_38  | resource          | aws_eks_cluster                       | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0                                                                                                                                            | Terraform      |
+|   8 | CKV_AWS_37  | resource          | aws_eks_cluster                       | Ensure Amazon EKS control plane logging enabled for all log types                                                                                                                                        | Terraform      |
+|   9 | CKV_AWS_39  | resource          | aws_eks_cluster                       | Ensure Amazon EKS public endpoint disabled                                                                                                                                                               | Terraform      |
+|  10 | CKV_AWS_15  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires at least one uppercase letter                                                                                                                                        | Terraform      |
+|  11 | CKV_AWS_12  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires at least one number                                                                                                                                                  | Terraform      |
+|  12 | CKV_AWS_13  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy prevents password reuse                                                                                                                                                       | Terraform      |
+|  13 | CKV_AWS_9   | resource          | aws_iam_account_password_policy       | Ensure IAM password policy expires passwords within 90 days or less                                                                                                                                      | Terraform      |
+|  14 | CKV_AWS_10  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires minimum length of 14 or greater                                                                                                                                      | Terraform      |
+|  15 | CKV_AWS_14  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires at least one symbol                                                                                                                                                  | Terraform      |
+|  16 | CKV_AWS_11  | resource          | aws_iam_account_password_policy       | Ensure IAM password policy requires at least one lowercase letter                                                                                                                                        | Terraform      |
+|  17 | CKV_AWS_25  | resource          | aws_security_group                    | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389                                                                                                                                      | Terraform      |
+|  18 | CKV_AWS_23  | resource          | aws_security_group                    | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
+|  19 | CKV_AWS_24  | resource          | aws_security_group                    | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22                                                                                                                                        | Terraform      |
+|  20 | CKV_AWS_51  | resource          | aws_ecr_repository                    | Ensure ECR Image Tags are immutable                                                                                                                                                                      | Terraform      |
+|  21 | CKV_AWS_33  | resource          | aws_ecr_repository                    | Ensure ECR image scanning on push is enabled                                                                                                                                                             | Terraform      |
+|  22 | CKV_AWS_50  | resource          | aws_lambda_function                   | X-ray tracing is enabled for Lambda                                                                                                                                                                      | Terraform      |
+|  23 | CKV_AWS_45  | resource          | aws_lambda_function                   | Ensure no hard coded AWS access key and and secret key exists in lambda environment                                                                                                                      | Terraform      |
+|  24 | CKV_AWS_47  | resource          | aws_dax_cluster                       | Ensure DAX is encrypted at rest (default is unencrypted)                                                                                                                                                 | Terraform      |
+|  25 | CKV_AWS_46  | resource          | aws_instance                          | Ensure no hard coded AWS access key and and secret key exists in EC2 user data                                                                                                                           | Terraform      |
+|  26 | CKV_AWS_8   | resource          | aws_instance                          | Ensure all data stored in the Launch configuration EBS is securely encrypted                                                                                                                             | Terraform      |
+|  27 | CKV_AWS_22  | resource          | aws_sagemaker_notebook_instance       | Ensure all data stored in the Sagemaker is securely encrypted at rest                                                                                                                                    | Terraform      |
+|  28 | CKV_AWS_36  | resource          | aws_cloudtrail                        | Ensure CloudTrail log file validation is enabled                                                                                                                                                         | Terraform      |
+|  29 | CKV_AWS_35  | resource          | aws_cloudtrail                        | Ensure CloudTrail logs are encrypted at rest using KMS CMKs                                                                                                                                              | Terraform      |
+|  30 | CKV_AWS_16  | resource          | aws_db_instance                       | Ensure all data stored in the RDS is securely encrypted at rest                                                                                                                                          | Terraform      |
+|  31 | CKV_AWS_17  | resource          | aws_db_instance                       | Ensure all data stored in the RDS bucket is not public accessible                                                                                                                                        | Terraform      |
+|  32 | CKV_AWS_28  | resource          | aws_dynamodb_table                    | Ensure Dynamodb point in time recovery (backup) is enabled                                                                                                                                               | Terraform      |
+|  33 | CKV_AWS_55  | resource          | aws_s3_bucket_public_access_block     | Ensure S3 bucket has ignore public ACLs enabled                                                                                                                                                          | Terraform      |
+|  34 | CKV_AWS_56  | resource          | aws_s3_bucket_public_access_block     | Ensure S3 bucket has 'restrict_public_bucket' enabled                                                                                                                                                    | Terraform      |
+|  35 | CKV_AWS_53  | resource          | aws_s3_bucket_public_access_block     | Ensure S3 bucket has block public ACLS enabled                                                                                                                                                           | Terraform      |
+|  36 | CKV_AWS_54  | resource          | aws_s3_bucket_public_access_block     | Ensure S3 bucket has block public policy enabled                                                                                                                                                         | Terraform      |
+|  37 | CKV_AWS_29  | resource          | aws_elasticache_replication_group     | Ensure all data stored in the Elasticache Replication Group  is securely encrypted at rest                                                                                                               | Terraform      |
+|  38 | CKV_AWS_31  | resource          | aws_elasticache_replication_group     | Ensure all data stored in the Elasticache Replication Group  is securely encrypted at transit and has auth token                                                                                         | Terraform      |
+|  39 | CKV_AWS_30  | resource          | aws_elasticache_replication_group     | Ensure all data stored in the Elasticache Replication Group  is securely encrypted at transit                                                                                                            | Terraform      |
+|  40 | CKV_AWS_3   | resource          | aws_ebs_volume                        | Ensure all data stored in the EBS is securely encrypted                                                                                                                                                  | Terraform      |
+|  41 | CKV_AWS_2   | resource          | aws_alb_listener                      | Ensure ALB protocol is HTTPS                                                                                                                                                                             | Terraform      |
+|  42 | CKV_AWS_2   | resource          | aws_lb_listener                       | Ensure ALB protocol is HTTPS                                                                                                                                                                             | Terraform      |
+|  43 | CKV_AWS_64  | resource          | aws_redshift_cluster                  | Ensure all data stored in the Redshift cluster is securely encrypted at rest                                                                                                                             | Terraform      |
+|  44 | CKV_AWS_23  | resource          | aws_security_group_rule               | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
+|  45 | CKV_AWS_23  | resource          | aws_db_security_group                 | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
+|  46 | CKV_AWS_23  | resource          | aws_elasticache_security_group        | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
+|  47 | CKV_AWS_23  | resource          | aws_redshift_security_group           | Ensure every security groups rule has a description                                                                                                                                                      | Terraform      |
+|  48 | CKV_AWS_42  | resource          | aws_efs_file_system                   | Ensure EFS is securely encrypted                                                                                                                                                                         | Terraform      |
+|  49 | CKV_AWS_48  | resource          | aws_mq_broker                         | Ensure MQ Broker logging is enabled                                                                                                                                                                      | Terraform      |
+|  50 | CKV_AWS_7   | resource          | aws_kms_key                           | Ensure rotation for customer created CMKs is enabled                                                                                                                                                     | Terraform      |
+|  51 | CKV_AWS_59  | resource          | aws_api_gateway_method                | Ensure there is no open access to back-end resources through API                                                                                                                                         | Terraform      |
+|  52 | CKV_AWS_5   | resource          | aws_elasticsearch_domain              | Ensure all data stored in the Elasticsearch is securely encrypted at rest                                                                                                                                | Terraform      |
+|  53 | CKV_AWS_6   | resource          | aws_elasticsearch_domain              | Ensure all Elasticsearch has node-to-node encryption enabled                                                                                                                                             | Terraform      |
+|  54 | CKV_AWS_34  | resource          | aws_cloudfront_distribution           | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS                                                                                                                                      | Terraform      |
+|  55 | CKV_AWS_61  | resource          | aws_iam_role                          | Ensure IAM role allows only specific principals in account to assume it                                                                                                                                  | Terraform      |
+|  56 | CKV_AWS_60  | resource          | aws_iam_role                          | Ensure IAM role allows only specific services or principals to assume it                                                                                                                                 | Terraform      |
+|  57 | CKV_AWS_4   | resource          | aws_ebs_snapshot                      | Ensure all data stored in the EBS Snapshot is securely encrypted                                                                                                                                         | Terraform      |
+|  58 | CKV_AWS_63  | resource          | aws_iam_role_policy                   | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+|  59 | CKV_AWS_62  | resource          | aws_iam_role_policy                   | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
+|  60 | CKV_AWS_63  | resource          | aws_iam_user_policy                   | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+|  61 | CKV_AWS_62  | resource          | aws_iam_user_policy                   | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
+|  62 | CKV_AWS_40  | resource          | aws_iam_user_policy                   | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
+|  63 | CKV_AWS_63  | resource          | aws_iam_group_policy                  | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+|  64 | CKV_AWS_62  | resource          | aws_iam_group_policy                  | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
+|  65 | CKV_AWS_63  | resource          | aws_iam_policy                        | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+|  66 | CKV_AWS_62  | resource          | aws_iam_policy                        | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
+|  67 | CKV_AWS_32  | resource          | aws_ecr_repository_policy             | Ensure ECR policy is not set to public                                                                                                                                                                   | Terraform      |
+|  68 | CKV_AWS_17  | resource          | aws_rds_cluster_instance              | Ensure all data stored in the RDS bucket is not public accessible                                                                                                                                        | Terraform      |
+|  69 | CKV_AWS_43  | resource          | aws_kinesis_stream                    | Ensure Kinesis Stream is securely encrypted                                                                                                                                                              | Terraform      |
+|  70 | CKV_AWS_8   | resource          | aws_launch_configuration              | Ensure all data stored in the Launch configuration EBS is securely encrypted                                                                                                                             | Terraform      |
+|  71 | CKV_AWS_26  | resource          | aws_sns_topic                         | Ensure all data stored in the SNS topic is encrypted                                                                                                                                                     | Terraform      |
+|  72 | CKV_AWS_27  | resource          | aws_sqs_queue                         | Ensure all data stored in the SQS queue is encrypted                                                                                                                                                     | Terraform      |
+|  73 | CKV_AWS_44  | resource          | aws_neptune_cluster                   | Ensure Neptune storage is securely encrypted                                                                                                                                                             | Terraform      |
+|  74 | CKV_AWS_40  | resource          | aws_iam_user_policy_attachment        | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
+|  75 | CKV_AWS_40  | resource          | aws_iam_policy_attachment             | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
+|  76 | CKV_GCP_24  | resource          | google_container_cluster              | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters                                                                                                                         | Terraform      |
+|  77 | CKV_GCP_13  | resource          | google_container_cluster              | Ensure a client certificate is used by clients to authenticate to Kubernetes Engine Clusters                                                                                                             | Terraform      |
+|  78 | CKV_GCP_21  | resource          | google_container_cluster              | Ensure Kubernetes Clusters are configured with Labels                                                                                                                                                    | Terraform      |
+|  79 | CKV_GCP_22  | resource          | google_container_cluster              | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image                                                                                                                    | Terraform      |
+|  80 | CKV_GCP_12  | resource          | google_container_cluster              | Ensure Network Policy is enabled on Kubernetes Engine Clusters                                                                                                                                           | Terraform      |
+|  81 | CKV_GCP_18  | resource          | google_container_cluster              | Ensure GKE Control Plane is not public                                                                                                                                                                   | Terraform      |
+|  82 | CKV_GCP_19  | resource          | google_container_cluster              | Ensure GKE basic auth is disabled                                                                                                                                                                        | Terraform      |
+|  83 | CKV_GCP_20  | resource          | google_container_cluster              | Ensure master authorized networks is set to enabled in GKE clusters                                                                                                                                      | Terraform      |
 |  84 | CKV_GCP_25  | resource          | google_container_cluster              | Ensure Kubernetes Cluster is created with Private cluster enabled                                                                                                                                        | Terraform      |
-|  85 | CKV_GCP_22  | resource          | google_container_cluster              | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image                                                                                                                    | Terraform      |
-|  86 | CKV_GCP_13  | resource          | google_container_cluster              | Ensure a client certificate is used by clients to authenticate to Kubernetes Engine Clusters                                                                                                             | Terraform      |
+|  85 | CKV_GCP_23  | resource          | google_container_cluster              | Ensure Kubernetes Cluster is created with Alias IP ranges enabled                                                                                                                                        | Terraform      |
+|  86 | CKV_GCP_8   | resource          | google_container_cluster              | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters                                                                                                                            | Terraform      |
 |  87 | CKV_GCP_7   | resource          | google_container_cluster              | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters                                                                                                                             | Terraform      |
-|  88 | CKV_GCP_4   | resource          | google_compute_ssl_policy             | Ensure Google SSL policy minimal TLS version is TLS_1_2                                                                                                                                                  | Terraform      |
-|  89 | CKV_GCP_16  | resource          | google_dns_managed_zone               | Ensure that DNSSEC is enabled for Cloud DNS                                                                                                                                                              | Terraform      |
-|  90 | CKV_GCP_17  | resource          | google_dns_managed_zone               | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC                                                                                                            | Terraform      |
-|  91 | CKV_GCP_14  | resource          | google_sql_database_instance          | Ensure all Cloud SQL database instance have backup configuration enabled                                                                                                                                 | Terraform      |
-|  92 | CKV_GCP_11  | resource          | google_sql_database_instance          | Ensure that Cloud SQL database Instances are not open to the world                                                                                                                                       | Terraform      |
-|  93 | CKV_GCP_6   | resource          | google_sql_database_instance          | Ensure all Cloud SQL database instance requires all incoming connections to use SSL                                                                                                                      | Terraform      |
-|  94 | CKV_GCP_10  | resource          | google_container_node_pool            | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters                                                                                                                                       | Terraform      |
-|  95 | CKV_GCP_9   | resource          | google_container_node_pool            | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters                                                                                                                                        | Terraform      |
-|  96 | CKV_GCP_3   | resource          | google_compute_firewall               | Ensure Google compute firewall ingress does not allow unrestricted rdp access                                                                                                                            | Terraform      |
-|  97 | CKV_GCP_2   | resource          | google_compute_firewall               | Ensure Google compute firewall ingress does not allow unrestricted ssh access                                                                                                                            | Terraform      |
+|  88 | CKV_GCP_1   | resource          | google_container_cluster              | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters                                                                                                                               | Terraform      |
+|  89 | CKV_GCP_4   | resource          | google_compute_ssl_policy             | Ensure Google SSL policy minimal TLS version is TLS_1_2                                                                                                                                                  | Terraform      |
+|  90 | CKV_GCP_3   | resource          | google_compute_firewall               | Ensure Google compute firewall ingress does not allow unrestricted rdp access                                                                                                                            | Terraform      |
+|  91 | CKV_GCP_2   | resource          | google_compute_firewall               | Ensure Google compute firewall ingress does not allow unrestricted ssh access                                                                                                                            | Terraform      |
+|  92 | CKV_GCP_9   | resource          | google_container_node_pool            | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters                                                                                                                                        | Terraform      |
+|  93 | CKV_GCP_10  | resource          | google_container_node_pool            | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters                                                                                                                                       | Terraform      |
+|  94 | CKV_GCP_6   | resource          | google_sql_database_instance          | Ensure all Cloud SQL database instance requires all incoming connections to use SSL                                                                                                                      | Terraform      |
+|  95 | CKV_GCP_14  | resource          | google_sql_database_instance          | Ensure all Cloud SQL database instance have backup configuration enabled                                                                                                                                 | Terraform      |
+|  96 | CKV_GCP_11  | resource          | google_sql_database_instance          | Ensure that Cloud SQL database Instances are not open to the world                                                                                                                                       | Terraform      |
+|  97 | CKV_GCP_15  | resource          | google_bigquery_dataset               | Ensure that BigQuery datasets are not anonymously or publicly accessible                                                                                                                                 | Terraform      |
 |  98 | CKV_GCP_5   | resource          | google_storage_bucket                 | Ensure Google storage bucket have encryption enabled                                                                                                                                                     | Terraform      |
-|  99 | CKV_GCP_15  | resource          | google_bigquery_dataset               | Ensure that BigQuery datasets are not anonymously or publicly accessible                                                                                                                                 | Terraform      |
-| 100 | CKV_AZURE_2 | resource          | azurerm_managed_disk                  | Ensure Azure managed disk have encryption enabled                                                                                                                                                        | Terraform      |
-| 101 | CKV_AZURE_6 | resource          | azurerm_kubernetes_cluster            | Ensure AKS has an API Server Authorized IP Ranges enabled                                                                                                                                                | Terraform      |
+|  99 | CKV_GCP_17  | resource          | google_dns_managed_zone               | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC                                                                                                            | Terraform      |
+| 100 | CKV_GCP_16  | resource          | google_dns_managed_zone               | Ensure that DNSSEC is enabled for Cloud DNS                                                                                                                                                              | Terraform      |
+| 101 | CKV_AZURE_3 | resource          | azurerm_storage_account               | Ensure that 'Secure transfer required' is set to 'Enabled'                                                                                                                                               | Terraform      |
 | 102 | CKV_AZURE_8 | resource          | azurerm_kubernetes_cluster            | Ensure Kube Dashboard is disabled                                                                                                                                                                        | Terraform      |
-| 103 | CKV_AZURE_5 | resource          | azurerm_kubernetes_cluster            | Ensure RBAC is enabled on AKS clusters                                                                                                                                                                   | Terraform      |
-| 104 | CKV_AZURE_4 | resource          | azurerm_kubernetes_cluster            | Ensure AKS logging to Azure Monitoring is Configured                                                                                                                                                     | Terraform      |
-| 105 | CKV_AZURE_7 | resource          | azurerm_kubernetes_cluster            | Ensure AKS cluster has Network Policy configured                                                                                                                                                         | Terraform      |
-| 106 | CKV_AZURE_1 | resource          | azurerm_virtual_machine               | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)                                                                                                                             | Terraform      |
-| 107 | CKV_AZURE_3 | resource          | azurerm_storage_account               | Ensure that 'Secure transfer required' is set to 'Enabled'                                                                                                                                               | Terraform      |
-| 108 | CKV_AWS_49  | data              | aws_iam_policy_document               | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+| 103 | CKV_AZURE_4 | resource          | azurerm_kubernetes_cluster            | Ensure AKS logging to Azure Monitoring is Configured                                                                                                                                                     | Terraform      |
+| 104 | CKV_AZURE_7 | resource          | azurerm_kubernetes_cluster            | Ensure AKS cluster has Network Policy configured                                                                                                                                                         | Terraform      |
+| 105 | CKV_AZURE_6 | resource          | azurerm_kubernetes_cluster            | Ensure AKS has an API Server Authorized IP Ranges enabled                                                                                                                                                | Terraform      |
+| 106 | CKV_AZURE_5 | resource          | azurerm_kubernetes_cluster            | Ensure RBAC is enabled on AKS clusters                                                                                                                                                                   | Terraform      |
+| 107 | CKV_AZURE_2 | resource          | azurerm_managed_disk                  | Ensure Azure managed disk have encryption enabled                                                                                                                                                        | Terraform      |
+| 108 | CKV_AZURE_1 | resource          | azurerm_virtual_machine               | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)                                                                                                                             | Terraform      |
 | 109 | CKV_AWS_1   | data              | aws_iam_policy_document               | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-| 110 | CKV_AWS_41  | provider          | aws                                   | Ensure no hard coded AWS access key and and secret key exists in provider                                                                                                                                | Terraform      |
-| 111 | CKV_AWS_21  | resource          | AWS::S3::Bucket                       | Ensure the S3 bucket has versioning enabled                                                                                                                                                              | Cloudformation |
-| 112 | CKV_AWS_19  | resource          | AWS::S3::Bucket                       | Ensure the S3 bucket has server-side-encryption enabled                                                                                                                                                  | Cloudformation |
+| 110 | CKV_AWS_49  | data              | aws_iam_policy_document               | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+| 111 | CKV_AWS_41  | provider          | aws                                   | Ensure no hard coded AWS access key and and secret key exists in provider                                                                                                                                | Terraform      |
+| 112 | CKV_AWS_21  | resource          | AWS::S3::Bucket                       | Ensure the S3 bucket has versioning enabled                                                                                                                                                              | Cloudformation |
 | 113 | CKV_AWS_57  | resource          | AWS::S3::Bucket                       | Ensure the S3 bucket does not allow WRITE permissions to everyone                                                                                                                                        | Cloudformation |
-| 114 | CKV_AWS_18  | resource          | AWS::S3::Bucket                       | Ensure the S3 bucket has access logging enabled                                                                                                                                                          | Cloudformation |
+| 114 | CKV_AWS_19  | resource          | AWS::S3::Bucket                       | Ensure the S3 bucket has server-side-encryption enabled                                                                                                                                                  | Cloudformation |
 | 115 | CKV_AWS_20  | resource          | AWS::S3::Bucket                       | Ensure the S3 bucket does not allow READ permissions to everyone                                                                                                                                         | Cloudformation |
-| 116 | CKV_AWS_24  | resource          | AWS::EC2::SecurityGroup               | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22                                                                                                                                        | Cloudformation |
-| 117 | CKV_AWS_23  | resource          | AWS::EC2::SecurityGroup               | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
-| 118 | CKV_AWS_24  | resource          | AWS::EC2::SecurityGroupIngress        | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22                                                                                                                                        | Cloudformation |
-| 119 | CKV_AWS_23  | resource          | AWS::EC2::SecurityGroupIngress        | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
-| 120 | CKV_AWS_29  | resource          | AWS::ElastiCache::ReplicationGroup    | Ensure all data stored in the Elasticache Replication Group  is securely encrypted at rest                                                                                                               | Cloudformation |
-| 121 | CKV_AWS_31  | resource          | AWS::ElastiCache::ReplicationGroup    | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token                                                                                          | Cloudformation |
-| 122 | CKV_AWS_30  | resource          | AWS::ElastiCache::ReplicationGroup    | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit                                                                                                             | Cloudformation |
-| 123 | CKV_AWS_23  | resource          | AWS::EC2::SecurityGroupEgress         | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
-| 124 | CKV_AWS_23  | resource          | AWS::RDS::DBSecurityGroup             | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
-| 125 | CKV_AWS_23  | resource          | AWS::ElastiCache::SecurityGroup       | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
-| 126 | CKV_AWS_23  | resource          | AWS::Redshift::ClusterSecurityGroup   | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
-| 127 | CKV_AWS_58  | resource          | AWS::EKS::Cluster                     | Ensure EKS Cluster has Secrets Encryption Enabled                                                                                                                                                        | Cloudformation |
-| 128 | CKV_AWS_32  | resource          | AWS::ECR::Repository                  | Ensure ECR policy is not set to public                                                                                                                                                                   | Cloudformation |
-| 129 | CKV_AWS_28  | resource          | AWS::DynamoDB::Table                  | Ensure Dynamodb point in time recovery (backup) is enabled                                                                                                                                               | Cloudformation |
-| 130 | CKV_AWS_6   | resource          | AWS::Elasticsearch::Domain            | Ensure all Elasticsearch has node-to-node encryption enabled                                                                                                                                             | Cloudformation |
-| 131 | CKV_AWS_5   | resource          | AWS::Elasticsearch::Domain            | Ensure all data stored in the Elasticsearch is securely encrypted at rest                                                                                                                                | Cloudformation |
-| 132 | CKV_AWS_35  | resource          | AWS::CloudTrail::Trail                | Ensure CloudTrail logs are encrypted at rest using KMS CMKs                                                                                                                                              | Cloudformation |
-| 133 | CKV_AWS_36  | resource          | AWS::CloudTrail::Trail                | Ensure CloudTrail log file validation is enabled                                                                                                                                                         | Cloudformation |
-| 134 | CKV_AWS_2   | resource          | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS                                                                                                                                                                             | Cloudformation |
-| 135 | CKV_AWS_3   | resource          | AWS::EC2::Volume                      | Ensure all data stored in the EBS is securely encrypted                                                                                                                                                  | Cloudformation |
-| 136 | CKV_AWS_34  | resource          | AWS::CloudFront::Distribution         | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS                                                                                                                                      | Cloudformation |
-| 137 | CKV_K8S_32  | PodSecurityPolicy | PodSecurityPolicy                     | Ensure default seccomp profile set to docker/default or runtime/default                                                                                                                                  | Kubernetes     |
-| 138 | CKV_K8S_6   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit root containers                                                                                                                                                                             | Kubernetes     |
-| 139 | CKV_K8S_5   | PodSecurityPolicy | PodSecurityPolicy                     | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
-| 140 | CKV_K8S_1   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit containers wishing to share the host process ID namespace                                                                                                                                   | Kubernetes     |
-| 141 | CKV_K8S_24  | PodSecurityPolicy | PodSecurityPolicy                     | Do not allow containers with added capability                                                                                                                                                            | Kubernetes     |
-| 142 | CKV_K8S_2   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit privileged containers                                                                                                                                                                       | Kubernetes     |
-| 143 | CKV_K8S_4   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit containers wishing to share the host network namespace                                                                                                                                      | Kubernetes     |
-| 144 | CKV_K8S_3   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit containers wishing to share the host IPC namespace                                                                                                                                          | Kubernetes     |
-| 145 | CKV_K8S_36  | PodSecurityPolicy | PodSecurityPolicy                     | Minimize the admission of containers with capabilities assigned                                                                                                                                          | Kubernetes     |
-| 146 | CKV_K8S_7   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit containers with the NET_RAW capability                                                                                                                                                      | Kubernetes     |
-| 147 | CKV_K8S_8   | PodSecurityPolicy | containers                            | Liveness Probe Should be Configured                                                                                                                                                                      | Kubernetes     |
-| 148 | CKV_K8S_26  | PodSecurityPolicy | containers                            | Do not specify hostPort unless absolutely necessary                                                                                                                                                      | Kubernetes     |
-| 149 | CKV_K8S_14  | PodSecurityPolicy | containers                            | Image Tag should be fixed - not latest or blank                                                                                                                                                          | Kubernetes     |
-| 150 | CKV_K8S_37  | PodSecurityPolicy | containers                            | Minimize the admission of containers with capabilities assigned                                                                                                                                          | Kubernetes     |
-| 151 | CKV_K8S_30  | PodSecurityPolicy | containers                            | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 152 | CKV_K8S_25  | PodSecurityPolicy | containers                            | Minimize the admission of containers with added capability                                                                                                                                               | Kubernetes     |
-| 153 | CKV_K8S_43  | PodSecurityPolicy | containers                            | Image should use digest                                                                                                                                                                                  | Kubernetes     |
-| 154 | CKV_K8S_15  | PodSecurityPolicy | containers                            | Image Pull Policy should be Always                                                                                                                                                                       | Kubernetes     |
-| 155 | CKV_K8S_34  | PodSecurityPolicy | containers                            | Ensure that Tiller (Helm v2) is not deployed                                                                                                                                                             | Kubernetes     |
-| 156 | CKV_K8S_16  | PodSecurityPolicy | containers                            | Container should not be privileged                                                                                                                                                                       | Kubernetes     |
-| 157 | CKV_K8S_20  | PodSecurityPolicy | containers                            | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
-| 158 | CKV_K8S_10  | PodSecurityPolicy | containers                            | CPU requests should be set                                                                                                                                                                               | Kubernetes     |
-| 159 | CKV_K8S_9   | PodSecurityPolicy | containers                            | Readiness Probe Should be Configured                                                                                                                                                                     | Kubernetes     |
-| 160 | CKV_K8S_35  | PodSecurityPolicy | containers                            | Prefer using secrets as files over secrets as environment variables                                                                                                                                      | Kubernetes     |
-| 161 | CKV_K8S_28  | PodSecurityPolicy | containers                            | Minimize the admission of containers with the NET_RAW capability                                                                                                                                         | Kubernetes     |
-| 162 | CKV_K8S_33  | PodSecurityPolicy | containers                            | Ensure the Kubernetes dashboard is not deployed                                                                                                                                                          | Kubernetes     |
-| 163 | CKV_K8S_11  | PodSecurityPolicy | containers                            | CPU limits should be set                                                                                                                                                                                 | Kubernetes     |
-| 164 | CKV_K8S_12  | PodSecurityPolicy | containers                            | Memory requests should be set                                                                                                                                                                            | Kubernetes     |
-| 165 | CKV_K8S_39  | PodSecurityPolicy | containers                            | Do not use the CAP_SYS_ADMIN linux capability                                                                                                                                                            | Kubernetes     |
-| 166 | CKV_K8S_22  | PodSecurityPolicy | containers                            | Use read-only filesystem for containers where possible                                                                                                                                                   | Kubernetes     |
-| 167 | CKV_K8S_13  | PodSecurityPolicy | containers                            | Memory limits should be set                                                                                                                                                                              | Kubernetes     |
-| 168 | CKV_K8S_26  | PodSecurityPolicy | initContainers                        | Do not specify hostPort unless absolutely necessary                                                                                                                                                      | Kubernetes     |
-| 169 | CKV_K8S_14  | PodSecurityPolicy | initContainers                        | Image Tag should be fixed - not latest or blank                                                                                                                                                          | Kubernetes     |
-| 170 | CKV_K8S_37  | PodSecurityPolicy | initContainers                        | Minimize the admission of containers with capabilities assigned                                                                                                                                          | Kubernetes     |
-| 171 | CKV_K8S_30  | PodSecurityPolicy | initContainers                        | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 172 | CKV_K8S_25  | PodSecurityPolicy | initContainers                        | Minimize the admission of containers with added capability                                                                                                                                               | Kubernetes     |
-| 173 | CKV_K8S_43  | PodSecurityPolicy | initContainers                        | Image should use digest                                                                                                                                                                                  | Kubernetes     |
-| 174 | CKV_K8S_15  | PodSecurityPolicy | initContainers                        | Image Pull Policy should be Always                                                                                                                                                                       | Kubernetes     |
-| 175 | CKV_K8S_34  | PodSecurityPolicy | initContainers                        | Ensure that Tiller (Helm v2) is not deployed                                                                                                                                                             | Kubernetes     |
-| 176 | CKV_K8S_16  | PodSecurityPolicy | initContainers                        | Container should not be privileged                                                                                                                                                                       | Kubernetes     |
-| 177 | CKV_K8S_20  | PodSecurityPolicy | initContainers                        | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
-| 178 | CKV_K8S_10  | PodSecurityPolicy | initContainers                        | CPU requests should be set                                                                                                                                                                               | Kubernetes     |
-| 179 | CKV_K8S_35  | PodSecurityPolicy | initContainers                        | Prefer using secrets as files over secrets as environment variables                                                                                                                                      | Kubernetes     |
-| 180 | CKV_K8S_28  | PodSecurityPolicy | initContainers                        | Minimize the admission of containers with the NET_RAW capability                                                                                                                                         | Kubernetes     |
-| 181 | CKV_K8S_33  | PodSecurityPolicy | initContainers                        | Ensure the Kubernetes dashboard is not deployed                                                                                                                                                          | Kubernetes     |
-| 182 | CKV_K8S_11  | PodSecurityPolicy | initContainers                        | CPU limits should be set                                                                                                                                                                                 | Kubernetes     |
-| 183 | CKV_K8S_12  | PodSecurityPolicy | initContainers                        | Memory requests should be set                                                                                                                                                                            | Kubernetes     |
-| 184 | CKV_K8S_39  | PodSecurityPolicy | initContainers                        | Do not use the CAP_SYS_ADMIN linux capability                                                                                                                                                            | Kubernetes     |
-| 185 | CKV_K8S_22  | PodSecurityPolicy | initContainers                        | Use read-only filesystem for containers where possible                                                                                                                                                   | Kubernetes     |
-| 186 | CKV_K8S_13  | PodSecurityPolicy | initContainers                        | Memory limits should be set                                                                                                                                                                              | Kubernetes     |
-| 187 | CKV_K8S_41  | PodSecurityPolicy | ServiceAccount                        | Ensure that default service accounts are not actively used                                                                                                                                               | Kubernetes     |
-| 188 | CKV_K8S_21  | PodSecurityPolicy | ServiceAccount                        | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 189 | CKV_K8S_42  | PodSecurityPolicy | RoleBinding                           | Ensure that default service accounts are not actively used                                                                                                                                               | Kubernetes     |
-| 190 | CKV_K8S_21  | PodSecurityPolicy | RoleBinding                           | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 191 | CKV_K8S_42  | PodSecurityPolicy | ClusterRoleBinding                    | Ensure that default service accounts are not actively used                                                                                                                                               | Kubernetes     |
-| 192 | CKV_K8S_31  | PodSecurityPolicy | Pod                                   | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
-| 193 | CKV_K8S_21  | PodSecurityPolicy | Pod                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 194 | CKV_K8S_40  | PodSecurityPolicy | Pod                                   | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
-| 195 | CKV_K8S_38  | PodSecurityPolicy | Pod                                   | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
-| 196 | CKV_K8S_17  | PodSecurityPolicy | Pod                                   | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
-| 197 | CKV_K8S_27  | PodSecurityPolicy | Pod                                   | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
-| 198 | CKV_K8S_18  | PodSecurityPolicy | Pod                                   | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
-| 199 | CKV_K8S_29  | PodSecurityPolicy | Pod                                   | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 200 | CKV_K8S_19  | PodSecurityPolicy | Pod                                   | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
-| 201 | CKV_K8S_23  | PodSecurityPolicy | Pod                                   | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
-| 202 | CKV_K8S_31  | PodSecurityPolicy | Deployment                            | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
-| 203 | CKV_K8S_21  | PodSecurityPolicy | Deployment                            | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 204 | CKV_K8S_40  | PodSecurityPolicy | Deployment                            | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
-| 205 | CKV_K8S_38  | PodSecurityPolicy | Deployment                            | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
-| 206 | CKV_K8S_17  | PodSecurityPolicy | Deployment                            | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
-| 207 | CKV_K8S_27  | PodSecurityPolicy | Deployment                            | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
-| 208 | CKV_K8S_18  | PodSecurityPolicy | Deployment                            | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
-| 209 | CKV_K8S_29  | PodSecurityPolicy | Deployment                            | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 210 | CKV_K8S_19  | PodSecurityPolicy | Deployment                            | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
-| 211 | CKV_K8S_23  | PodSecurityPolicy | Deployment                            | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
-| 212 | CKV_K8S_31  | PodSecurityPolicy | DaemonSet                             | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
-| 213 | CKV_K8S_21  | PodSecurityPolicy | DaemonSet                             | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 214 | CKV_K8S_40  | PodSecurityPolicy | DaemonSet                             | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
-| 215 | CKV_K8S_38  | PodSecurityPolicy | DaemonSet                             | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
-| 216 | CKV_K8S_17  | PodSecurityPolicy | DaemonSet                             | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
-| 217 | CKV_K8S_27  | PodSecurityPolicy | DaemonSet                             | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
-| 218 | CKV_K8S_18  | PodSecurityPolicy | DaemonSet                             | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
-| 219 | CKV_K8S_29  | PodSecurityPolicy | DaemonSet                             | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 220 | CKV_K8S_19  | PodSecurityPolicy | DaemonSet                             | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
-| 221 | CKV_K8S_23  | PodSecurityPolicy | DaemonSet                             | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
-| 222 | CKV_K8S_31  | PodSecurityPolicy | StatefulSet                           | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
-| 223 | CKV_K8S_21  | PodSecurityPolicy | StatefulSet                           | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 224 | CKV_K8S_40  | PodSecurityPolicy | StatefulSet                           | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
-| 225 | CKV_K8S_38  | PodSecurityPolicy | StatefulSet                           | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
-| 226 | CKV_K8S_17  | PodSecurityPolicy | StatefulSet                           | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
-| 227 | CKV_K8S_27  | PodSecurityPolicy | StatefulSet                           | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
-| 228 | CKV_K8S_18  | PodSecurityPolicy | StatefulSet                           | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
-| 229 | CKV_K8S_29  | PodSecurityPolicy | StatefulSet                           | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 230 | CKV_K8S_19  | PodSecurityPolicy | StatefulSet                           | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
-| 231 | CKV_K8S_23  | PodSecurityPolicy | StatefulSet                           | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
-| 232 | CKV_K8S_31  | PodSecurityPolicy | ReplicaSet                            | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
-| 233 | CKV_K8S_21  | PodSecurityPolicy | ReplicaSet                            | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 234 | CKV_K8S_40  | PodSecurityPolicy | ReplicaSet                            | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
-| 235 | CKV_K8S_38  | PodSecurityPolicy | ReplicaSet                            | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
-| 236 | CKV_K8S_17  | PodSecurityPolicy | ReplicaSet                            | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
-| 237 | CKV_K8S_27  | PodSecurityPolicy | ReplicaSet                            | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
-| 238 | CKV_K8S_18  | PodSecurityPolicy | ReplicaSet                            | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
-| 239 | CKV_K8S_29  | PodSecurityPolicy | ReplicaSet                            | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 240 | CKV_K8S_19  | PodSecurityPolicy | ReplicaSet                            | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
-| 241 | CKV_K8S_23  | PodSecurityPolicy | ReplicaSet                            | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
-| 242 | CKV_K8S_31  | PodSecurityPolicy | ReplicationController                 | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
-| 243 | CKV_K8S_21  | PodSecurityPolicy | ReplicationController                 | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 244 | CKV_K8S_40  | PodSecurityPolicy | ReplicationController                 | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
-| 245 | CKV_K8S_38  | PodSecurityPolicy | ReplicationController                 | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
-| 246 | CKV_K8S_17  | PodSecurityPolicy | ReplicationController                 | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
-| 247 | CKV_K8S_27  | PodSecurityPolicy | ReplicationController                 | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
-| 248 | CKV_K8S_18  | PodSecurityPolicy | ReplicationController                 | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
-| 249 | CKV_K8S_29  | PodSecurityPolicy | ReplicationController                 | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 250 | CKV_K8S_19  | PodSecurityPolicy | ReplicationController                 | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
-| 251 | CKV_K8S_23  | PodSecurityPolicy | ReplicationController                 | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
-| 252 | CKV_K8S_31  | PodSecurityPolicy | Job                                   | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
-| 253 | CKV_K8S_21  | PodSecurityPolicy | Job                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 254 | CKV_K8S_40  | PodSecurityPolicy | Job                                   | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
-| 255 | CKV_K8S_38  | PodSecurityPolicy | Job                                   | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
-| 256 | CKV_K8S_17  | PodSecurityPolicy | Job                                   | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
-| 257 | CKV_K8S_27  | PodSecurityPolicy | Job                                   | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
-| 258 | CKV_K8S_18  | PodSecurityPolicy | Job                                   | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
-| 259 | CKV_K8S_29  | PodSecurityPolicy | Job                                   | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 260 | CKV_K8S_19  | PodSecurityPolicy | Job                                   | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
-| 261 | CKV_K8S_23  | PodSecurityPolicy | Job                                   | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
-| 262 | CKV_K8S_31  | PodSecurityPolicy | CronJob                               | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
-| 263 | CKV_K8S_21  | PodSecurityPolicy | CronJob                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 264 | CKV_K8S_40  | PodSecurityPolicy | CronJob                               | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
-| 265 | CKV_K8S_38  | PodSecurityPolicy | CronJob                               | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
-| 266 | CKV_K8S_17  | PodSecurityPolicy | CronJob                               | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
-| 267 | CKV_K8S_27  | PodSecurityPolicy | CronJob                               | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
-| 268 | CKV_K8S_18  | PodSecurityPolicy | CronJob                               | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
-| 269 | CKV_K8S_29  | PodSecurityPolicy | CronJob                               | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
-| 270 | CKV_K8S_19  | PodSecurityPolicy | CronJob                               | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
-| 271 | CKV_K8S_23  | PodSecurityPolicy | CronJob                               | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
-| 272 | CKV_K8S_21  | PodSecurityPolicy | Service                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 273 | CKV_K8S_21  | PodSecurityPolicy | Secret                                | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 274 | CKV_K8S_21  | PodSecurityPolicy | Role                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 275 | CKV_K8S_21  | PodSecurityPolicy | ConfigMap                             | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 276 | CKV_K8S_21  | PodSecurityPolicy | Ingress                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 116 | CKV_AWS_18  | resource          | AWS::S3::Bucket                       | Ensure the S3 bucket has access logging enabled                                                                                                                                                          | Cloudformation |
+| 117 | CKV_AWS_58  | resource          | AWS::EKS::Cluster                     | Ensure EKS Cluster has Secrets Encryption Enabled                                                                                                                                                        | Cloudformation |
+| 118 | CKV_AWS_36  | resource          | AWS::CloudTrail::Trail                | Ensure CloudTrail log file validation is enabled                                                                                                                                                         | Cloudformation |
+| 119 | CKV_AWS_35  | resource          | AWS::CloudTrail::Trail                | Ensure CloudTrail logs are encrypted at rest using KMS CMKs                                                                                                                                              | Cloudformation |
+| 120 | CKV_AWS_16  | resource          | AWS::RDS::DBInstance                  | Ensure all data stored in the RDS is securely encrypted at rest                                                                                                                                          | Cloudformation |
+| 121 | CKV_AWS_17  | resource          | AWS::RDS::DBInstance                  | Ensure all data stored in the RDS bucket is not public accessible                                                                                                                                        | Cloudformation |
+| 122 | CKV_AWS_28  | resource          | AWS::DynamoDB::Table                  | Ensure Dynamodb point in time recovery (backup) is enabled                                                                                                                                               | Cloudformation |
+| 123 | CKV_AWS_29  | resource          | AWS::ElastiCache::ReplicationGroup    | Ensure all data stored in the Elasticache Replication Group  is securely encrypted at rest                                                                                                               | Cloudformation |
+| 124 | CKV_AWS_31  | resource          | AWS::ElastiCache::ReplicationGroup    | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token                                                                                          | Cloudformation |
+| 125 | CKV_AWS_30  | resource          | AWS::ElastiCache::ReplicationGroup    | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit                                                                                                             | Cloudformation |
+| 126 | CKV_AWS_3   | resource          | AWS::EC2::Volume                      | Ensure all data stored in the EBS is securely encrypted                                                                                                                                                  | Cloudformation |
+| 127 | CKV_AWS_2   | resource          | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS                                                                                                                                                                             | Cloudformation |
+| 128 | CKV_AWS_64  | resource          | AWS::Redshift::Cluster                | Ensure all data stored in the Redshift cluster is securely encrypted at rest                                                                                                                             | Cloudformation |
+| 129 | CKV_AWS_23  | resource          | AWS::EC2::SecurityGroup               | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
+| 130 | CKV_AWS_24  | resource          | AWS::EC2::SecurityGroup               | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22                                                                                                                                        | Cloudformation |
+| 131 | CKV_AWS_23  | resource          | AWS::EC2::SecurityGroupIngress        | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
+| 132 | CKV_AWS_24  | resource          | AWS::EC2::SecurityGroupIngress        | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22                                                                                                                                        | Cloudformation |
+| 133 | CKV_AWS_23  | resource          | AWS::EC2::SecurityGroupEgress         | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
+| 134 | CKV_AWS_23  | resource          | AWS::RDS::DBSecurityGroup             | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
+| 135 | CKV_AWS_23  | resource          | AWS::ElastiCache::SecurityGroup       | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
+| 136 | CKV_AWS_23  | resource          | AWS::Redshift::ClusterSecurityGroup   | Ensure every security groups rule has a description                                                                                                                                                      | Cloudformation |
+| 137 | CKV_AWS_5   | resource          | AWS::Elasticsearch::Domain            | Ensure all data stored in the Elasticsearch is securely encrypted at rest                                                                                                                                | Cloudformation |
+| 138 | CKV_AWS_6   | resource          | AWS::Elasticsearch::Domain            | Ensure all Elasticsearch has node-to-node encryption enabled                                                                                                                                             | Cloudformation |
+| 139 | CKV_AWS_34  | resource          | AWS::CloudFront::Distribution         | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS                                                                                                                                      | Cloudformation |
+| 140 | CKV_AWS_32  | resource          | AWS::ECR::Repository                  | Ensure ECR policy is not set to public                                                                                                                                                                   | Cloudformation |
+| 141 | CKV_K8S_38  | PodSecurityPolicy | Pod                                   | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
+| 142 | CKV_K8S_29  | PodSecurityPolicy | Pod                                   | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 143 | CKV_K8S_23  | PodSecurityPolicy | Pod                                   | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
+| 144 | CKV_K8S_18  | PodSecurityPolicy | Pod                                   | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
+| 145 | CKV_K8S_27  | PodSecurityPolicy | Pod                                   | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
+| 146 | CKV_K8S_21  | PodSecurityPolicy | Pod                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 147 | CKV_K8S_31  | PodSecurityPolicy | Pod                                   | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
+| 148 | CKV_K8S_17  | PodSecurityPolicy | Pod                                   | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
+| 149 | CKV_K8S_19  | PodSecurityPolicy | Pod                                   | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
+| 150 | CKV_K8S_40  | PodSecurityPolicy | Pod                                   | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
+| 151 | CKV_K8S_38  | PodSecurityPolicy | Deployment                            | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
+| 152 | CKV_K8S_29  | PodSecurityPolicy | Deployment                            | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 153 | CKV_K8S_23  | PodSecurityPolicy | Deployment                            | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
+| 154 | CKV_K8S_18  | PodSecurityPolicy | Deployment                            | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
+| 155 | CKV_K8S_27  | PodSecurityPolicy | Deployment                            | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
+| 156 | CKV_K8S_21  | PodSecurityPolicy | Deployment                            | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 157 | CKV_K8S_31  | PodSecurityPolicy | Deployment                            | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
+| 158 | CKV_K8S_17  | PodSecurityPolicy | Deployment                            | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
+| 159 | CKV_K8S_19  | PodSecurityPolicy | Deployment                            | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
+| 160 | CKV_K8S_40  | PodSecurityPolicy | Deployment                            | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
+| 161 | CKV_K8S_38  | PodSecurityPolicy | DaemonSet                             | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
+| 162 | CKV_K8S_29  | PodSecurityPolicy | DaemonSet                             | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 163 | CKV_K8S_23  | PodSecurityPolicy | DaemonSet                             | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
+| 164 | CKV_K8S_18  | PodSecurityPolicy | DaemonSet                             | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
+| 165 | CKV_K8S_27  | PodSecurityPolicy | DaemonSet                             | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
+| 166 | CKV_K8S_21  | PodSecurityPolicy | DaemonSet                             | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 167 | CKV_K8S_31  | PodSecurityPolicy | DaemonSet                             | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
+| 168 | CKV_K8S_17  | PodSecurityPolicy | DaemonSet                             | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
+| 169 | CKV_K8S_19  | PodSecurityPolicy | DaemonSet                             | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
+| 170 | CKV_K8S_40  | PodSecurityPolicy | DaemonSet                             | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
+| 171 | CKV_K8S_38  | PodSecurityPolicy | StatefulSet                           | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
+| 172 | CKV_K8S_29  | PodSecurityPolicy | StatefulSet                           | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 173 | CKV_K8S_23  | PodSecurityPolicy | StatefulSet                           | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
+| 174 | CKV_K8S_18  | PodSecurityPolicy | StatefulSet                           | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
+| 175 | CKV_K8S_27  | PodSecurityPolicy | StatefulSet                           | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
+| 176 | CKV_K8S_21  | PodSecurityPolicy | StatefulSet                           | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 177 | CKV_K8S_31  | PodSecurityPolicy | StatefulSet                           | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
+| 178 | CKV_K8S_17  | PodSecurityPolicy | StatefulSet                           | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
+| 179 | CKV_K8S_19  | PodSecurityPolicy | StatefulSet                           | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
+| 180 | CKV_K8S_40  | PodSecurityPolicy | StatefulSet                           | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
+| 181 | CKV_K8S_38  | PodSecurityPolicy | ReplicaSet                            | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
+| 182 | CKV_K8S_29  | PodSecurityPolicy | ReplicaSet                            | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 183 | CKV_K8S_23  | PodSecurityPolicy | ReplicaSet                            | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
+| 184 | CKV_K8S_18  | PodSecurityPolicy | ReplicaSet                            | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
+| 185 | CKV_K8S_27  | PodSecurityPolicy | ReplicaSet                            | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
+| 186 | CKV_K8S_21  | PodSecurityPolicy | ReplicaSet                            | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 187 | CKV_K8S_31  | PodSecurityPolicy | ReplicaSet                            | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
+| 188 | CKV_K8S_17  | PodSecurityPolicy | ReplicaSet                            | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
+| 189 | CKV_K8S_19  | PodSecurityPolicy | ReplicaSet                            | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
+| 190 | CKV_K8S_40  | PodSecurityPolicy | ReplicaSet                            | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
+| 191 | CKV_K8S_38  | PodSecurityPolicy | ReplicationController                 | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
+| 192 | CKV_K8S_29  | PodSecurityPolicy | ReplicationController                 | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 193 | CKV_K8S_23  | PodSecurityPolicy | ReplicationController                 | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
+| 194 | CKV_K8S_18  | PodSecurityPolicy | ReplicationController                 | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
+| 195 | CKV_K8S_27  | PodSecurityPolicy | ReplicationController                 | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
+| 196 | CKV_K8S_21  | PodSecurityPolicy | ReplicationController                 | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 197 | CKV_K8S_31  | PodSecurityPolicy | ReplicationController                 | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
+| 198 | CKV_K8S_17  | PodSecurityPolicy | ReplicationController                 | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
+| 199 | CKV_K8S_19  | PodSecurityPolicy | ReplicationController                 | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
+| 200 | CKV_K8S_40  | PodSecurityPolicy | ReplicationController                 | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
+| 201 | CKV_K8S_38  | PodSecurityPolicy | Job                                   | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
+| 202 | CKV_K8S_29  | PodSecurityPolicy | Job                                   | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 203 | CKV_K8S_23  | PodSecurityPolicy | Job                                   | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
+| 204 | CKV_K8S_18  | PodSecurityPolicy | Job                                   | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
+| 205 | CKV_K8S_27  | PodSecurityPolicy | Job                                   | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
+| 206 | CKV_K8S_21  | PodSecurityPolicy | Job                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 207 | CKV_K8S_31  | PodSecurityPolicy | Job                                   | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
+| 208 | CKV_K8S_17  | PodSecurityPolicy | Job                                   | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
+| 209 | CKV_K8S_19  | PodSecurityPolicy | Job                                   | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
+| 210 | CKV_K8S_40  | PodSecurityPolicy | Job                                   | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
+| 211 | CKV_K8S_38  | PodSecurityPolicy | CronJob                               | Ensure that Service Account Tokens are only mounted where necessary                                                                                                                                      | Kubernetes     |
+| 212 | CKV_K8S_29  | PodSecurityPolicy | CronJob                               | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 213 | CKV_K8S_23  | PodSecurityPolicy | CronJob                               | Minimize the admission of root containers                                                                                                                                                                | Kubernetes     |
+| 214 | CKV_K8S_18  | PodSecurityPolicy | CronJob                               | Containers should not share the host IPC namespace                                                                                                                                                       | Kubernetes     |
+| 215 | CKV_K8S_27  | PodSecurityPolicy | CronJob                               | Do not expose the docker daemon socket to containers                                                                                                                                                     | Kubernetes     |
+| 216 | CKV_K8S_21  | PodSecurityPolicy | CronJob                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 217 | CKV_K8S_31  | PodSecurityPolicy | CronJob                               | Ensure that the seccomp profile is set to docker/default or runtime/default                                                                                                                              | Kubernetes     |
+| 218 | CKV_K8S_17  | PodSecurityPolicy | CronJob                               | Containers should not share the host process ID namespace                                                                                                                                                | Kubernetes     |
+| 219 | CKV_K8S_19  | PodSecurityPolicy | CronJob                               | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
+| 220 | CKV_K8S_40  | PodSecurityPolicy | CronJob                               | Containers should run as a high UID to avoid host conflict                                                                                                                                               | Kubernetes     |
+| 221 | CKV_K8S_7   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit containers with the NET_RAW capability                                                                                                                                                      | Kubernetes     |
+| 222 | CKV_K8S_3   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit containers wishing to share the host IPC namespace                                                                                                                                          | Kubernetes     |
+| 223 | CKV_K8S_36  | PodSecurityPolicy | PodSecurityPolicy                     | Minimize the admission of containers with capabilities assigned                                                                                                                                          | Kubernetes     |
+| 224 | CKV_K8S_24  | PodSecurityPolicy | PodSecurityPolicy                     | Do not allow containers with added capability                                                                                                                                                            | Kubernetes     |
+| 225 | CKV_K8S_5   | PodSecurityPolicy | PodSecurityPolicy                     | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
+| 226 | CKV_K8S_1   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit containers wishing to share the host process ID namespace                                                                                                                                   | Kubernetes     |
+| 227 | CKV_K8S_4   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit containers wishing to share the host network namespace                                                                                                                                      | Kubernetes     |
+| 228 | CKV_K8S_32  | PodSecurityPolicy | PodSecurityPolicy                     | Ensure default seccomp profile set to docker/default or runtime/default                                                                                                                                  | Kubernetes     |
+| 229 | CKV_K8S_2   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit privileged containers                                                                                                                                                                       | Kubernetes     |
+| 230 | CKV_K8S_6   | PodSecurityPolicy | PodSecurityPolicy                     | Do not admit root containers                                                                                                                                                                             | Kubernetes     |
+| 231 | CKV_K8S_41  | PodSecurityPolicy | ServiceAccount                        | Ensure that default service accounts are not actively used                                                                                                                                               | Kubernetes     |
+| 232 | CKV_K8S_21  | PodSecurityPolicy | ServiceAccount                        | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 233 | CKV_K8S_22  | PodSecurityPolicy | containers                            | Use read-only filesystem for containers where possible                                                                                                                                                   | Kubernetes     |
+| 234 | CKV_K8S_15  | PodSecurityPolicy | containers                            | Image Pull Policy should be Always                                                                                                                                                                       | Kubernetes     |
+| 235 | CKV_K8S_39  | PodSecurityPolicy | containers                            | Do not use the CAP_SYS_ADMIN linux capability                                                                                                                                                            | Kubernetes     |
+| 236 | CKV_K8S_33  | PodSecurityPolicy | containers                            | Ensure the Kubernetes dashboard is not deployed                                                                                                                                                          | Kubernetes     |
+| 237 | CKV_K8S_26  | PodSecurityPolicy | containers                            | Do not specify hostPort unless absolutely necessary                                                                                                                                                      | Kubernetes     |
+| 238 | CKV_K8S_9   | PodSecurityPolicy | containers                            | Readiness Probe Should be Configured                                                                                                                                                                     | Kubernetes     |
+| 239 | CKV_K8S_13  | PodSecurityPolicy | containers                            | Memory limits should be set                                                                                                                                                                              | Kubernetes     |
+| 240 | CKV_K8S_10  | PodSecurityPolicy | containers                            | CPU requests should be set                                                                                                                                                                               | Kubernetes     |
+| 241 | CKV_K8S_20  | PodSecurityPolicy | containers                            | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
+| 242 | CKV_K8S_37  | PodSecurityPolicy | containers                            | Minimize the admission of containers with capabilities assigned                                                                                                                                          | Kubernetes     |
+| 243 | CKV_K8S_25  | PodSecurityPolicy | containers                            | Minimize the admission of containers with added capability                                                                                                                                               | Kubernetes     |
+| 244 | CKV_K8S_30  | PodSecurityPolicy | containers                            | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 245 | CKV_K8S_16  | PodSecurityPolicy | containers                            | Container should not be privileged                                                                                                                                                                       | Kubernetes     |
+| 246 | CKV_K8S_11  | PodSecurityPolicy | containers                            | CPU limits should be set                                                                                                                                                                                 | Kubernetes     |
+| 247 | CKV_K8S_43  | PodSecurityPolicy | containers                            | Image should use digest                                                                                                                                                                                  | Kubernetes     |
+| 248 | CKV_K8S_12  | PodSecurityPolicy | containers                            | Memory requests should be set                                                                                                                                                                            | Kubernetes     |
+| 249 | CKV_K8S_8   | PodSecurityPolicy | containers                            | Liveness Probe Should be Configured                                                                                                                                                                      | Kubernetes     |
+| 250 | CKV_K8S_35  | PodSecurityPolicy | containers                            | Prefer using secrets as files over secrets as environment variables                                                                                                                                      | Kubernetes     |
+| 251 | CKV_K8S_34  | PodSecurityPolicy | containers                            | Ensure that Tiller (Helm v2) is not deployed                                                                                                                                                             | Kubernetes     |
+| 252 | CKV_K8S_28  | PodSecurityPolicy | containers                            | Minimize the admission of containers with the NET_RAW capability                                                                                                                                         | Kubernetes     |
+| 253 | CKV_K8S_14  | PodSecurityPolicy | containers                            | Image Tag should be fixed - not latest or blank                                                                                                                                                          | Kubernetes     |
+| 254 | CKV_K8S_22  | PodSecurityPolicy | initContainers                        | Use read-only filesystem for containers where possible                                                                                                                                                   | Kubernetes     |
+| 255 | CKV_K8S_15  | PodSecurityPolicy | initContainers                        | Image Pull Policy should be Always                                                                                                                                                                       | Kubernetes     |
+| 256 | CKV_K8S_39  | PodSecurityPolicy | initContainers                        | Do not use the CAP_SYS_ADMIN linux capability                                                                                                                                                            | Kubernetes     |
+| 257 | CKV_K8S_33  | PodSecurityPolicy | initContainers                        | Ensure the Kubernetes dashboard is not deployed                                                                                                                                                          | Kubernetes     |
+| 258 | CKV_K8S_26  | PodSecurityPolicy | initContainers                        | Do not specify hostPort unless absolutely necessary                                                                                                                                                      | Kubernetes     |
+| 259 | CKV_K8S_13  | PodSecurityPolicy | initContainers                        | Memory limits should be set                                                                                                                                                                              | Kubernetes     |
+| 260 | CKV_K8S_10  | PodSecurityPolicy | initContainers                        | CPU requests should be set                                                                                                                                                                               | Kubernetes     |
+| 261 | CKV_K8S_20  | PodSecurityPolicy | initContainers                        | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
+| 262 | CKV_K8S_37  | PodSecurityPolicy | initContainers                        | Minimize the admission of containers with capabilities assigned                                                                                                                                          | Kubernetes     |
+| 263 | CKV_K8S_25  | PodSecurityPolicy | initContainers                        | Minimize the admission of containers with added capability                                                                                                                                               | Kubernetes     |
+| 264 | CKV_K8S_30  | PodSecurityPolicy | initContainers                        | Apply security context to your pods and containers                                                                                                                                                       | Kubernetes     |
+| 265 | CKV_K8S_16  | PodSecurityPolicy | initContainers                        | Container should not be privileged                                                                                                                                                                       | Kubernetes     |
+| 266 | CKV_K8S_11  | PodSecurityPolicy | initContainers                        | CPU limits should be set                                                                                                                                                                                 | Kubernetes     |
+| 267 | CKV_K8S_43  | PodSecurityPolicy | initContainers                        | Image should use digest                                                                                                                                                                                  | Kubernetes     |
+| 268 | CKV_K8S_12  | PodSecurityPolicy | initContainers                        | Memory requests should be set                                                                                                                                                                            | Kubernetes     |
+| 269 | CKV_K8S_35  | PodSecurityPolicy | initContainers                        | Prefer using secrets as files over secrets as environment variables                                                                                                                                      | Kubernetes     |
+| 270 | CKV_K8S_34  | PodSecurityPolicy | initContainers                        | Ensure that Tiller (Helm v2) is not deployed                                                                                                                                                             | Kubernetes     |
+| 271 | CKV_K8S_28  | PodSecurityPolicy | initContainers                        | Minimize the admission of containers with the NET_RAW capability                                                                                                                                         | Kubernetes     |
+| 272 | CKV_K8S_14  | PodSecurityPolicy | initContainers                        | Image Tag should be fixed - not latest or blank                                                                                                                                                          | Kubernetes     |
+| 273 | CKV_K8S_42  | PodSecurityPolicy | RoleBinding                           | Ensure that default service accounts are not actively used                                                                                                                                               | Kubernetes     |
+| 274 | CKV_K8S_21  | PodSecurityPolicy | RoleBinding                           | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 275 | CKV_K8S_42  | PodSecurityPolicy | ClusterRoleBinding                    | Ensure that default service accounts are not actively used                                                                                                                                               | Kubernetes     |
+| 276 | CKV_K8S_21  | PodSecurityPolicy | Service                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 277 | CKV_K8S_21  | PodSecurityPolicy | Secret                                | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 278 | CKV_K8S_21  | PodSecurityPolicy | Role                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 279 | CKV_K8S_21  | PodSecurityPolicy | ConfigMap                             | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 280 | CKV_K8S_21  | PodSecurityPolicy | Ingress                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 
 
 ---


Test patch:
diff --git a/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED-2.yaml b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED-2.yaml
new file mode 100644
index 000000000..f2d103772
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED-2.yaml
@@ -0,0 +1,8 @@
+Resources:
+  ECSCluster:
+    Type: 'AWS::ECS::Cluster'
+    Properties:
+      ClusterName: 'MyCluster'
+      ClusterSettings:
+        - Name: 'containerInsights'
+          Value: 'disabled'
diff --git a/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED.yaml b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED.yaml
new file mode 100644
index 000000000..ff085fad1
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED.yaml
@@ -0,0 +1,5 @@
+Resources:
+  ECSCluster:
+    Type: 'AWS::ECS::Cluster'
+    Properties:
+      ClusterName: 'MyCluster'
diff --git a/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-PASSED.yaml b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-PASSED.yaml
new file mode 100644
index 000000000..2eb0fe40e
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-PASSED.yaml
@@ -0,0 +1,8 @@
+Resources:
+  ECSCluster:
+    Type: 'AWS::ECS::Cluster'
+    Properties:
+      ClusterName: 'MyCluster'
+      ClusterSettings:
+        - Name: 'containerInsights'
+          Value: 'enabled'
diff --git a/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-FAIL.yaml b/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-FAIL.yaml
new file mode 100644
index 000000000..2ac59719b
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-FAIL.yaml
@@ -0,0 +1,10 @@
+Resources:
+  MyDB:
+    Type: 'AWS::RDS::DBInstance'
+    Properties:
+      DBName: 'mydb'
+      DBInstanceClass: 't3.micro'
+      AllocatedStorage: 5
+      Engine: 'mysql'
+      MasterUsername: 'master'
+      MasterUserPassword: 'password'
diff --git a/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-FAILED-2.yaml b/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-FAILED-2.yaml
new file mode 100644
index 000000000..1c4a54e56
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-FAILED-2.yaml
@@ -0,0 +1,11 @@
+Resources:
+  MyDB:
+    Type: 'AWS::RDS::DBInstance'
+    Properties:
+      DBName: 'mydb'
+      DBInstanceClass: 't3.micro'
+      AllocatedStorage: 5
+      Engine: 'mysql'
+      MasterUsername: 'master'
+      MasterUserPassword: 'password'
+      StorageEncrypted: false
diff --git a/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-PASSED.yaml b/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-PASSED.yaml
new file mode 100644
index 000000000..49cba37db
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-PASSED.yaml
@@ -0,0 +1,11 @@
+Resources:
+  MyDB:
+    Type: 'AWS::RDS::DBInstance'
+    Properties:
+      DBName: 'mydb'
+      DBInstanceClass: 't3.micro'
+      AllocatedStorage: 5
+      Engine: 'mysql'
+      MasterUsername: 'master'
+      MasterUserPassword: 'password'
+      StorageEncrypted: true
diff --git a/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-FAIL.yaml b/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-FAIL.yaml
new file mode 100644
index 000000000..9691e0f9a
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-FAIL.yaml
@@ -0,0 +1,11 @@
+Resources:
+  MyDB:
+    Type: 'AWS::RDS::DBInstance'
+    Properties:
+      DBName: 'mydb'
+      DBInstanceClass: 't3.micro'
+      AllocatedStorage: 5
+      Engine: 'mysql'
+      MasterUsername: 'master'
+      MasterUserPassword: 'password'
+      PubliclyAccessible: true
diff --git a/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-PASSED-2.yaml b/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-PASSED-2.yaml
new file mode 100644
index 000000000..8b91a040d
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-PASSED-2.yaml
@@ -0,0 +1,11 @@
+Resources:
+  MyDB:
+    Type: 'AWS::RDS::DBInstance'
+    Properties:
+      DBName: 'mydb'
+      DBInstanceClass: 't3.micro'
+      AllocatedStorage: 5
+      Engine: 'mysql'
+      MasterUsername: 'master'
+      MasterUserPassword: 'password'
+      PubliclyAccessible: false
diff --git a/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-PASSED.yaml b/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-PASSED.yaml
new file mode 100644
index 000000000..2ac59719b
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-PASSED.yaml
@@ -0,0 +1,10 @@
+Resources:
+  MyDB:
+    Type: 'AWS::RDS::DBInstance'
+    Properties:
+      DBName: 'mydb'
+      DBInstanceClass: 't3.micro'
+      AllocatedStorage: 5
+      Engine: 'mysql'
+      MasterUsername: 'master'
+      MasterUserPassword: 'password'
diff --git a/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-FAILED-2.yaml b/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-FAILED-2.yaml
new file mode 100644
index 000000000..66feacfee
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-FAILED-2.yaml
@@ -0,0 +1,10 @@
+Resources:
+  myCluster:
+    Type: "AWS::Redshift::Cluster"
+    Properties:
+      DBName: "mydb"
+      MasterUsername: "master"
+      MasterUserPassword:
+        Ref: "MasterUserPassword"
+      NodeType: "ds2.xlarge"
+      ClusterType: "single-node"
diff --git a/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-FAILED.yaml b/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-FAILED.yaml
new file mode 100644
index 000000000..4ca5e2184
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-FAILED.yaml
@@ -0,0 +1,11 @@
+Resources:
+  myCluster:
+    Type: "AWS::Redshift::Cluster"
+    Properties:
+      DBName: "mydb"
+      MasterUsername: "master"
+      MasterUserPassword:
+        Ref: "MasterUserPassword"
+      NodeType: "ds2.xlarge"
+      ClusterType: "single-node"
+      Encrypted: false
diff --git a/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-PASSED.yaml b/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-PASSED.yaml
new file mode 100644
index 000000000..7a6880d0f
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-PASSED.yaml
@@ -0,0 +1,11 @@
+Resources:
+  myCluster:
+    Type: "AWS::Redshift::Cluster"
+    Properties:
+      DBName: "mydb"
+      MasterUsername: "master"
+      MasterUserPassword:
+        Ref: "MasterUserPassword"
+      NodeType: "ds2.xlarge"
+      ClusterType: "single-node"
+      Encrypted: true
diff --git a/tests/cloudformation/checks/resource/aws/test_ECSClusterContainerInsights.py b/tests/cloudformation/checks/resource/aws/test_ECSClusterContainerInsights.py
new file mode 100644
index 000000000..d8f4ccd6d
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/test_ECSClusterContainerInsights.py
@@ -0,0 +1,26 @@
+import os
+import unittest
+
+from checkov.cloudformation.checks.resource.aws.ECSClusterContainerInsights import check
+from checkov.cloudformation.runner import Runner
+from checkov.runner_filter import RunnerFilter
+
+
+class TestECSClusterContainerInsights(unittest.TestCase):
+
+    def test_summary(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = current_dir + "/example_ECSClusterContainerInsights"
+        report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        self.assertEqual(summary['passed'], 1)
+        self.assertEqual(summary['failed'], 2)
+        self.assertEqual(summary['skipped'], 0)
+        self.assertEqual(summary['parsing_errors'], 0)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/cloudformation/checks/resource/aws/test_RDSEncryption.py b/tests/cloudformation/checks/resource/aws/test_RDSEncryption.py
new file mode 100644
index 000000000..85d5438ee
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/test_RDSEncryption.py
@@ -0,0 +1,26 @@
+import os
+import unittest
+
+from checkov.cloudformation.checks.resource.aws.RDSEncryption import check
+from checkov.cloudformation.runner import Runner
+from checkov.runner_filter import RunnerFilter
+
+
+class TestRDSEncryption(unittest.TestCase):
+
+    def test_summary(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = current_dir + "/example_RDSEncryption"
+        report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        self.assertEqual(summary['passed'], 1)
+        self.assertEqual(summary['failed'], 2)
+        self.assertEqual(summary['skipped'], 0)
+        self.assertEqual(summary['parsing_errors'], 0)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/cloudformation/checks/resource/aws/test_RDSPubliclyAccessible.py b/tests/cloudformation/checks/resource/aws/test_RDSPubliclyAccessible.py
new file mode 100644
index 000000000..604aa85c6
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/test_RDSPubliclyAccessible.py
@@ -0,0 +1,26 @@
+import os
+import unittest
+
+from checkov.cloudformation.checks.resource.aws.RDSPubliclyAccessible import check
+from checkov.cloudformation.runner import Runner
+from checkov.runner_filter import RunnerFilter
+
+
+class TestRDSPubliclyAccessible(unittest.TestCase):
+
+    def test_summary(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = current_dir + "/example_RDSPubliclyAccessible"
+        report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        self.assertEqual(summary['passed'], 2)
+        self.assertEqual(summary['failed'], 1)
+        self.assertEqual(summary['skipped'], 0)
+        self.assertEqual(summary['parsing_errors'], 0)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/cloudformation/checks/resource/aws/test_RedshiftClusterEncryption.py b/tests/cloudformation/checks/resource/aws/test_RedshiftClusterEncryption.py
new file mode 100644
index 000000000..6041578d2
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/test_RedshiftClusterEncryption.py
@@ -0,0 +1,26 @@
+import os
+import unittest
+
+from checkov.cloudformation.checks.resource.aws.RedshiftClusterEncryption import check
+from checkov.cloudformation.runner import Runner
+from checkov.runner_filter import RunnerFilter
+
+
+class TestRedshiftClusterEncryption(unittest.TestCase):
+
+    def test_summary(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = current_dir + "/example_RedshiftClusterEncryption"
+        report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        self.assertEqual(summary['passed'], 1)
+        self.assertEqual(summary['failed'], 2)
+        self.assertEqual(summary['skipped'], 0)
+        self.assertEqual(summary['parsing_errors'], 0)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/terraform/checks/resource/aws/test_ECSClusterContainerInsights.py b/tests/terraform/checks/resource/aws/test_ECSClusterContainerInsights.py
new file mode 100644
index 000000000..1f5b65b5b
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_ECSClusterContainerInsights.py
@@ -0,0 +1,41 @@
+import unittest
+
+import hcl2
+
+from checkov.terraform.checks.resource.aws.ECSClusterContainerInsights import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestECSClusterContainerInsights(unittest.TestCase):
+
+    def test_failure(self):
+        hcl_res = hcl2.loads(
+            """
+            resource "aws_ecs_cluster" "my_cluster" {
+                name = "white-hart"
+            }
+            """
+        )
+        resource_conf = hcl_res['resource'][0]['aws_ecs_cluster']['my_cluster']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        hcl_res = hcl2.loads(
+            """
+            resource "aws_ecs_cluster" "my_cluster" {
+                name = "white-hart"
+                setting {
+                    name = "containerInsights"
+                    value = "enabled"
+                }
+            }
+            """
+        )
+        resource_conf = hcl_res['resource'][0]['aws_ecs_cluster']['my_cluster']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/terraform/checks/resource/aws/test_RedshiftClusterEncryption.py b/tests/terraform/checks/resource/aws/test_RedshiftClusterEncryption.py
new file mode 100644
index 000000000..63caa565f
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_RedshiftClusterEncryption.py
@@ -0,0 +1,36 @@
+import unittest
+
+from checkov.terraform.checks.resource.aws.RedshiftClusterEncryption import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestRedshiftClusterEncryption(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "cluster_identifier": ["tf-redshift-cluster"],
+            "database_name": ["mydb"],
+            "master_username": ["foo"],
+            "master_password": ["Mustbe8characters"],
+            "node_type": ["dc1.large"],
+            "cluster_type": ["single-node"]
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "cluster_identifier": ["tf-redshift-cluster"],
+            "database_name": ["mydb"],
+            "master_username": ["foo"],
+            "master_password": ["Mustbe8characters"],
+            "node_type": ["dc1.large"],
+            "cluster_type": ["single-node"],
+            "encryption": [True]
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == "__main__":
+    unittest.main()