| 0 |
CKV_AWS_1 |
data |
aws_iam_policy_document |
Ensure IAM policies that allow full “-” administrative privileges are not created |
Terraform |
| 1 |
CKV_AWS_1 |
resource |
serverless_aws |
Ensure IAM policies that allow full “-” administrative privileges are not created |
serverless |
| 2 |
CKV_AWS_2 |
resource |
AWS::ElasticLoadBalancingV2::Listener |
Ensure ALB protocol is HTTPS |
Cloudformation |
| 3 |
CKV_AWS_2 |
resource |
aws_alb_listener |
Ensure ALB protocol is HTTPS |
Terraform |
| 4 |
CKV_AWS_2 |
resource |
aws_lb_listener |
Ensure ALB protocol is HTTPS |
Terraform |
| 5 |
CKV_AWS_3 |
resource |
AWS::EC2::Volume |
Ensure all data stored in the EBS is securely encrypted |
Cloudformation |
| 6 |
CKV_AWS_3 |
resource |
aws_ebs_volume |
Ensure all data stored in the EBS is securely encrypted |
Terraform |
| 7 |
CKV_AWS_5 |
resource |
AWS::Elasticsearch::Domain |
Ensure all data stored in the Elasticsearch is securely encrypted at rest |
Cloudformation |
| 8 |
CKV_AWS_5 |
resource |
aws_elasticsearch_domain |
Ensure all data stored in the Elasticsearch is securely encrypted at rest |
Terraform |
| 9 |
CKV_AWS_6 |
resource |
AWS::Elasticsearch::Domain |
Ensure all Elasticsearch has node-to-node encryption enabled |
Cloudformation |
| 10 |
CKV_AWS_6 |
resource |
aws_elasticsearch_domain |
Ensure all Elasticsearch has node-to-node encryption enabled |
Terraform |
| 11 |
CKV_AWS_7 |
resource |
AWS::KMS::Key |
Ensure rotation for customer created CMKs is enabled |
Cloudformation |
| 12 |
CKV_AWS_7 |
resource |
aws_kms_key |
Ensure rotation for customer created CMKs is enabled |
Terraform |
| 13 |
CKV_AWS_8 |
resource |
AWS::AutoScaling::LaunchConfiguration |
Ensure all data stored in the Launch configuration EBS is securely encrypted |
Cloudformation |
| 14 |
CKV_AWS_8 |
resource |
aws_instance |
Ensure all data stored in the Launch configuration EBS is securely encrypted |
Terraform |
| 15 |
CKV_AWS_8 |
resource |
aws_launch_configuration |
Ensure all data stored in the Launch configuration EBS is securely encrypted |
Terraform |
| 16 |
CKV_AWS_9 |
resource |
aws_iam_account_password_policy |
Ensure IAM password policy expires passwords within 90 days or less |
Terraform |
| 17 |
CKV_AWS_10 |
resource |
aws_iam_account_password_policy |
Ensure IAM password policy requires minimum length of 14 or greater |
Terraform |
| 18 |
CKV_AWS_11 |
resource |
aws_iam_account_password_policy |
Ensure IAM password policy requires at least one lowercase letter |
Terraform |
| 19 |
CKV_AWS_12 |
resource |
aws_iam_account_password_policy |
Ensure IAM password policy requires at least one number |
Terraform |
| 20 |
CKV_AWS_13 |
resource |
aws_iam_account_password_policy |
Ensure IAM password policy prevents password reuse |
Terraform |
| 21 |
CKV_AWS_14 |
resource |
aws_iam_account_password_policy |
Ensure IAM password policy requires at least one symbol |
Terraform |
| 22 |
CKV_AWS_15 |
resource |
aws_iam_account_password_policy |
Ensure IAM password policy requires at least one uppercase letter |
Terraform |
| 23 |
CKV_AWS_16 |
resource |
AWS::RDS::DBInstance |
Ensure all data stored in the RDS is securely encrypted at rest |
Cloudformation |
| 24 |
CKV_AWS_16 |
resource |
aws_db_instance |
Ensure all data stored in the RDS is securely encrypted at rest |
Terraform |
| 25 |
CKV_AWS_17 |
resource |
AWS::RDS::DBInstance |
Ensure all data stored in RDS is not publicly accessible |
Cloudformation |
| 26 |
CKV_AWS_17 |
resource |
aws_db_instance |
Ensure all data stored in RDS is not publicly accessible |
Terraform |
| 27 |
CKV_AWS_17 |
resource |
aws_rds_cluster_instance |
Ensure all data stored in RDS is not publicly accessible |
Terraform |
| 28 |
CKV_AWS_18 |
resource |
AWS::S3::Bucket |
Ensure the S3 bucket has access logging enabled |
Cloudformation |
| 29 |
CKV_AWS_18 |
resource |
aws_s3_bucket |
Ensure the S3 bucket has access logging enabled |
Terraform |
| 30 |
CKV_AWS_19 |
resource |
AWS::S3::Bucket |
Ensure the S3 bucket has server-side-encryption enabled |
Cloudformation |
| 31 |
CKV_AWS_19 |
resource |
aws_s3_bucket |
Ensure all data stored in the S3 bucket is securely encrypted at rest |
Terraform |
| 32 |
CKV_AWS_20 |
resource |
AWS::S3::Bucket |
Ensure the S3 bucket does not allow READ permissions to everyone |
Cloudformation |
| 33 |
CKV_AWS_20 |
resource |
aws_s3_bucket |
S3 Bucket has an ACL defined which allows public READ access. |
Terraform |
| 34 |
CKV_AWS_21 |
resource |
AWS::S3::Bucket |
Ensure the S3 bucket has versioning enabled |
Cloudformation |
| 35 |
CKV_AWS_21 |
resource |
aws_s3_bucket |
Ensure all data stored in the S3 bucket have versioning enabled |
Terraform |
| 36 |
CKV_AWS_22 |
resource |
aws_sagemaker_notebook_instance |
Ensure SageMaker Notebook is encrypted at rest using KMS CMK |
Terraform |
| 37 |
CKV_AWS_23 |
resource |
AWS::EC2::SecurityGroup |
Ensure every security groups rule has a description |
Cloudformation |
| 38 |
CKV_AWS_23 |
resource |
AWS::EC2::SecurityGroupEgress |
Ensure every security groups rule has a description |
Cloudformation |
| 39 |
CKV_AWS_23 |
resource |
AWS::EC2::SecurityGroupIngress |
Ensure every security groups rule has a description |
Cloudformation |
| 40 |
CKV_AWS_23 |
resource |
aws_db_security_group |
Ensure every security groups rule has a description |
Terraform |
| 41 |
CKV_AWS_23 |
resource |
aws_elasticache_security_group |
Ensure every security groups rule has a description |
Terraform |
| 42 |
CKV_AWS_23 |
resource |
aws_redshift_security_group |
Ensure every security groups rule has a description |
Terraform |
| 43 |
CKV_AWS_23 |
resource |
aws_security_group |
Ensure every security groups rule has a description |
Terraform |
| 44 |
CKV_AWS_23 |
resource |
aws_security_group_rule |
Ensure every security groups rule has a description |
Terraform |
| 45 |
CKV_AWS_24 |
resource |
AWS::EC2::SecurityGroup |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 |
Cloudformation |
| 46 |
CKV_AWS_24 |
resource |
AWS::EC2::SecurityGroupIngress |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 |
Cloudformation |
| 47 |
CKV_AWS_24 |
resource |
aws_security_group |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 |
Terraform |
| 48 |
CKV_AWS_24 |
resource |
aws_security_group_rule |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 |
Terraform |
| 49 |
CKV_AWS_25 |
resource |
AWS::EC2::SecurityGroup |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 |
Cloudformation |
| 50 |
CKV_AWS_25 |
resource |
AWS::EC2::SecurityGroupIngress |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 |
Cloudformation |
| 51 |
CKV_AWS_25 |
resource |
aws_security_group |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 |
Terraform |
| 52 |
CKV_AWS_25 |
resource |
aws_security_group_rule |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 |
Terraform |
| 53 |
CKV_AWS_26 |
resource |
AWS::SNS::Topic |
Ensure all data stored in the SNS topic is encrypted |
Cloudformation |
| 54 |
CKV_AWS_26 |
resource |
aws_sns_topic |
Ensure all data stored in the SNS topic is encrypted |
Terraform |
| 55 |
CKV_AWS_27 |
resource |
AWS::SQS::Queue |
Ensure all data stored in the SQS queue is encrypted |
Cloudformation |
| 56 |
CKV_AWS_27 |
resource |
aws_sqs_queue |
Ensure all data stored in the SQS queue is encrypted |
Terraform |
| 57 |
CKV_AWS_28 |
resource |
AWS::DynamoDB::Table |
Ensure Dynamodb point in time recovery (backup) is enabled |
Cloudformation |
| 58 |
CKV_AWS_28 |
resource |
aws_dynamodb_table |
Ensure Dynamodb point in time recovery (backup) is enabled |
Terraform |
| 59 |
CKV_AWS_29 |
resource |
AWS::ElastiCache::ReplicationGroup |
Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest |
Cloudformation |
| 60 |
CKV_AWS_29 |
resource |
aws_elasticache_replication_group |
Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest |
Terraform |
| 61 |
CKV_AWS_30 |
resource |
AWS::ElastiCache::ReplicationGroup |
Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit |
Cloudformation |
| 62 |
CKV_AWS_30 |
resource |
aws_elasticache_replication_group |
Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit |
Terraform |
| 63 |
CKV_AWS_31 |
resource |
AWS::ElastiCache::ReplicationGroup |
Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token |
Cloudformation |
| 64 |
CKV_AWS_31 |
resource |
aws_elasticache_replication_group |
Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token |
Terraform |
| 65 |
CKV_AWS_32 |
resource |
AWS::ECR::Repository |
Ensure ECR policy is not set to public |
Cloudformation |
| 66 |
CKV_AWS_32 |
resource |
aws_ecr_repository_policy |
Ensure ECR policy is not set to public |
Terraform |
| 67 |
CKV_AWS_33 |
resource |
AWS::KMS::Key |
Ensure KMS key policy does not contain wildcard (*) principal |
Cloudformation |
| 68 |
CKV_AWS_33 |
resource |
aws_kms_key |
Ensure KMS key policy does not contain wildcard (*) principal |
Terraform |
| 69 |
CKV_AWS_34 |
resource |
AWS::CloudFront::Distribution |
Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS |
Cloudformation |
| 70 |
CKV_AWS_34 |
resource |
aws_cloudfront_distribution |
Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS |
Terraform |
| 71 |
CKV_AWS_35 |
resource |
AWS::CloudTrail::Trail |
Ensure CloudTrail logs are encrypted at rest using KMS CMKs |
Cloudformation |
| 72 |
CKV_AWS_35 |
resource |
aws_cloudtrail |
Ensure CloudTrail logs are encrypted at rest using KMS CMKs |
Terraform |
| 73 |
CKV_AWS_36 |
resource |
AWS::CloudTrail::Trail |
Ensure CloudTrail log file validation is enabled |
Cloudformation |
| 74 |
CKV_AWS_36 |
resource |
aws_cloudtrail |
Ensure CloudTrail log file validation is enabled |
Terraform |
| 75 |
CKV_AWS_37 |
resource |
aws_eks_cluster |
Ensure Amazon EKS control plane logging enabled for all log types |
Terraform |
| 76 |
CKV_AWS_38 |
resource |
aws_eks_cluster |
Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 |
Terraform |
| 77 |
CKV_AWS_39 |
resource |
aws_eks_cluster |
Ensure Amazon EKS public endpoint disabled |
Terraform |
| 78 |
CKV_AWS_40 |
resource |
AWS::IAM::Policy |
Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) |
Cloudformation |
| 79 |
CKV_AWS_40 |
resource |
aws_iam_policy_attachment |
Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) |
Terraform |
| 80 |
CKV_AWS_40 |
resource |
aws_iam_user_policy |
Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) |
Terraform |
| 81 |
CKV_AWS_40 |
resource |
aws_iam_user_policy_attachment |
Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) |
Terraform |
| 82 |
CKV_AWS_41 |
provider |
aws |
Ensure no hard coded AWS access key and secret key exists in provider |
Terraform |
| 83 |
CKV_AWS_41 |
resource |
serverless_aws |
Ensure no hard coded AWS access key and secret key exists in provider |
serverless |
| 84 |
CKV_AWS_42 |
resource |
AWS::EFS::FileSystem |
Ensure EFS is securely encrypted |
Cloudformation |
| 85 |
CKV_AWS_42 |
resource |
aws_efs_file_system |
Ensure EFS is securely encrypted |
Terraform |
| 86 |
CKV_AWS_43 |
resource |
AWS::Kinesis::Stream |
Ensure Kinesis Stream is securely encrypted |
Cloudformation |
| 87 |
CKV_AWS_43 |
resource |
aws_kinesis_stream |
Ensure Kinesis Stream is securely encrypted |
Terraform |
| 88 |
CKV_AWS_44 |
resource |
AWS::Neptune::DBCluster |
Ensure Neptune storage is securely encrypted |
Cloudformation |
| 89 |
CKV_AWS_44 |
resource |
aws_neptune_cluster |
Ensure Neptune storage is securely encrypted |
Terraform |
| 90 |
CKV_AWS_45 |
resource |
AWS::Lambda::Function |
Ensure no hard-coded secrets exist in lambda environment |
Cloudformation |
| 91 |
CKV_AWS_45 |
resource |
AWS::Serverless::Function |
Ensure no hard-coded secrets exist in lambda environment |
Cloudformation |
| 92 |
CKV_AWS_45 |
resource |
aws_lambda_function |
Ensure no hard-coded secrets exist in lambda environment |
Terraform |
| 93 |
CKV_AWS_46 |
resource |
AWS::EC2::Instance |
Ensure no hard-coded secrets exist in EC2 user data |
Cloudformation |
| 94 |
CKV_AWS_46 |
resource |
aws_instance |
Ensure no hard-coded secrets exist in EC2 user data |
Terraform |
| 95 |
CKV_AWS_47 |
resource |
AWS::DAX::Cluster |
Ensure DAX is encrypted at rest (default is unencrypted) |
Cloudformation |
| 96 |
CKV_AWS_47 |
resource |
aws_dax_cluster |
Ensure DAX is encrypted at rest (default is unencrypted) |
Terraform |
| 97 |
CKV_AWS_48 |
resource |
aws_mq_broker |
Ensure MQ Broker logging is enabled |
Terraform |
| 98 |
CKV_AWS_49 |
data |
aws_iam_policy_document |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Terraform |
| 99 |
CKV_AWS_49 |
resource |
serverless_aws |
Ensure no IAM policies documents allow “*” as a statement’s actions |
serverless |
| 100 |
CKV_AWS_50 |
resource |
aws_lambda_function |
X-ray tracing is enabled for Lambda |
Terraform |
| 101 |
CKV_AWS_51 |
resource |
AWS::ECR::Repository |
Ensure ECR Image Tags are immutable |
Cloudformation |
| 102 |
CKV_AWS_51 |
resource |
aws_ecr_repository |
Ensure ECR Image Tags are immutable |
Terraform |
| 103 |
CKV_AWS_53 |
resource |
AWS::S3::Bucket |
Ensure S3 bucket has block public ACLS enabled |
Cloudformation |
| 104 |
CKV_AWS_53 |
resource |
aws_s3_bucket_public_access_block |
Ensure S3 bucket has block public ACLS enabled |
Terraform |
| 105 |
CKV_AWS_54 |
resource |
AWS::S3::Bucket |
Ensure S3 bucket has block public policy enabled |
Cloudformation |
| 106 |
CKV_AWS_54 |
resource |
aws_s3_bucket_public_access_block |
Ensure S3 bucket has block public policy enabled |
Terraform |
| 107 |
CKV_AWS_55 |
resource |
AWS::S3::Bucket |
Ensure S3 bucket has ignore public ACLs enabled |
Cloudformation |
| 108 |
CKV_AWS_55 |
resource |
aws_s3_bucket_public_access_block |
Ensure S3 bucket has ignore public ACLs enabled |
Terraform |
| 109 |
CKV_AWS_56 |
resource |
AWS::S3::Bucket |
Ensure S3 bucket has ‘restrict_public_bucket’ enabled |
Cloudformation |
| 110 |
CKV_AWS_56 |
resource |
aws_s3_bucket_public_access_block |
Ensure S3 bucket has ‘restrict_public_bucket’ enabled |
Terraform |
| 111 |
CKV_AWS_57 |
resource |
AWS::S3::Bucket |
Ensure the S3 bucket does not allow WRITE permissions to everyone |
Cloudformation |
| 112 |
CKV_AWS_57 |
resource |
aws_s3_bucket |
S3 Bucket has an ACL defined which allows public WRITE access. |
Terraform |
| 113 |
CKV_AWS_58 |
resource |
AWS::EKS::Cluster |
Ensure EKS Cluster has Secrets Encryption Enabled |
Cloudformation |
| 114 |
CKV_AWS_58 |
resource |
aws_eks_cluster |
Ensure EKS Cluster has Secrets Encryption Enabled |
Terraform |
| 115 |
CKV_AWS_59 |
resource |
AWS::ApiGateway::Method |
Ensure there is no open access to back-end resources through API |
Cloudformation |
| 116 |
CKV_AWS_59 |
resource |
aws_api_gateway_method |
Ensure there is no open access to back-end resources through API |
Terraform |
| 117 |
CKV_AWS_60 |
resource |
AWS::IAM::Role |
Ensure IAM role allows only specific services or principals to assume it |
Cloudformation |
| 118 |
CKV_AWS_60 |
resource |
aws_iam_role |
Ensure IAM role allows only specific services or principals to assume it |
Terraform |
| 119 |
CKV_AWS_61 |
resource |
AWS::IAM::Role |
Ensure IAM role allows only specific principals in account to assume it |
Cloudformation |
| 120 |
CKV_AWS_61 |
resource |
aws_iam_role |
Ensure IAM role allows only specific principals in account to assume it |
Terraform |
| 121 |
CKV_AWS_62 |
resource |
AWS::IAM::Group |
Ensure no IAM policies that allow full “-” administrative privileges are not created |
Cloudformation |
| 122 |
CKV_AWS_62 |
resource |
AWS::IAM::Policy |
Ensure no IAM policies that allow full “-” administrative privileges are not created |
Cloudformation |
| 123 |
CKV_AWS_62 |
resource |
AWS::IAM::Role |
Ensure no IAM policies that allow full “-” administrative privileges are not created |
Cloudformation |
| 124 |
CKV_AWS_62 |
resource |
AWS::IAM::User |
Ensure no IAM policies that allow full “-” administrative privileges are not created |
Cloudformation |
| 125 |
CKV_AWS_62 |
resource |
aws_iam_group_policy |
Ensure IAM policies that allow full “-” administrative privileges are not created |
Terraform |
| 126 |
CKV_AWS_62 |
resource |
aws_iam_policy |
Ensure IAM policies that allow full “-” administrative privileges are not created |
Terraform |
| 127 |
CKV_AWS_62 |
resource |
aws_iam_role_policy |
Ensure IAM policies that allow full “-” administrative privileges are not created |
Terraform |
| 128 |
CKV_AWS_62 |
resource |
aws_iam_user_policy |
Ensure IAM policies that allow full “-” administrative privileges are not created |
Terraform |
| 129 |
CKV_AWS_62 |
resource |
aws_ssoadmin_permission_set_inline_policy |
Ensure IAM policies that allow full “-” administrative privileges are not created |
Terraform |
| 130 |
CKV_AWS_63 |
resource |
AWS::IAM::Group |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Cloudformation |
| 131 |
CKV_AWS_63 |
resource |
AWS::IAM::Policy |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Cloudformation |
| 132 |
CKV_AWS_63 |
resource |
AWS::IAM::Role |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Cloudformation |
| 133 |
CKV_AWS_63 |
resource |
AWS::IAM::User |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Cloudformation |
| 134 |
CKV_AWS_63 |
resource |
aws_iam_group_policy |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Terraform |
| 135 |
CKV_AWS_63 |
resource |
aws_iam_policy |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Terraform |
| 136 |
CKV_AWS_63 |
resource |
aws_iam_role_policy |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Terraform |
| 137 |
CKV_AWS_63 |
resource |
aws_iam_user_policy |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Terraform |
| 138 |
CKV_AWS_63 |
resource |
aws_ssoadmin_permission_set_inline_policy |
Ensure no IAM policies documents allow “*” as a statement’s actions |
Terraform |
| 139 |
CKV_AWS_64 |
resource |
AWS::Redshift::Cluster |
Ensure all data stored in the Redshift cluster is securely encrypted at rest |
Cloudformation |
| 140 |
CKV_AWS_64 |
resource |
aws_redshift_cluster |
Ensure all data stored in the Redshift cluster is securely encrypted at rest |
Terraform |
| 141 |
CKV_AWS_65 |
resource |
AWS::ECS::Cluster |
Ensure container insights are enabled on ECS cluster |
Cloudformation |
| 142 |
CKV_AWS_65 |
resource |
aws_ecs_cluster |
Ensure container insights are enabled on ECS cluster |
Terraform |
| 143 |
CKV_AWS_66 |
resource |
AWS::Logs::LogGroup |
Ensure that CloudWatch Log Group specifies retention days |
Cloudformation |
| 144 |
CKV_AWS_66 |
resource |
aws_cloudwatch_log_group |
Ensure that CloudWatch Log Group specifies retention days |
Terraform |
| 145 |
CKV_AWS_67 |
resource |
AWS::CloudTrail::Trail |
Ensure CloudTrail is enabled in all Regions |
Cloudformation |
| 146 |
CKV_AWS_67 |
resource |
aws_cloudtrail |
Ensure CloudTrail is enabled in all Regions |
Terraform |
| 147 |
CKV_AWS_68 |
resource |
AWS::CloudFront::Distribution |
CloudFront Distribution should have WAF enabled |
Cloudformation |
| 148 |
CKV_AWS_68 |
resource |
aws_cloudfront_distribution |
CloudFront Distribution should have WAF enabled |
Terraform |
| 149 |
CKV_AWS_69 |
resource |
AWS::AmazonMQ::Broker |
Ensure Amazon MQ Broker should not have public access |
Cloudformation |
| 150 |
CKV_AWS_69 |
resource |
aws_mq_broker |
Ensure MQ Broker is not publicly exposed |
Terraform |
| 151 |
CKV_AWS_70 |
resource |
aws_s3_bucket |
Ensure S3 bucket does not allow an action with any Principal |
Terraform |
| 152 |
CKV_AWS_70 |
resource |
aws_s3_bucket_policy |
Ensure S3 bucket does not allow an action with any Principal |
Terraform |
| 153 |
CKV_AWS_71 |
resource |
AWS::Redshift::Cluster |
Ensure Redshift Cluster logging is enabled |
Cloudformation |
| 154 |
CKV_AWS_71 |
resource |
aws_redshift_cluster |
Ensure Redshift Cluster logging is enabled |
Terraform |
| 155 |
CKV_AWS_72 |
resource |
aws_sqs_queue_policy |
Ensure SQS policy does not allow ALL (*) actions. |
Terraform |
| 156 |
CKV_AWS_73 |
resource |
AWS::ApiGateway::Stage |
Ensure API Gateway has X-Ray Tracing enabled |
Cloudformation |
| 157 |
CKV_AWS_73 |
resource |
AWS::Serverless::Api |
Ensure API Gateway has X-Ray Tracing enabled |
Cloudformation |
| 158 |
CKV_AWS_73 |
resource |
aws_api_gateway_stage |
Ensure API Gateway has X-Ray Tracing enabled |
Terraform |
| 159 |
CKV_AWS_74 |
resource |
AWS::DocDB::DBCluster |
Ensure DocDB is encrypted at rest (default is unencrypted) |
Cloudformation |
| 160 |
CKV_AWS_74 |
resource |
aws_docdb_cluster |
Ensure DocDB is encrypted at rest (default is unencrypted) |
Terraform |
| 161 |
CKV_AWS_75 |
resource |
aws_globalaccelerator_accelerator |
Ensure Global Accelerator accelerator has flow logs enabled |
Terraform |
| 162 |
CKV_AWS_76 |
resource |
AWS::ApiGateway::Stage |
Ensure API Gateway has Access Logging enabled |
Cloudformation |
| 163 |
CKV_AWS_76 |
resource |
AWS::Serverless::Api |
Ensure API Gateway has Access Logging enabled |
Cloudformation |
| 164 |
CKV_AWS_76 |
resource |
aws_api_gateway_stage |
Ensure API Gateway has Access Logging enabled |
Terraform |
| 165 |
CKV_AWS_76 |
resource |
aws_apigatewayv2_stage |
Ensure API Gateway has Access Logging enabled |
Terraform |
| 166 |
CKV_AWS_77 |
resource |
aws_athena_database |
Ensure Athena Database is encrypted at rest (default is unencrypted) |
Terraform |
| 167 |
CKV_AWS_78 |
resource |
AWS::CodeBuild::Project |
Ensure that CodeBuild Project encryption is not disabled |
Cloudformation |
| 168 |
CKV_AWS_78 |
resource |
aws_codebuild_project |
Ensure that CodeBuild Project encryption is not disabled |
Terraform |
| 169 |
CKV_AWS_79 |
resource |
AWS::EC2::LaunchTemplate |
Ensure Instance Metadata Service Version 1 is not enabled |
Cloudformation |
| 170 |
CKV_AWS_79 |
resource |
aws_instance |
Ensure Instance Metadata Service Version 1 is not enabled |
Terraform |
| 171 |
CKV_AWS_79 |
resource |
aws_launch_template |
Ensure Instance Metadata Service Version 1 is not enabled |
Terraform |
| 172 |
CKV_AWS_80 |
resource |
aws_msk_cluster |
Ensure MSK Cluster logging is enabled |
Terraform |
| 173 |
CKV_AWS_81 |
resource |
aws_msk_cluster |
Ensure MSK Cluster encryption in rest and transit is enabled |
Terraform |
| 174 |
CKV_AWS_82 |
resource |
AWS::Athena::WorkGroup |
Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption |
Cloudformation |
| 175 |
CKV_AWS_82 |
resource |
aws_athena_workgroup |
Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption |
Terraform |
| 176 |
CKV_AWS_83 |
resource |
AWS::Elasticsearch::Domain |
Ensure Elasticsearch Domain enforces HTTPS |
Cloudformation |
| 177 |
CKV_AWS_83 |
resource |
aws_elasticsearch_domain |
Ensure Elasticsearch Domain enforces HTTPS |
Terraform |
| 178 |
CKV_AWS_84 |
resource |
AWS::Elasticsearch::Domain |
Ensure Elasticsearch Domain Logging is enabled |
Cloudformation |
| 179 |
CKV_AWS_84 |
resource |
aws_elasticsearch_domain |
Ensure Elasticsearch Domain Logging is enabled |
Terraform |
| 180 |
CKV_AWS_85 |
resource |
AWS::DocDB::DBCluster |
Ensure DocDB Logging is enabled |
Cloudformation |
| 181 |
CKV_AWS_85 |
resource |
aws_docdb_cluster |
Ensure DocDB Logging is enabled |
Terraform |
| 182 |
CKV_AWS_86 |
resource |
AWS::CloudFront::Distribution |
Ensure Cloudfront distribution has Access Logging enabled |
Cloudformation |
| 183 |
CKV_AWS_86 |
resource |
aws_cloudfront_distribution |
Ensure Cloudfront distribution has Access Logging enabled |
Terraform |
| 184 |
CKV_AWS_87 |
resource |
AWS::Redshift::Cluster |
Redshift cluster should not be publicly accessible |
Cloudformation |
| 185 |
CKV_AWS_87 |
resource |
aws_redshift_cluster |
Redshift cluster should not be publicly accessible |
Terraform |
| 186 |
CKV_AWS_88 |
resource |
AWS::EC2::Instance |
EC2 instance should not have public IP. |
Cloudformation |
| 187 |
CKV_AWS_88 |
resource |
AWS::EC2::LaunchTemplate |
EC2 instance should not have public IP. |
Cloudformation |
| 188 |
CKV_AWS_88 |
resource |
aws_instance |
EC2 instance should not have public IP. |
Terraform |
| 189 |
CKV_AWS_88 |
resource |
aws_launch_template |
EC2 instance should not have public IP. |
Terraform |
| 190 |
CKV_AWS_89 |
resource |
AWS::DMS::ReplicationInstance |
DMS replication instance should not be publicly accessible |
Cloudformation |
| 191 |
CKV_AWS_89 |
resource |
aws_dms_replication_instance |
DMS replication instance should not be publicly accessible |
Terraform |
| 192 |
CKV_AWS_90 |
resource |
AWS::DocDB::DBClusterParameterGroup |
Ensure DocDB TLS is not disabled |
Cloudformation |
| 193 |
CKV_AWS_90 |
resource |
aws_docdb_cluster_parameter_group |
Ensure DocDB TLS is not disabled |
Terraform |
| 194 |
CKV_AWS_91 |
resource |
AWS::ElasticLoadBalancingV2::LoadBalancer |
Ensure the ELBv2 (Application/Network) has access logging enabled |
Cloudformation |
| 195 |
CKV_AWS_91 |
resource |
aws_alb |
Ensure the ELBv2 (Application/Network) has access logging enabled |
Terraform |
| 196 |
CKV_AWS_91 |
resource |
aws_lb |
Ensure the ELBv2 (Application/Network) has access logging enabled |
Terraform |
| 197 |
CKV_AWS_92 |
resource |
AWS::ElasticLoadBalancing::LoadBalancer |
Ensure the ELB has access logging enabled |
Cloudformation |
| 198 |
CKV_AWS_92 |
resource |
aws_elb |
Ensure the ELB has access logging enabled |
Terraform |
| 199 |
CKV_AWS_93 |
resource |
aws_s3_bucket |
Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) |
Terraform |
| 200 |
CKV_AWS_93 |
resource |
aws_s3_bucket_policy |
Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) |
Terraform |
| 201 |
CKV_AWS_94 |
resource |
AWS::Glue::DataCatalogEncryptionSettings |
Ensure Glue Data Catalog Encryption is enabled |
Cloudformation |
| 202 |
CKV_AWS_94 |
resource |
aws_glue_data_catalog_encryption_settings |
Ensure Glue Data Catalog Encryption is enabled |
Terraform |
| 203 |
CKV_AWS_95 |
resource |
AWS::ApiGatewayV2::Stage |
Ensure API Gateway V2 has Access Logging enabled |
Cloudformation |
| 204 |
CKV_AWS_95 |
resource |
AWS::Serverless::HttpApi |
Ensure API Gateway V2 has Access Logging enabled |
Cloudformation |
| 205 |
CKV_AWS_96 |
resource |
AWS::RDS::DBCluster |
Ensure all data stored in Aurora is securely encrypted at rest |
Cloudformation |
| 206 |
CKV_AWS_96 |
resource |
aws_rds_cluster |
Ensure all data stored in Aurora is securely encrypted at rest |
Terraform |
| 207 |
CKV_AWS_97 |
resource |
AWS::ECS::TaskDefinition |
Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions |
Cloudformation |
| 208 |
CKV_AWS_97 |
resource |
aws_ecs_task_definition |
Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions |
Terraform |
| 209 |
CKV_AWS_98 |
resource |
aws_sagemaker_endpoint_configuration |
Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest |
Terraform |
| 210 |
CKV_AWS_99 |
resource |
AWS::Glue::SecurityConfiguration |
Ensure Glue Security Configuration Encryption is enabled |
Cloudformation |
| 211 |
CKV_AWS_99 |
resource |
aws_glue_security_configuration |
Ensure Glue Security Configuration Encryption is enabled |
Terraform |
| 212 |
CKV_AWS_100 |
resource |
AWS::EKS::Nodegroup |
Ensure Amazon EKS Node group has implicit SSH access from 0.0.0.0/0 |
Cloudformation |
| 213 |
CKV_AWS_100 |
resource |
aws_eks_node_group |
Ensure Amazon EKS Node group has implicit SSH access from 0.0.0.0/0 |
Terraform |
| 214 |
CKV_AWS_101 |
resource |
AWS::Neptune::DBCluster |
Ensure Neptune logging is enabled |
Cloudformation |
| 215 |
CKV_AWS_101 |
resource |
aws_neptune_cluster |
Ensure Neptune logging is enabled |
Terraform |
| 216 |
CKV_AWS_102 |
resource |
aws_neptune_cluster_instance |
Ensure Neptune Cluster instance is not publicly available |
Terraform |
| 217 |
CKV_AWS_103 |
resource |
AWS::ElasticLoadBalancingV2::Listener |
Ensure that Application Load Balancer Listener is using TLS v1.2 |
Cloudformation |
| 218 |
CKV_AWS_103 |
resource |
aws_alb_listener |
Ensure that load balancer is using TLS 1.2 |
Terraform |
| 219 |
CKV_AWS_103 |
resource |
aws_lb_listener |
Ensure that load balancer is using TLS 1.2 |
Terraform |
| 220 |
CKV_AWS_104 |
resource |
AWS::DocDB::DBClusterParameterGroup |
Ensure DocDB has audit logs enabled |
Cloudformation |
| 221 |
CKV_AWS_104 |
resource |
aws_docdb_cluster_parameter_group |
Ensure DocDB has audit logs enabled |
Terraform |
| 222 |
CKV_AWS_105 |
resource |
AWS::Redshift::ClusterParameterGroup |
Ensure Redshift uses SSL |
Cloudformation |
| 223 |
CKV_AWS_105 |
resource |
aws_redshift_parameter_group |
Ensure Redshift uses SSL |
Terraform |
| 224 |
CKV_AWS_106 |
resource |
aws_ebs_encryption_by_default |
Ensure EBS default encryption is enabled |
Terraform |
| 225 |
CKV_AWS_107 |
resource |
AWS::IAM::Group |
Ensure IAM policies does not allow credentials exposure |
Cloudformation |
| 226 |
CKV_AWS_107 |
resource |
AWS::IAM::ManagedPolicy |
Ensure IAM policies does not allow credentials exposure |
Cloudformation |
| 227 |
CKV_AWS_107 |
resource |
AWS::IAM::Policy |
Ensure IAM policies does not allow credentials exposure |
Cloudformation |
| 228 |
CKV_AWS_107 |
resource |
AWS::IAM::Role |
Ensure IAM policies does not allow credentials exposure |
Cloudformation |
| 229 |
CKV_AWS_107 |
resource |
AWS::IAM::User |
Ensure IAM policies does not allow credentials exposure |
Cloudformation |
| 230 |
CKV_AWS_107 |
data |
aws_iam_policy_document |
Ensure IAM policies does not allow credentials exposure |
Terraform |
| 231 |
CKV_AWS_108 |
resource |
AWS::IAM::Group |
Ensure IAM policies does not allow data exfiltration |
Cloudformation |
| 232 |
CKV_AWS_108 |
resource |
AWS::IAM::ManagedPolicy |
Ensure IAM policies does not allow data exfiltration |
Cloudformation |
| 233 |
CKV_AWS_108 |
resource |
AWS::IAM::Policy |
Ensure IAM policies does not allow data exfiltration |
Cloudformation |
| 234 |
CKV_AWS_108 |
resource |
AWS::IAM::Role |
Ensure IAM policies does not allow data exfiltration |
Cloudformation |
| 235 |
CKV_AWS_108 |
resource |
AWS::IAM::User |
Ensure IAM policies does not allow data exfiltration |
Cloudformation |
| 236 |
CKV_AWS_108 |
data |
aws_iam_policy_document |
Ensure IAM policies does not allow data exfiltration |
Terraform |
| 237 |
CKV_AWS_109 |
resource |
AWS::IAM::Group |
Ensure IAM policies does not allow permissions management without constraints |
Cloudformation |
| 238 |
CKV_AWS_109 |
resource |
AWS::IAM::ManagedPolicy |
Ensure IAM policies does not allow permissions management without constraints |
Cloudformation |
| 239 |
CKV_AWS_109 |
resource |
AWS::IAM::Policy |
Ensure IAM policies does not allow permissions management without constraints |
Cloudformation |
| 240 |
CKV_AWS_109 |
resource |
AWS::IAM::Role |
Ensure IAM policies does not allow permissions management without constraints |
Cloudformation |
| 241 |
CKV_AWS_109 |
resource |
AWS::IAM::User |
Ensure IAM policies does not allow permissions management without constraints |
Cloudformation |
| 242 |
CKV_AWS_109 |
data |
aws_iam_policy_document |
Ensure IAM policies does not allow permissions management / resource exposure without constraints |
Terraform |
| 243 |
CKV_AWS_110 |
resource |
AWS::IAM::Group |
Ensure IAM policies does not allow privilege escalation |
Cloudformation |
| 244 |
CKV_AWS_110 |
resource |
AWS::IAM::ManagedPolicy |
Ensure IAM policies does not allow privilege escalation |
Cloudformation |
| 245 |
CKV_AWS_110 |
resource |
AWS::IAM::Policy |
Ensure IAM policies does not allow privilege escalation |
Cloudformation |
| 246 |
CKV_AWS_110 |
resource |
AWS::IAM::Role |
Ensure IAM policies does not allow privilege escalation |
Cloudformation |
| 247 |
CKV_AWS_110 |
resource |
AWS::IAM::User |
Ensure IAM policies does not allow privilege escalation |
Cloudformation |
| 248 |
CKV_AWS_110 |
data |
aws_iam_policy_document |
Ensure IAM policies does not allow privilege escalation |
Terraform |
| 249 |
CKV_AWS_111 |
resource |
AWS::IAM::Group |
Ensure IAM policies does not allow write access without constraints |
Cloudformation |
| 250 |
CKV_AWS_111 |
resource |
AWS::IAM::ManagedPolicy |
Ensure IAM policies does not allow write access without constraints |
Cloudformation |
| 251 |
CKV_AWS_111 |
resource |
AWS::IAM::Policy |
Ensure IAM policies does not allow write access without constraints |
Cloudformation |
| 252 |
CKV_AWS_111 |
resource |
AWS::IAM::Role |
Ensure IAM policies does not allow write access without constraints |
Cloudformation |
| 253 |
CKV_AWS_111 |
resource |
AWS::IAM::User |
Ensure IAM policies does not allow write access without constraints |
Cloudformation |
| 254 |
CKV_AWS_111 |
data |
aws_iam_policy_document |
Ensure IAM policies does not allow write access without constraints |
Terraform |
| 255 |
CKV_AWS_112 |
resource |
aws_ssm_document |
Ensure Session Manager data is encrypted in transit |
Terraform |
| 256 |
CKV_AWS_113 |
resource |
aws_ssm_document |
Ensure Session Manager logs are enabled and encrypted |
Terraform |
| 257 |
CKV_AWS_114 |
resource |
aws_emr_cluster |
Ensure that EMR clusters with Kerberos have Kerberos Realm set |
Terraform |
| 258 |
CKV_AWS_115 |
resource |
aws_lambda_function |
Ensure that AWS Lambda function is configured for function-level concurrent execution limit |
Terraform |
| 259 |
CKV_AWS_116 |
resource |
AWS::Lambda::Function |
Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) |
Cloudformation |
| 260 |
CKV_AWS_116 |
resource |
AWS::Serverless::Function |
Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) |
Cloudformation |
| 261 |
CKV_AWS_116 |
resource |
aws_lambda_function |
Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) |
Terraform |
| 262 |
CKV_AWS_117 |
resource |
aws_lambda_function |
Ensure that AWS Lambda function is configured inside a VPC |
Terraform |
| 263 |
CKV_AWS_118 |
resource |
aws_db_instance |
Ensure that enhanced monitoring is enabled for Amazon RDS instances |
Terraform |
| 264 |
CKV_AWS_118 |
resource |
aws_rds_cluster_instance |
Ensure that enhanced monitoring is enabled for Amazon RDS instances |
Terraform |
| 265 |
CKV_AWS_119 |
resource |
AWS::DynamoDB::Table |
Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK |
Cloudformation |
| 266 |
CKV_AWS_119 |
resource |
aws_dynamodb_table |
Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK |
Terraform |
| 267 |
CKV_AWS_120 |
resource |
AWS::ApiGateway::Stage |
Ensure API Gateway caching is enabled |
Cloudformation |
| 268 |
CKV_AWS_120 |
resource |
AWS::Serverless::Api |
Ensure API Gateway caching is enabled |
Cloudformation |
| 269 |
CKV_AWS_120 |
resource |
aws_api_gateway_stage |
Ensure API Gateway caching is enabled |
Terraform |
| 270 |
CKV_AWS_121 |
resource |
aws_config_configuration_aggregator |
Ensure AWS Config is enabled in all regions |
Terraform |
| 271 |
CKV_AWS_122 |
resource |
aws_sagemaker_notebook_instance |
Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance |
Terraform |
| 272 |
CKV_AWS_123 |
resource |
AWS::EC2::VPCEndpointService |
Ensure that VPC Endpoint Service is configured for Manual Acceptance |
Cloudformation |
| 273 |
CKV_AWS_123 |
resource |
aws_vpc_endpoint_service |
Ensure that VPC Endpoint Service is configured for Manual Acceptance |
Terraform |
| 274 |
CKV_AWS_124 |
resource |
aws_cloudformation_stack |
Ensure that CloudFormation stacks are sending event notifications to an SNS topic |
Terraform |
| 275 |
CKV_AWS_126 |
resource |
aws_instance |
Ensure that detailed monitoring is enabled for EC2 instances |
Terraform |
| 276 |
CKV_AWS_127 |
resource |
aws_elb |
Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager |
Terraform |
| 277 |
CKV_AWS_128 |
resource |
aws_rds_cluster |
Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled |
Terraform |
| 278 |
CKV_AWS_129 |
resource |
aws_db_instance |
Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled |
Terraform |
| 279 |
CKV_AWS_130 |
resource |
aws_subnet |
Ensure VPC subnets do not assign public IP by default |
Terraform |
| 280 |
CKV_AWS_131 |
resource |
AWS::ElasticLoadBalancingV2::LoadBalancer |
Ensure that ALB drops HTTP headers |
Cloudformation |
| 281 |
CKV_AWS_131 |
resource |
aws_alb |
Ensure that ALB drops HTTP headers |
Terraform |
| 282 |
CKV_AWS_131 |
resource |
aws_lb |
Ensure that ALB drops HTTP headers |
Terraform |
| 283 |
CKV_AWS_133 |
resource |
aws_db_instance |
Ensure that RDS instances has backup policy |
Terraform |
| 284 |
CKV_AWS_133 |
resource |
aws_rds_cluster |
Ensure that RDS instances has backup policy |
Terraform |
| 285 |
CKV_AWS_134 |
resource |
aws_elasticache_cluster |
Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on |
Terraform |
| 286 |
CKV_AWS_135 |
resource |
aws_instance |
Ensure that EC2 is EBS optimized |
Terraform |
| 287 |
CKV_AWS_136 |
resource |
AWS::ECR::Repository |
Ensure that ECR repositories are encrypted using KMS |
Cloudformation |
| 288 |
CKV_AWS_136 |
resource |
aws_ecr_repository |
Ensure that ECR repositories are encrypted using KMS |
Terraform |
| 289 |
CKV_AWS_137 |
resource |
aws_elasticsearch_domain |
Ensure that Elasticsearch is configured inside a VPC |
Terraform |
| 290 |
CKV_AWS_138 |
resource |
aws_elb |
Ensure that ELB is cross-zone-load-balancing enabled |
Terraform |
| 291 |
CKV_AWS_139 |
resource |
aws_rds_cluster |
Ensure that RDS clusters have deletion protection enabled |
Terraform |
| 292 |
CKV_AWS_140 |
resource |
aws_rds_global_cluster |
Ensure that RDS global clusters are encrypted |
Terraform |
| 293 |
CKV_AWS_141 |
resource |
aws_redshift_cluster |
Ensured that redshift cluster allowing version upgrade by default |
Terraform |
| 294 |
CKV_AWS_142 |
resource |
aws_redshift_cluster |
Ensure that Redshift cluster is encrypted by KMS |
Terraform |
| 295 |
CKV_AWS_143 |
resource |
aws_s3_bucket |
Ensure that S3 bucket has lock configuration enabled by default |
Terraform |
| 296 |
CKV_AWS_144 |
resource |
aws_s3_bucket |
Ensure that S3 bucket has cross-region replication enabled |
Terraform |
| 297 |
CKV_AWS_145 |
resource |
aws_s3_bucket |
Ensure that S3 buckets are encrypted with KMS by default |
Terraform |
| 298 |
CKV_AWS_146 |
resource |
aws_db_cluster_snapshot |
Ensure that RDS database cluster snapshot is encrypted |
Terraform |
| 299 |
CKV_AWS_147 |
resource |
aws_codebuild_project |
Ensure that CodeBuild projects are encrypted |
Terraform |
| 300 |
CKV_AWS_148 |
resource |
aws_default_vpc |
Ensure no default VPC is planned to be provisioned |
Terraform |
| 301 |
CKV_AWS_149 |
resource |
AWS::SecretsManager::Secret |
Ensure that Secrets Manager secret is encrypted using KMS CMK |
Cloudformation |
| 302 |
CKV_AWS_149 |
resource |
aws_secretsmanager_secret |
Ensure that Secrets Manager secret is encrypted using KMS CMK |
Terraform |
| 303 |
CKV_AWS_150 |
resource |
aws_alb |
Ensure that Load Balancer has deletion protection enabled |
Terraform |
| 304 |
CKV_AWS_150 |
resource |
aws_lb |
Ensure that Load Balancer has deletion protection enabled |
Terraform |
| 305 |
CKV_AWS_152 |
resource |
aws_alb |
Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled |
Terraform |
| 306 |
CKV_AWS_152 |
resource |
aws_lb |
Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled |
Terraform |
| 307 |
CKV_AWS_153 |
resource |
aws_autoscaling_group |
Autoscaling groups should supply tags to launch configurations |
Terraform |
| 308 |
CKV_AWS_154 |
resource |
AWS::Redshift::Cluster |
Ensure Redshift is not deployed outside of a VPC |
Cloudformation |
| 309 |
CKV_AWS_154 |
resource |
aws_redshift_cluster |
Ensure Redshift is not deployed outside of a VPC |
Terraform |
| 310 |
CKV_AWS_155 |
resource |
AWS::WorkSpaces::Workspace |
Ensure that Workspace user volumes are encrypted |
Cloudformation |
| 311 |
CKV_AWS_155 |
resource |
aws_workspaces_workspace |
Ensure that Workspace user volumes are encrypted |
Terraform |
| 312 |
CKV_AWS_156 |
resource |
AWS::WorkSpaces::Workspace |
Ensure that Workspace root volumes are encrypted |
Cloudformation |
| 313 |
CKV_AWS_156 |
resource |
aws_workspaces_workspace |
Ensure that Workspace root volumes are encrypted |
Terraform |
| 314 |
CKV_AWS_157 |
resource |
AWS::RDS::DBInstance |
Ensure that RDS instances have Multi-AZ enabled |
Cloudformation |
| 315 |
CKV_AWS_157 |
resource |
aws_db_instance |
Ensure that RDS instances have Multi-AZ enabled |
Terraform |
| 316 |
CKV_AWS_158 |
resource |
AWS::Logs::LogGroup |
Ensure that CloudWatch Log Group is encrypted by KMS |
Cloudformation |
| 317 |
CKV_AWS_158 |
resource |
aws_cloudwatch_log_group |
Ensure that CloudWatch Log Group is encrypted by KMS |
Terraform |
| 318 |
CKV_AWS_159 |
resource |
aws_athena_workgroup |
Ensure that Athena Workgroup is encrypted |
Terraform |
| 319 |
CKV_AWS_160 |
resource |
AWS::Timestream::Database |
Ensure that Timestream database is encrypted with KMS CMK |
Cloudformation |
| 320 |
CKV_AWS_160 |
resource |
aws_timestreamwrite_database |
Ensure that Timestream database is encrypted with KMS CMK |
Terraform |
| 321 |
CKV_AWS_161 |
resource |
AWS::RDS::DBInstance |
Ensure RDS database has IAM authentication enabled |
Cloudformation |
| 322 |
CKV_AWS_161 |
resource |
aws_db_instance |
Ensure RDS database has IAM authentication enabled |
Terraform |
| 323 |
CKV_AWS_162 |
resource |
AWS::RDS::DBCluster |
Ensure RDS cluster has IAM authentication enabled |
Cloudformation |
| 324 |
CKV_AWS_162 |
resource |
aws_rds_cluster |
Ensure RDS cluster has IAM authentication enabled |
Terraform |
| 325 |
CKV_AWS_163 |
resource |
AWS::ECR::Repository |
Ensure ECR image scanning on push is enabled |
Cloudformation |
| 326 |
CKV_AWS_163 |
resource |
aws_ecr_repository |
Ensure ECR image scanning on push is enabled |
Terraform |
| 327 |
CKV_AWS_164 |
resource |
AWS::Transfer::Server |
Ensure Transfer Server is not exposed publicly. |
Cloudformation |
| 328 |
CKV_AWS_164 |
resource |
aws_transfer_server |
Ensure Transfer Server is not exposed publicly. |
Terraform |
| 329 |
CKV_AWS_165 |
resource |
AWS::DynamoDB::GlobalTable |
Ensure Dynamodb global table point in time recovery (backup) is enabled |
Cloudformation |
| 330 |
CKV_AWS_165 |
resource |
aws_dynamodb_global_table |
Ensure Dynamodb point in time recovery (backup) is enabled for global tables |
Terraform |
| 331 |
CKV_AWS_166 |
resource |
AWS::Backup::BackupVault |
Ensure Backup Vault is encrypted at rest using KMS CMK |
Cloudformation |
| 332 |
CKV_AWS_166 |
resource |
aws_backup_vault |
Ensure Backup Vault is encrypted at rest using KMS CMK |
Terraform |
| 333 |
CKV_AWS_167 |
resource |
aws_glacier_vault |
Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it |
Terraform |
| 334 |
CKV_AWS_168 |
resource |
aws_sqs_queue |
Ensure SQS queue policy is not public by only allowing specific services or principals to access it |
Terraform |
| 335 |
CKV_AWS_168 |
resource |
aws_sqs_queue_policy |
Ensure SQS queue policy is not public by only allowing specific services or principals to access it |
Terraform |
| 336 |
CKV_AWS_169 |
resource |
aws_sns_topic_policy |
Ensure SNS topic policy is not public by only allowing specific services or principals to access it |
Terraform |
| 337 |
CKV_AWS_170 |
resource |
AWS::QLDB::Ledger |
Ensure QLDB ledger permissions mode is set to STANDARD |
Cloudformation |
| 338 |
CKV_AWS_170 |
resource |
aws_qldb_ledger |
Ensure QLDB ledger permissions mode is set to STANDARD |
Terraform |
| 339 |
CKV_AWS_171 |
resource |
aws_emr_security_configuration |
Ensure Cluster security configuration encryption is using SSE-KMS |
Terraform |
| 340 |
CKV_AWS_172 |
resource |
AWS::QLDB::Ledger |
Ensure QLDB ledger has deletion protection enabled |
Cloudformation |
| 341 |
CKV_AWS_172 |
resource |
aws_qldb_ledger |
Ensure QLDB ledger has deletion protection enabled |
Terraform |
| 342 |
CKV_AWS_173 |
resource |
AWS::Lambda::Function |
Check encryption settings for Lambda environmental variable |
Cloudformation |
| 343 |
CKV_AWS_173 |
resource |
AWS::Serverless::Function |
Check encryption settings for Lambda environmental variable |
Cloudformation |
| 344 |
CKV_AWS_173 |
resource |
aws_lambda_function |
Check encryption settings for Lambda environmental variable |
Terraform |
| 345 |
CKV_AWS_174 |
resource |
AWS::CloudFront::Distribution |
Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 |
Cloudformation |
| 346 |
CKV_AWS_174 |
resource |
aws_cloudfront_distribution |
Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 |
Terraform |
| 347 |
CKV_AWS_175 |
resource |
aws_waf_web_acl |
Ensure WAF has associated rules |
Terraform |
| 348 |
CKV_AWS_175 |
resource |
aws_wafregional_web_acl |
Ensure WAF has associated rules |
Terraform |
| 349 |
CKV_AWS_175 |
resource |
aws_wafv2_web_acl |
Ensure WAF has associated rules |
Terraform |
| 350 |
CKV_AWS_176 |
resource |
aws_waf_web_acl |
Ensure Logging is enabled for WAF Web Access Control Lists |
Terraform |
| 351 |
CKV_AWS_176 |
resource |
aws_wafregional_web_acl |
Ensure Logging is enabled for WAF Web Access Control Lists |
Terraform |
| 352 |
CKV_AWS_177 |
resource |
aws_kinesis_video_stream |
Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 353 |
CKV_AWS_178 |
resource |
aws_fsx_ontap_file_system |
Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 354 |
CKV_AWS_179 |
resource |
aws_fsx_windows_file_system |
Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 355 |
CKV_AWS_180 |
resource |
aws_imagebuilder_component |
Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 356 |
CKV_AWS_181 |
resource |
aws_s3_object_copy |
Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 357 |
CKV_AWS_182 |
resource |
aws_docdb_cluster |
Ensure Doc DB is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 358 |
CKV_AWS_183 |
resource |
aws_ebs_snapshot_copy |
Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 359 |
CKV_AWS_184 |
resource |
aws_efs_file_system |
Ensure resource is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 360 |
CKV_AWS_185 |
resource |
aws_kinesis_stream |
Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 361 |
CKV_AWS_186 |
resource |
aws_s3_bucket_object |
Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 362 |
CKV_AWS_187 |
resource |
aws_sagemaker_domain |
Ensure Sagemaker domain is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 363 |
CKV_AWS_188 |
resource |
aws_redshift_cluster |
Ensure RedShift Cluster is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 364 |
CKV_AWS_189 |
resource |
aws_ebs_volume |
Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 365 |
CKV_AWS_190 |
resource |
aws_fsx_lustre_file_system |
Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 366 |
CKV_AWS_191 |
resource |
aws_elasticache_replication_group |
Ensure Elasticache replication group is encrypted by KMS using a customer managed Key (CMK) |
Terraform |
| 367 |
CKV_AWS_192 |
resource |
AWS::WAFv2::WebACL |
Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell |
Cloudformation |
| 368 |
CKV_AWS_192 |
resource |
aws_wafv2_web_acl |
Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell |
Terraform |
| 369 |
CKV_AWS_193 |
resource |
AWS::AppSync::GraphQLApi |
Ensure AppSync has Logging enabled |
Cloudformation |
| 370 |
CKV_AWS_193 |
resource |
aws_appsync_graphql_api |
Ensure AppSync has Logging enabled |
Terraform |
| 371 |
CKV_AWS_194 |
resource |
AWS::AppSync::GraphQLApi |
Ensure AppSync has Field-Level logs enabled |
Cloudformation |
| 372 |
CKV_AWS_194 |
resource |
aws_appsync_graphql_api |
Ensure AppSync has Field-Level logs enabled |
Terraform |
| 373 |
CKV_AWS_195 |
resource |
AWS::Glue::Crawler |
Ensure Glue component has a security configuration associated |
Cloudformation |
| 374 |
CKV_AWS_195 |
resource |
AWS::Glue::DevEndpoint |
Ensure Glue component has a security configuration associated |
Cloudformation |
| 375 |
CKV_AWS_195 |
resource |
AWS::Glue::Job |
Ensure Glue component has a security configuration associated |
Cloudformation |
| 376 |
CKV_AWS_195 |
resource |
aws_glue_crawler |
Ensure Glue component has a security configuration associated |
Terraform |
| 377 |
CKV_AWS_195 |
resource |
aws_glue_dev_endpoint |
Ensure Glue component has a security configuration associated |
Terraform |
| 378 |
CKV_AWS_195 |
resource |
aws_glue_job |
Ensure Glue component has a security configuration associated |
Terraform |
| 379 |
CKV_AWS_196 |
resource |
aws_elasticache_security_group |
Ensure no aws_elasticache_security_group resources exist |
Terraform |
| 380 |
CKV_AWS_197 |
resource |
aws_mq_broker |
Ensure MQ Broker Audit logging is enabled |
Terraform |
| 381 |
CKV_AWS_198 |
resource |
aws_db_security_group |
Ensure no aws_db_security_group resources exist |
Terraform |
| 382 |
CKV2_AWS_1 |
resource |
aws_network_acl |
Ensure that all NACL are attached to subnets |
Terraform |
| 383 |
CKV2_AWS_1 |
resource |
aws_subnet |
Ensure that all NACL are attached to subnets |
Terraform |
| 384 |
CKV2_AWS_2 |
resource |
aws_ebs_volume |
Ensure that only encrypted EBS volumes are attached to EC2 instances |
Terraform |
| 385 |
CKV2_AWS_2 |
resource |
aws_volume_attachment |
Ensure that only encrypted EBS volumes are attached to EC2 instances |
Terraform |
| 386 |
CKV2_AWS_3 |
resource |
aws_guardduty_detector |
Ensure GuardDuty is enabled to specific org/region |
Terraform |
| 387 |
CKV2_AWS_3 |
resource |
aws_guardduty_organization_configuration |
Ensure GuardDuty is enabled to specific org/region |
Terraform |
| 388 |
CKV2_AWS_4 |
resource |
aws_api_gateway_method_settings |
Ensure API Gateway stage have logging level defined as appropriate |
Terraform |
| 389 |
CKV2_AWS_4 |
resource |
aws_api_gateway_stage |
Ensure API Gateway stage have logging level defined as appropriate |
Terraform |
| 390 |
CKV2_AWS_5 |
resource |
aws_security_group |
Ensure that Security Groups are attached to another resource |
Terraform |
| 391 |
CKV2_AWS_6 |
resource |
aws_s3_bucket |
Ensure that S3 bucket has a Public Access block |
Terraform |
| 392 |
CKV2_AWS_6 |
resource |
aws_s3_bucket_public_access_block |
Ensure that S3 bucket has a Public Access block |
Terraform |
| 393 |
CKV2_AWS_7 |
resource |
aws_emr_cluster |
Ensure that Amazon EMR clusters’ security groups are not open to the world |
Terraform |
| 394 |
CKV2_AWS_7 |
resource |
aws_security_group |
Ensure that Amazon EMR clusters’ security groups are not open to the world |
Terraform |
| 395 |
CKV2_AWS_8 |
resource |
aws_rds_cluster |
Ensure that RDS clusters has backup plan of AWS Backup |
Terraform |
| 396 |
CKV2_AWS_9 |
resource |
aws_backup_selection |
Ensure that EBS are added in the backup plans of AWS Backup |
Terraform |
| 397 |
CKV2_AWS_10 |
resource |
aws_cloudtrail |
Ensure CloudTrail trails are integrated with CloudWatch Logs |
Terraform |
| 398 |
CKV2_AWS_11 |
resource |
aws_vpc |
Ensure VPC flow logging is enabled in all VPCs |
Terraform |
| 399 |
CKV2_AWS_12 |
resource |
aws_default_security_group |
Ensure the default security group of every VPC restricts all traffic |
Terraform |
| 400 |
CKV2_AWS_12 |
resource |
aws_vpc |
Ensure the default security group of every VPC restricts all traffic |
Terraform |
| 401 |
CKV2_AWS_14 |
resource |
aws_iam_group |
Ensure that IAM groups includes at least one IAM user |
Terraform |
| 402 |
CKV2_AWS_14 |
resource |
aws_iam_group_membership |
Ensure that IAM groups includes at least one IAM user |
Terraform |
| 403 |
CKV2_AWS_15 |
resource |
aws_autoscaling_group |
Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. |
Terraform |
| 404 |
CKV2_AWS_15 |
resource |
aws_elb |
Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. |
Terraform |
| 405 |
CKV2_AWS_16 |
resource |
aws_appautoscaling_target |
Ensure that Auto Scaling is enabled on your DynamoDB tables |
Terraform |
| 406 |
CKV2_AWS_16 |
resource |
aws_dynamodb_table |
Ensure that Auto Scaling is enabled on your DynamoDB tables |
Terraform |
| 407 |
CKV2_AWS_18 |
resource |
aws_backup_selection |
Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup |
Terraform |
| 408 |
CKV2_AWS_19 |
resource |
aws_eip |
Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances |
Terraform |
| 409 |
CKV2_AWS_19 |
resource |
aws_eip_association |
Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances |
Terraform |
| 410 |
CKV2_AWS_20 |
resource |
aws_alb |
Ensure that ALB redirects HTTP requests into HTTPS ones |
Terraform |
| 411 |
CKV2_AWS_20 |
resource |
aws_alb_listener |
Ensure that ALB redirects HTTP requests into HTTPS ones |
Terraform |
| 412 |
CKV2_AWS_20 |
resource |
aws_lb |
Ensure that ALB redirects HTTP requests into HTTPS ones |
Terraform |
| 413 |
CKV2_AWS_20 |
resource |
aws_lb_listener |
Ensure that ALB redirects HTTP requests into HTTPS ones |
Terraform |
| 414 |
CKV2_AWS_21 |
resource |
aws_iam_group_membership |
Ensure that all IAM users are members of at least one IAM group. |
Terraform |
| 415 |
CKV2_AWS_22 |
resource |
aws_iam_user |
Ensure an IAM User does not have access to the console |
Terraform |
| 416 |
CKV2_AWS_23 |
resource |
aws_route53_record |
Route53 A Record has Attached Resource |
Terraform |
| 417 |
CKV2_AWS_27 |
resource |
aws_rds_cluster |
Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled |
Terraform |
| 418 |
CKV2_AWS_27 |
resource |
aws_rds_cluster_parameter_group |
Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled |
Terraform |
| 419 |
CKV2_AWS_28 |
resource |
aws_alb |
Ensure public facing ALB are protected by WAF |
Terraform |
| 420 |
CKV2_AWS_28 |
resource |
aws_lb |
Ensure public facing ALB are protected by WAF |
Terraform |
| 421 |
CKV2_AWS_29 |
resource |
aws_api_gateway_rest_api |
Ensure public API gateway are protected by WAF |
Terraform |
| 422 |
CKV2_AWS_29 |
resource |
aws_api_gateway_stage |
Ensure public API gateway are protected by WAF |
Terraform |
| 423 |
CKV2_AWS_30 |
resource |
aws_db_instance |
Ensure Postgres RDS as aws_db_instance has Query Logging enabled |
Terraform |
| 424 |
CKV2_AWS_30 |
resource |
aws_db_parameter_group |
Ensure Postgres RDS as aws_db_instance has Query Logging enabled |
Terraform |
| 425 |
CKV2_AWS_31 |
resource |
aws_wafv2_web_acl |
Ensure WAF2 has a Logging Configuration |
Terraform |
| 426 |
CKV2_AWS_32 |
resource |
aws_cloudfront_distribution |
Ensure CloudFront distribution has a strict security headers policy attached |
Terraform |
| 427 |
CKV2_AWS_32 |
resource |
aws_cloudfront_response_headers_policy |
Ensure CloudFront distribution has a strict security headers policy attached |
Terraform |
| 428 |
CKV2_AWS_33 |
resource |
aws_appsync_graphql_api |
Ensure AppSync is protected by WAF |
Terraform |
| 429 |
CKV2_AWS_34 |
resource |
aws_ssm_parameter |
AWS SSM Parameter should be Encrypted |
Terraform |
| 430 |
CKV_AZURE_1 |
resource |
Microsoft.Compute/virtualMachines |
Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) |
arm |
| 431 |
CKV_AZURE_1 |
resource |
azurerm_linux_virtual_machine |
Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) |
Terraform |
| 432 |
CKV_AZURE_1 |
resource |
azurerm_virtual_machine |
Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) |
Terraform |
| 433 |
CKV_AZURE_2 |
resource |
Microsoft.Compute/disks |
Ensure Azure managed disk have encryption enabled |
arm |
| 434 |
CKV_AZURE_2 |
resource |
azurerm_managed_disk |
Ensure Azure managed disk has encryption enabled |
Terraform |
| 435 |
CKV_AZURE_3 |
resource |
Microsoft.Storage/storageAccounts |
Ensure that ‘supportsHttpsTrafficOnly’ is set to ‘true’ |
arm |
| 436 |
CKV_AZURE_3 |
resource |
azurerm_storage_account |
Ensure that ‘Secure transfer required’ is set to ‘Enabled’ |
Terraform |
| 437 |
CKV_AZURE_4 |
resource |
Microsoft.ContainerService/managedClusters |
Ensure AKS logging to Azure Monitoring is Configured |
arm |
| 438 |
CKV_AZURE_4 |
resource |
azurerm_kubernetes_cluster |
Ensure AKS logging to Azure Monitoring is Configured |
Terraform |
| 439 |
CKV_AZURE_5 |
resource |
Microsoft.ContainerService/managedClusters |
Ensure RBAC is enabled on AKS clusters |
arm |
| 440 |
CKV_AZURE_5 |
resource |
azurerm_kubernetes_cluster |
Ensure RBAC is enabled on AKS clusters |
Terraform |
| 441 |
CKV_AZURE_6 |
resource |
Microsoft.ContainerService/managedClusters |
Ensure AKS has an API Server Authorized IP Ranges enabled |
arm |
| 442 |
CKV_AZURE_6 |
resource |
azurerm_kubernetes_cluster |
Ensure AKS has an API Server Authorized IP Ranges enabled |
Terraform |
| 443 |
CKV_AZURE_7 |
resource |
Microsoft.ContainerService/managedClusters |
Ensure AKS cluster has Network Policy configured |
arm |
| 444 |
CKV_AZURE_7 |
resource |
azurerm_kubernetes_cluster |
Ensure AKS cluster has Network Policy configured |
Terraform |
| 445 |
CKV_AZURE_8 |
resource |
Microsoft.ContainerService/managedClusters |
Ensure Kubernetes Dashboard is disabled |
arm |
| 446 |
CKV_AZURE_8 |
resource |
azurerm_kubernetes_cluster |
Ensure Kubernetes Dashboard is disabled |
Terraform |
| 447 |
CKV_AZURE_9 |
resource |
Microsoft.Network/networkSecurityGroups |
Ensure that RDP access is restricted from the internet |
arm |
| 448 |
CKV_AZURE_9 |
resource |
Microsoft.Network/networkSecurityGroups/securityRules |
Ensure that RDP access is restricted from the internet |
arm |
| 449 |
CKV_AZURE_9 |
resource |
azurerm_network_security_group |
Ensure that RDP access is restricted from the internet |
Terraform |
| 450 |
CKV_AZURE_9 |
resource |
azurerm_network_security_rule |
Ensure that RDP access is restricted from the internet |
Terraform |
| 451 |
CKV_AZURE_10 |
resource |
Microsoft.Network/networkSecurityGroups |
Ensure that SSH access is restricted from the internet |
arm |
| 452 |
CKV_AZURE_10 |
resource |
Microsoft.Network/networkSecurityGroups/securityRules |
Ensure that SSH access is restricted from the internet |
arm |
| 453 |
CKV_AZURE_10 |
resource |
azurerm_network_security_group |
Ensure that SSH access is restricted from the internet |
Terraform |
| 454 |
CKV_AZURE_10 |
resource |
azurerm_network_security_rule |
Ensure that SSH access is restricted from the internet |
Terraform |
| 455 |
CKV_AZURE_11 |
resource |
Microsoft.Sql/servers |
Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) |
arm |
| 456 |
CKV_AZURE_11 |
resource |
azurerm_mariadb_firewall_rule |
Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) |
Terraform |
| 457 |
CKV_AZURE_11 |
resource |
azurerm_mysql_firewall_rule |
Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) |
Terraform |
| 458 |
CKV_AZURE_11 |
resource |
azurerm_postgresql_firewall_rule |
Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) |
Terraform |
| 459 |
CKV_AZURE_11 |
resource |
azurerm_sql_firewall_rule |
Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) |
Terraform |
| 460 |
CKV_AZURE_12 |
resource |
Microsoft.Network/networkWatchers/FlowLogs |
Ensure that Network Security Group Flow Log retention period is ‘greater than 90 days’ |
arm |
| 461 |
CKV_AZURE_12 |
resource |
Microsoft.Network/networkWatchers/FlowLogs/ |
Ensure that Network Security Group Flow Log retention period is ‘greater than 90 days’ |
arm |
| 462 |
CKV_AZURE_12 |
resource |
Microsoft.Network/networkWatchers/flowLogs |
Ensure that Network Security Group Flow Log retention period is ‘greater than 90 days’ |
arm |
| 463 |
CKV_AZURE_12 |
resource |
Microsoft.Network/networkWatchers/flowLogs/ |
Ensure that Network Security Group Flow Log retention period is ‘greater than 90 days’ |
arm |
| 464 |
CKV_AZURE_12 |
resource |
azurerm_network_watcher_flow_log |
Ensure that Network Security Group Flow Log retention period is ‘greater than 90 days’ |
Terraform |
| 465 |
CKV_AZURE_13 |
resource |
Microsoft.Web/sites/config |
Ensure App Service Authentication is set on Azure App Service |
arm |
| 466 |
CKV_AZURE_13 |
resource |
azurerm_app_service |
Ensure App Service Authentication is set on Azure App Service |
Terraform |
| 467 |
CKV_AZURE_13 |
resource |
config |
Ensure App Service Authentication is set on Azure App Service |
arm |
| 468 |
CKV_AZURE_14 |
resource |
Microsoft.Web/sites |
Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service |
arm |
| 469 |
CKV_AZURE_14 |
resource |
azurerm_app_service |
Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service |
Terraform |
| 470 |
CKV_AZURE_15 |
resource |
Microsoft.Web/sites |
Ensure web app is using the latest version of TLS encryption |
arm |
| 471 |
CKV_AZURE_15 |
resource |
azurerm_app_service |
Ensure web app is using the latest version of TLS encryption |
Terraform |
| 472 |
CKV_AZURE_16 |
resource |
Microsoft.Web/sites |
Ensure that Register with Azure Active Directory is enabled on App Service |
arm |
| 473 |
CKV_AZURE_16 |
resource |
azurerm_app_service |
Ensure that Register with Azure Active Directory is enabled on App Service |
Terraform |
| 474 |
CKV_AZURE_17 |
resource |
Microsoft.Web/sites |
Ensure the web app has ‘Client Certificates (Incoming client certificates)’ set |
arm |
| 475 |
CKV_AZURE_17 |
resource |
azurerm_app_service |
Ensure the web app has ‘Client Certificates (Incoming client certificates)’ set |
Terraform |
| 476 |
CKV_AZURE_18 |
resource |
Microsoft.Web/sites |
Ensure that ‘HTTP Version’ is the latest if used to run the web app |
arm |
| 477 |
CKV_AZURE_18 |
resource |
azurerm_app_service |
Ensure that ‘HTTP Version’ is the latest if used to run the web app |
Terraform |
| 478 |
CKV_AZURE_19 |
resource |
Microsoft.Security/pricings |
Ensure that standard pricing tier is selected |
arm |
| 479 |
CKV_AZURE_19 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that standard pricing tier is selected |
Terraform |
| 480 |
CKV_AZURE_20 |
resource |
Microsoft.Security/securityContacts |
Ensure that security contact ‘Phone number’ is set |
arm |
| 481 |
CKV_AZURE_20 |
resource |
azurerm_security_center_contact |
Ensure that security contact ‘Phone number’ is set |
Terraform |
| 482 |
CKV_AZURE_21 |
resource |
Microsoft.Security/securityContacts |
Ensure that ‘Send email notification for high severity alerts’ is set to ‘On’ |
arm |
| 483 |
CKV_AZURE_21 |
resource |
azurerm_security_center_contact |
Ensure that ‘Send email notification for high severity alerts’ is set to ‘On’ |
Terraform |
| 484 |
CKV_AZURE_22 |
resource |
Microsoft.Security/securityContacts |
Ensure that ‘Send email notification for high severity alerts’ is set to ‘On’ |
arm |
| 485 |
CKV_AZURE_22 |
resource |
azurerm_security_center_contact |
Ensure that ‘Send email notification for high severity alerts’ is set to ‘On’ |
Terraform |
| 486 |
CKV_AZURE_23 |
resource |
Microsoft.Sql/servers |
Ensure that ‘Auditing’ is set to ‘Enabled’ for SQL servers |
arm |
| 487 |
CKV_AZURE_23 |
resource |
azurerm_mssql_server |
Ensure that ‘Auditing’ is set to ‘On’ for SQL servers |
Terraform |
| 488 |
CKV_AZURE_23 |
resource |
azurerm_mssql_server_extended_auditing_policy |
Ensure that ‘Auditing’ is set to ‘On’ for SQL servers |
Terraform |
| 489 |
CKV_AZURE_23 |
resource |
azurerm_sql_server |
Ensure that ‘Auditing’ is set to ‘On’ for SQL servers |
Terraform |
| 490 |
CKV_AZURE_24 |
resource |
Microsoft.Sql/servers |
Ensure that ‘Auditing’ Retention is ‘greater than 90 days’ for SQL servers |
arm |
| 491 |
CKV_AZURE_24 |
resource |
azurerm_mssql_server |
Ensure that ‘Auditing’ Retention is ‘greater than 90 days’ for SQL servers |
Terraform |
| 492 |
CKV_AZURE_24 |
resource |
azurerm_mssql_server_extended_auditing_policy |
Ensure that ‘Auditing’ Retention is ‘greater than 90 days’ for SQL servers |
Terraform |
| 493 |
CKV_AZURE_24 |
resource |
azurerm_sql_server |
Ensure that ‘Auditing’ Retention is ‘greater than 90 days’ for SQL servers |
Terraform |
| 494 |
CKV_AZURE_25 |
resource |
Microsoft.Sql/servers/databases |
Ensure that ‘Threat Detection types’ is set to ‘All’ |
arm |
| 495 |
CKV_AZURE_25 |
resource |
azurerm_mssql_server_security_alert_policy |
Ensure that ‘Threat Detection types’ is set to ‘All’ |
Terraform |
| 496 |
CKV_AZURE_26 |
resource |
Microsoft.Sql/servers/databases |
Ensure that ‘Send Alerts To’ is enabled for MSSQL servers |
arm |
| 497 |
CKV_AZURE_26 |
resource |
azurerm_mssql_server_security_alert_policy |
Ensure that ‘Send Alerts To’ is enabled for MSSQL servers |
Terraform |
| 498 |
CKV_AZURE_27 |
resource |
Microsoft.Sql/servers/databases |
Ensure that ‘Email service and co-administrators’ is ‘Enabled’ for MSSQL servers |
arm |
| 499 |
CKV_AZURE_27 |
resource |
azurerm_mssql_server_security_alert_policy |
Ensure that ‘Email service and co-administrators’ is ‘Enabled’ for MSSQL servers |
Terraform |
| 500 |
CKV_AZURE_28 |
resource |
Microsoft.DBforMySQL/servers |
Ensure ‘Enforce SSL connection’ is set to ‘ENABLED’ for MySQL Database Server |
arm |
| 501 |
CKV_AZURE_28 |
resource |
azurerm_mysql_server |
Ensure ‘Enforce SSL connection’ is set to ‘ENABLED’ for MySQL Database Server |
Terraform |
| 502 |
CKV_AZURE_29 |
resource |
Microsoft.DBforPostgreSQL/servers |
Ensure ‘Enforce SSL connection’ is set to ‘ENABLED’ for PostgreSQL Database Server |
arm |
| 503 |
CKV_AZURE_29 |
resource |
azurerm_postgresql_server |
Ensure ‘Enforce SSL connection’ is set to ‘ENABLED’ for PostgreSQL Database Server |
Terraform |
| 504 |
CKV_AZURE_30 |
resource |
Microsoft.DBforPostgreSQL/servers/configurations |
Ensure server parameter ‘log_checkpoints’ is set to ‘ON’ for PostgreSQL Database Server |
arm |
| 505 |
CKV_AZURE_30 |
resource |
azurerm_postgresql_configuration |
Ensure server parameter ‘log_checkpoints’ is set to ‘ON’ for PostgreSQL Database Server |
Terraform |
| 506 |
CKV_AZURE_30 |
resource |
configurations |
Ensure server parameter ‘log_checkpoints’ is set to ‘ON’ for PostgreSQL Database Server |
arm |
| 507 |
CKV_AZURE_31 |
resource |
Microsoft.DBforPostgreSQL/servers/configurations |
Ensure configuration ‘log_connections’ is set to ‘ON’ for PostgreSQL Database Server |
arm |
| 508 |
CKV_AZURE_31 |
resource |
azurerm_postgresql_configuration |
Ensure server parameter ‘log_connections’ is set to ‘ON’ for PostgreSQL Database Server |
Terraform |
| 509 |
CKV_AZURE_31 |
resource |
configurations |
Ensure configuration ‘log_connections’ is set to ‘ON’ for PostgreSQL Database Server |
arm |
| 510 |
CKV_AZURE_32 |
resource |
Microsoft.DBforPostgreSQL/servers/configurations |
Ensure server parameter ‘connection_throttling’ is set to ‘ON’ for PostgreSQL Database Server |
arm |
| 511 |
CKV_AZURE_32 |
resource |
azurerm_postgresql_configuration |
Ensure server parameter ‘connection_throttling’ is set to ‘ON’ for PostgreSQL Database Server |
Terraform |
| 512 |
CKV_AZURE_32 |
resource |
configurations |
Ensure server parameter ‘connection_throttling’ is set to ‘ON’ for PostgreSQL Database Server |
arm |
| 513 |
CKV_AZURE_33 |
resource |
Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings |
Ensure Storage logging is enabled for Queue service for read, write and delete requests |
arm |
| 514 |
CKV_AZURE_33 |
resource |
azurerm_storage_account |
Ensure Storage logging is enabled for Queue service for read, write and delete requests |
Terraform |
| 515 |
CKV_AZURE_34 |
resource |
Microsoft.Storage/storageAccounts/blobServices/containers |
Ensure that ‘Public access level’ is set to Private for blob containers |
arm |
| 516 |
CKV_AZURE_34 |
resource |
azurerm_storage_container |
Ensure that ‘Public access level’ is set to Private for blob containers |
Terraform |
| 517 |
CKV_AZURE_34 |
resource |
blobServices/containers |
Ensure that ‘Public access level’ is set to Private for blob containers |
arm |
| 518 |
CKV_AZURE_34 |
resource |
containers |
Ensure that ‘Public access level’ is set to Private for blob containers |
arm |
| 519 |
CKV_AZURE_35 |
resource |
Microsoft.Storage/storageAccounts |
Ensure default network access rule for Storage Accounts is set to deny |
arm |
| 520 |
CKV_AZURE_35 |
resource |
azurerm_storage_account |
Ensure default network access rule for Storage Accounts is set to deny |
Terraform |
| 521 |
CKV_AZURE_35 |
resource |
azurerm_storage_account_network_rules |
Ensure default network access rule for Storage Accounts is set to deny |
Terraform |
| 522 |
CKV_AZURE_36 |
resource |
Microsoft.Storage/storageAccounts |
Ensure ‘Trusted Microsoft Services’ is enabled for Storage Account access |
arm |
| 523 |
CKV_AZURE_36 |
resource |
azurerm_storage_account |
Ensure ‘Trusted Microsoft Services’ is enabled for Storage Account access |
Terraform |
| 524 |
CKV_AZURE_36 |
resource |
azurerm_storage_account_network_rules |
Ensure ‘Trusted Microsoft Services’ is enabled for Storage Account access |
Terraform |
| 525 |
CKV_AZURE_37 |
resource |
azurerm_monitor_log_profile |
Ensure that Activity Log Retention is set 365 days or greater |
Terraform |
| 526 |
CKV_AZURE_37 |
resource |
microsoft.insights/logprofiles |
Ensure that Activity Log Retention is set 365 days or greater |
arm |
| 527 |
CKV_AZURE_38 |
resource |
azurerm_monitor_log_profile |
Ensure audit profile captures all the activities |
Terraform |
| 528 |
CKV_AZURE_38 |
resource |
microsoft.insights/logprofiles |
Ensure audit profile captures all the activities |
arm |
| 529 |
CKV_AZURE_39 |
resource |
Microsoft.Authorization/roleDefinitions |
Ensure that no custom subscription owner roles are created |
arm |
| 530 |
CKV_AZURE_39 |
resource |
azurerm_role_definition |
Ensure that no custom subscription owner roles are created |
Terraform |
| 531 |
CKV_AZURE_40 |
resource |
azurerm_key_vault_key |
Ensure that the expiration date is set on all keys |
Terraform |
| 532 |
CKV_AZURE_41 |
resource |
Microsoft.KeyVault/vaults/secrets |
Ensure that the expiration date is set on all secrets |
arm |
| 533 |
CKV_AZURE_41 |
resource |
azurerm_key_vault_secret |
Ensure that the expiration date is set on all secrets |
Terraform |
| 534 |
CKV_AZURE_42 |
resource |
Microsoft.KeyVault/vaults |
Ensure the key vault is recoverable |
arm |
| 535 |
CKV_AZURE_42 |
resource |
azurerm_key_vault |
Ensure the key vault is recoverable |
Terraform |
| 536 |
CKV_AZURE_43 |
resource |
azurerm_storage_account |
Ensure Storage Accounts adhere to the naming rules |
Terraform |
| 537 |
CKV_AZURE_44 |
resource |
azurerm_storage_account |
Ensure Storage Account is using the latest version of TLS encryption |
Terraform |
| 538 |
CKV_AZURE_45 |
resource |
azurerm_virtual_machine |
Ensure that no sensitive credentials are exposed in VM custom_data |
Terraform |
| 539 |
CKV_AZURE_47 |
resource |
Microsoft.DBforMariaDB/servers |
Ensure ‘Enforce SSL connection’ is set to ‘ENABLED’ for MariaDB servers |
arm |
| 540 |
CKV_AZURE_47 |
resource |
azurerm_mariadb_server |
Ensure ‘Enforce SSL connection’ is set to ‘ENABLED’ for MariaDB servers |
Terraform |
| 541 |
CKV_AZURE_48 |
resource |
azurerm_mariadb_server |
Ensure ‘public network access enabled’ is set to ‘False’ for MariaDB servers |
Terraform |
| 542 |
CKV_AZURE_49 |
resource |
Microsoft.Compute/virtualMachineScaleSets |
Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) |
arm |
| 543 |
CKV_AZURE_49 |
resource |
azurerm_linux_virtual_machine_scale_set |
Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) |
Terraform |
| 544 |
CKV_AZURE_50 |
resource |
azurerm_linux_virtual_machine |
Ensure Virtual Machine Extensions are not Installed |
Terraform |
| 545 |
CKV_AZURE_50 |
resource |
azurerm_windows_virtual_machine |
Ensure Virtual Machine Extensions are not Installed |
Terraform |
| 546 |
CKV_AZURE_52 |
resource |
azurerm_mssql_server |
Ensure MSSQL is using the latest version of TLS encryption |
Terraform |
| 547 |
CKV_AZURE_53 |
resource |
azurerm_mysql_server |
Ensure ‘public network access enabled’ is set to ‘False’ for mySQL servers |
Terraform |
| 548 |
CKV_AZURE_54 |
resource |
azurerm_mysql_server |
Ensure MySQL is using the latest version of TLS encryption |
Terraform |
| 549 |
CKV_AZURE_55 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that Azure Defender is set to On for Servers |
Terraform |
| 550 |
CKV_AZURE_56 |
resource |
azurerm_function_app |
Ensure that function apps enables Authentication |
Terraform |
| 551 |
CKV_AZURE_57 |
resource |
azurerm_app_service |
Ensure that CORS disallows every resource to access app services |
Terraform |
| 552 |
CKV_AZURE_58 |
resource |
azurerm_synapse_workspace |
Ensure that Azure Synapse workspaces enables managed virtual networks |
Terraform |
| 553 |
CKV_AZURE_59 |
resource |
azurerm_storage_account |
Ensure that Storage accounts disallow public access |
Terraform |
| 554 |
CKV_AZURE_60 |
resource |
azurerm_storage_account |
Ensure that storage account enables secure transfer |
Terraform |
| 555 |
CKV_AZURE_61 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that Azure Defender is set to On for App Service |
Terraform |
| 556 |
CKV_AZURE_62 |
resource |
azurerm_function_app |
Ensure function apps are not accessible from all regions |
Terraform |
| 557 |
CKV_AZURE_63 |
resource |
azurerm_app_service |
Ensure that App service enables HTTP logging |
Terraform |
| 558 |
CKV_AZURE_64 |
resource |
azurerm_storage_sync |
Ensure that Azure File Sync disables public network access |
Terraform |
| 559 |
CKV_AZURE_65 |
resource |
azurerm_app_service |
Ensure that App service enables detailed error messages |
Terraform |
| 560 |
CKV_AZURE_66 |
resource |
azurerm_app_service |
Ensure that App service enables failed request tracing |
Terraform |
| 561 |
CKV_AZURE_67 |
resource |
azurerm_function_app |
Ensure that ‘HTTP Version’ is the latest, if used to run the Function app |
Terraform |
| 562 |
CKV_AZURE_68 |
resource |
azurerm_postgresql_server |
Ensure that PostgreSQL server disables public network access |
Terraform |
| 563 |
CKV_AZURE_69 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that Azure Defender is set to On for Azure SQL database servers |
Terraform |
| 564 |
CKV_AZURE_70 |
resource |
azurerm_function_app |
Ensure that Function apps is only accessible over HTTPS |
Terraform |
| 565 |
CKV_AZURE_71 |
resource |
azurerm_app_service |
Ensure that Managed identity provider is enabled for app services |
Terraform |
| 566 |
CKV_AZURE_72 |
resource |
azurerm_app_service |
Ensure that remote debugging is not enabled for app services |
Terraform |
| 567 |
CKV_AZURE_73 |
resource |
azurerm_automation_variable_bool |
Ensure that Automation account variables are encrypted |
Terraform |
| 568 |
CKV_AZURE_73 |
resource |
azurerm_automation_variable_datetime |
Ensure that Automation account variables are encrypted |
Terraform |
| 569 |
CKV_AZURE_73 |
resource |
azurerm_automation_variable_int |
Ensure that Automation account variables are encrypted |
Terraform |
| 570 |
CKV_AZURE_73 |
resource |
azurerm_automation_variable_string |
Ensure that Automation account variables are encrypted |
Terraform |
| 571 |
CKV_AZURE_74 |
resource |
azurerm_kusto_cluster |
Ensure that Azure Data Explorer uses disk encryption |
Terraform |
| 572 |
CKV_AZURE_75 |
resource |
azurerm_kusto_cluster |
Ensure that Azure Data Explorer uses double encryption |
Terraform |
| 573 |
CKV_AZURE_76 |
resource |
azurerm_batch_account |
Ensure that Azure Batch account uses key vault to encrypt data |
Terraform |
| 574 |
CKV_AZURE_77 |
resource |
azurerm_network_security_group |
Ensure that UDP Services are restricted from the Internet |
Terraform |
| 575 |
CKV_AZURE_77 |
resource |
azurerm_network_security_rule |
Ensure that UDP Services are restricted from the Internet |
Terraform |
| 576 |
CKV_AZURE_78 |
resource |
azurerm_app_service |
Ensure FTP deployments are disabled |
Terraform |
| 577 |
CKV_AZURE_79 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that Azure Defender is set to On for SQL servers on machines |
Terraform |
| 578 |
CKV_AZURE_80 |
resource |
azurerm_app_service |
Ensure that ‘Net Framework’ version is the latest, if used as a part of the web app |
Terraform |
| 579 |
CKV_AZURE_81 |
resource |
azurerm_app_service |
Ensure that ‘PHP version’ is the latest, if used to run the web app |
Terraform |
| 580 |
CKV_AZURE_82 |
resource |
azurerm_app_service |
Ensure that ‘Python version’ is the latest, if used to run the web app |
Terraform |
| 581 |
CKV_AZURE_83 |
resource |
azurerm_app_service |
Ensure that ‘Java version’ is the latest, if used to run the web app |
Terraform |
| 582 |
CKV_AZURE_84 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that Azure Defender is set to On for Storage |
Terraform |
| 583 |
CKV_AZURE_85 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that Azure Defender is set to On for Kubernetes |
Terraform |
| 584 |
CKV_AZURE_86 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that Azure Defender is set to On for Container Registries |
Terraform |
| 585 |
CKV_AZURE_87 |
resource |
azurerm_security_center_subscription_pricing |
Ensure that Azure Defender is set to On for Key Vault |
Terraform |
| 586 |
CKV_AZURE_88 |
resource |
azurerm_app_service |
Ensure that app services use Azure Files |
Terraform |
| 587 |
CKV_AZURE_89 |
resource |
azurerm_redis_cache |
Ensure that Azure Cache for Redis disables public network access |
Terraform |
| 588 |
CKV_AZURE_91 |
resource |
azurerm_redis_cache |
Ensure that only SSL are enabled for Cache for Redis |
Terraform |
| 589 |
CKV_AZURE_92 |
resource |
azurerm_linux_virtual_machine |
Ensure that Virtual Machines use managed disks |
Terraform |
| 590 |
CKV_AZURE_92 |
resource |
azurerm_windows_virtual_machine |
Ensure that Virtual Machines use managed disks |
Terraform |
| 591 |
CKV_AZURE_93 |
resource |
azurerm_managed_disk |
Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption |
Terraform |
| 592 |
CKV_AZURE_94 |
resource |
azurerm_mysql_server |
Ensure that My SQL server enables geo-redundant backups |
Terraform |
| 593 |
CKV_AZURE_95 |
resource |
azurerm_virtual_machine_scale_set |
Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets |
Terraform |
| 594 |
CKV_AZURE_96 |
resource |
azurerm_mysql_server |
Ensure that MySQL server enables infrastructure encryption |
Terraform |
| 595 |
CKV_AZURE_97 |
resource |
azurerm_linux_virtual_machine_scale_set |
Ensure that Virtual machine scale sets have encryption at host enabled |
Terraform |
| 596 |
CKV_AZURE_97 |
resource |
azurerm_windows_virtual_machine_scale_set |
Ensure that Virtual machine scale sets have encryption at host enabled |
Terraform |
| 597 |
CKV_AZURE_98 |
resource |
azurerm_container_group |
Ensure that Azure Container group is deployed into virtual network |
Terraform |
| 598 |
CKV_AZURE_99 |
resource |
azurerm_cosmosdb_account |
Ensure Cosmos DB accounts have restricted access |
Terraform |
| 599 |
CKV_AZURE_100 |
resource |
azurerm_cosmosdb_account |
Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest |
Terraform |
| 600 |
CKV_AZURE_101 |
resource |
azurerm_cosmosdb_account |
Ensure that Azure Cosmos DB disables public network access |
Terraform |
| 601 |
CKV_AZURE_102 |
resource |
azurerm_postgresql_server |
Ensure that PostgreSQL server enables geo-redundant backups |
Terraform |
| 602 |
CKV_AZURE_103 |
resource |
azurerm_data_factory |
Ensure that Azure Data Factory uses Git repository for source control |
Terraform |
| 603 |
CKV_AZURE_104 |
resource |
azurerm_data_factory |
Ensure that Azure Data factory public network access is disabled |
Terraform |
| 604 |
CKV_AZURE_105 |
resource |
azurerm_data_lake_store |
Ensure that Data Lake Store accounts enables encryption |
Terraform |
| 605 |
CKV_AZURE_106 |
resource |
azurerm_eventgrid_domain |
Ensure that Azure Event Grid Domain public network access is disabled |
Terraform |
| 606 |
CKV_AZURE_107 |
resource |
azurerm_api_management |
Ensure that API management services use virtual networks |
Terraform |
| 607 |
CKV_AZURE_108 |
resource |
azurerm_iothub |
Ensure that Azure IoT Hub disables public network access |
Terraform |
| 608 |
CKV_AZURE_109 |
resource |
azurerm_key_vault |
Ensure that key vault allows firewall rules settings |
Terraform |
| 609 |
CKV_AZURE_110 |
resource |
azurerm_key_vault |
Ensure that key vault enables purge protection |
Terraform |
| 610 |
CKV_AZURE_111 |
resource |
azurerm_key_vault |
Ensure that key vault enables soft delete |
Terraform |
| 611 |
CKV_AZURE_112 |
resource |
azurerm_key_vault_key |
Ensure that key vault key is backed by HSM |
Terraform |
| 612 |
CKV_AZURE_113 |
resource |
azurerm_mssql_server |
Ensure that SQL server disables public network access |
Terraform |
| 613 |
CKV_AZURE_114 |
resource |
azurerm_key_vault_secret |
Ensure that key vault secrets have “content_type” set |
Terraform |
| 614 |
CKV_AZURE_115 |
resource |
azurerm_kubernetes_cluster |
Ensure that AKS enables private clusters |
Terraform |
| 615 |
CKV_AZURE_116 |
resource |
azurerm_kubernetes_cluster |
Ensure that AKS uses Azure Policies Add-on |
Terraform |
| 616 |
CKV_AZURE_117 |
resource |
azurerm_kubernetes_cluster |
Ensure that AKS uses disk encryption set |
Terraform |
| 617 |
CKV_AZURE_118 |
resource |
azurerm_network_interface |
Ensure that Network Interfaces disable IP forwarding |
Terraform |
| 618 |
CKV_AZURE_119 |
resource |
azurerm_network_interface |
Ensure that Network Interfaces don’t use public IPs |
Terraform |
| 619 |
CKV_AZURE_120 |
resource |
azurerm_application_gateway |
Ensure that Application Gateway enables WAF |
Terraform |
| 620 |
CKV_AZURE_121 |
resource |
azurerm_frontdoor |
Ensure that Azure Front Door enables WAF |
Terraform |
| 621 |
CKV_AZURE_122 |
resource |
azurerm_web_application_firewall_policy |
Ensure that Application Gateway uses WAF in “Detection” or “Prevention” modes |
Terraform |
| 622 |
CKV_AZURE_123 |
resource |
azurerm_frontdoor_firewall_policy |
Ensure that Azure Front Door uses WAF in “Detection” or “Prevention” modes |
Terraform |
| 623 |
CKV_AZURE_124 |
resource |
azurerm_search_service |
Ensure that Azure Cognitive Search disables public network access |
Terraform |
| 624 |
CKV_AZURE_125 |
resource |
azurerm_service_fabric_cluster |
Ensures that Service Fabric use three levels of protection available |
Terraform |
| 625 |
CKV_AZURE_126 |
resource |
azurerm_service_fabric_cluster |
Ensures that Active Directory is used for authentication for Service Fabric |
Terraform |
| 626 |
CKV_AZURE_127 |
resource |
azurerm_mysql_server |
Ensure that My SQL server enables Threat detection policy |
Terraform |
| 627 |
CKV_AZURE_128 |
resource |
azurerm_postgresql_server |
Ensure that PostgreSQL server enables Threat detection policy |
Terraform |
| 628 |
CKV_AZURE_129 |
resource |
azurerm_mariadb_server |
Ensure that MariaDB server enables geo-redundant backups |
Terraform |
| 629 |
CKV_AZURE_130 |
resource |
azurerm_postgresql_server |
Ensure that PostgreSQL server enables infrastructure encryption |
Terraform |
| 630 |
CKV_AZURE_131 |
resource |
azurerm_security_center_contact |
Ensure that ‘Security contact emails’ is set |
Terraform |
| 631 |
CKV_AZURE_131 |
parameter |
secureString |
SecureString parameter should not have hardcoded default values |
arm |
| 632 |
CKV_AZURE_132 |
resource |
Microsoft.DocumentDB/databaseAccounts |
Ensure cosmosdb does not allow privileged escalation by restricting management plane changes |
arm |
| 633 |
CKV_AZURE_132 |
resource |
azurerm_cosmosdb_account |
Ensure cosmosdb does not allow privileged escalation by restricting management plane changes |
Terraform |
| 634 |
CKV_AZURE_133 |
resource |
azurerm_frontdoor_firewall_policy |
Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell |
Terraform |
| 635 |
CKV_AZURE_134 |
resource |
azurerm_cognitive_account |
Ensure that Cognitive Services accounts disable public network access |
Terraform |
| 636 |
CKV_AZURE_135 |
resource |
azurerm_web_application_firewall_policy |
Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell |
Terraform |
| 637 |
CKV2_AZURE_1 |
resource |
azurerm_storage_account |
Ensure storage for critical data are encrypted with Customer Managed Key |
Terraform |
| 638 |
CKV2_AZURE_2 |
resource |
azurerm_mssql_server_security_alert_policy |
Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account |
Terraform |
| 639 |
CKV2_AZURE_2 |
resource |
azurerm_sql_server |
Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account |
Terraform |
| 640 |
CKV2_AZURE_3 |
resource |
azurerm_mssql_server |
Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server |
Terraform |
| 641 |
CKV2_AZURE_3 |
resource |
azurerm_mssql_server_security_alert_policy |
Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server |
Terraform |
| 642 |
CKV2_AZURE_3 |
resource |
azurerm_mssql_server_vulnerability_assessment |
Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server |
Terraform |
| 643 |
CKV2_AZURE_3 |
resource |
azurerm_sql_server |
Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server |
Terraform |
| 644 |
CKV2_AZURE_4 |
resource |
azurerm_mssql_server |
Ensure Azure SQL server ADS VA Send scan reports to is configured |
Terraform |
| 645 |
CKV2_AZURE_4 |
resource |
azurerm_mssql_server_security_alert_policy |
Ensure Azure SQL server ADS VA Send scan reports to is configured |
Terraform |
| 646 |
CKV2_AZURE_4 |
resource |
azurerm_mssql_server_vulnerability_assessment |
Ensure Azure SQL server ADS VA Send scan reports to is configured |
Terraform |
| 647 |
CKV2_AZURE_4 |
resource |
azurerm_sql_server |
Ensure Azure SQL server ADS VA Send scan reports to is configured |
Terraform |
| 648 |
CKV2_AZURE_5 |
resource |
azurerm_mssql_server |
Ensure that VA setting ‘Also send email notifications to admins and subscription owners’ is set for a SQL server |
Terraform |
| 649 |
CKV2_AZURE_5 |
resource |
azurerm_mssql_server_security_alert_policy |
Ensure that VA setting ‘Also send email notifications to admins and subscription owners’ is set for a SQL server |
Terraform |
| 650 |
CKV2_AZURE_5 |
resource |
azurerm_mssql_server_vulnerability_assessment |
Ensure that VA setting ‘Also send email notifications to admins and subscription owners’ is set for a SQL server |
Terraform |
| 651 |
CKV2_AZURE_5 |
resource |
azurerm_sql_server |
Ensure that VA setting ‘Also send email notifications to admins and subscription owners’ is set for a SQL server |
Terraform |
| 652 |
CKV2_AZURE_6 |
resource |
azurerm_sql_firewall_rule |
Ensure ‘Allow access to Azure services’ for PostgreSQL Database Server is disabled |
Terraform |
| 653 |
CKV2_AZURE_6 |
resource |
azurerm_sql_server |
Ensure ‘Allow access to Azure services’ for PostgreSQL Database Server is disabled |
Terraform |
| 654 |
CKV2_AZURE_7 |
resource |
azurerm_sql_server |
Ensure that Azure Active Directory Admin is configured |
Terraform |
| 655 |
CKV2_AZURE_8 |
resource |
azurerm_monitor_activity_log_alert |
Ensure the storage container storing the activity logs is not publicly accessible |
Terraform |
| 656 |
CKV2_AZURE_8 |
resource |
azurerm_storage_container |
Ensure the storage container storing the activity logs is not publicly accessible |
Terraform |
| 657 |
CKV2_AZURE_9 |
resource |
azurerm_virtual_machine |
Ensure Virtual Machines are utilizing Managed Disks |
Terraform |
| 658 |
CKV2_AZURE_10 |
resource |
azurerm_virtual_machine |
Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines |
Terraform |
| 659 |
CKV2_AZURE_10 |
resource |
azurerm_virtual_machine_extension |
Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines |
Terraform |
| 660 |
CKV2_AZURE_11 |
resource |
azurerm_kusto_cluster |
Ensure that Azure Data Explorer encryption at rest uses a customer-managed key |
Terraform |
| 661 |
CKV2_AZURE_12 |
resource |
azurerm_virtual_machine |
Ensure that virtual machines are backed up using Azure Backup |
Terraform |
| 662 |
CKV2_AZURE_13 |
resource |
azurerm_mssql_server_security_alert_policy |
Ensure that sql servers enables data security policy |
Terraform |
| 663 |
CKV2_AZURE_13 |
resource |
azurerm_sql_server |
Ensure that sql servers enables data security policy |
Terraform |
| 664 |
CKV2_AZURE_14 |
resource |
azurerm_managed_disk |
Ensure that Unattached disks are encrypted |
Terraform |
| 665 |
CKV2_AZURE_14 |
resource |
azurerm_virtual_machine |
Ensure that Unattached disks are encrypted |
Terraform |
| 666 |
CKV2_AZURE_15 |
resource |
azurerm_data_factory |
Ensure that Azure data factories are encrypted with a customer-managed key |
Terraform |
| 667 |
CKV2_AZURE_16 |
resource |
azurerm_mysql_server |
Ensure that MySQL server enables customer-managed key for encryption |
Terraform |
| 668 |
CKV2_AZURE_16 |
resource |
azurerm_mysql_server_key |
Ensure that MySQL server enables customer-managed key for encryption |
Terraform |
| 669 |
CKV2_AZURE_17 |
resource |
azurerm_postgresql_server |
Ensure that PostgreSQL server enables customer-managed key for encryption |
Terraform |
| 670 |
CKV2_AZURE_17 |
resource |
azurerm_postgresql_server_key |
Ensure that PostgreSQL server enables customer-managed key for encryption |
Terraform |
| 671 |
CKV2_AZURE_18 |
resource |
azurerm_storage_account |
Ensure that Storage Accounts use customer-managed key for encryption |
Terraform |
| 672 |
CKV2_AZURE_18 |
resource |
azurerm_storage_account_customer_managed_key |
Ensure that Storage Accounts use customer-managed key for encryption |
Terraform |
| 673 |
CKV2_AZURE_19 |
resource |
azurerm_synapse_workspace |
Ensure that Azure Synapse workspaces have no IP firewall rules attached |
Terraform |
| 674 |
CKV2_AZURE_20 |
resource |
azurerm_log_analytics_storage_insights |
Ensure Storage logging is enabled for Table service for read requests |
Terraform |
| 675 |
CKV2_AZURE_20 |
resource |
azurerm_storage_account |
Ensure Storage logging is enabled for Table service for read requests |
Terraform |
| 676 |
CKV2_AZURE_20 |
resource |
azurerm_storage_table |
Ensure Storage logging is enabled for Table service for read requests |
Terraform |
| 677 |
CKV2_AZURE_21 |
resource |
azurerm_log_analytics_storage_insights |
Ensure Storage logging is enabled for Blob service for read requests |
Terraform |
| 678 |
CKV2_AZURE_21 |
resource |
azurerm_storage_account |
Ensure Storage logging is enabled for Blob service for read requests |
Terraform |
| 679 |
CKV2_AZURE_21 |
resource |
azurerm_storage_container |
Ensure Storage logging is enabled for Blob service for read requests |
Terraform |
| 680 |
CKV2_AZURE_22 |
resource |
azurerm_cognitive_account |
Ensure that Cognitive Services enables customer-managed key for encryption |
Terraform |
| 681 |
CKV2_AZURE_22 |
resource |
azurerm_cognitive_account_customer_managed_key |
Ensure that Cognitive Services enables customer-managed key for encryption |
Terraform |
| 682 |
CKV_BCW_1 |
provider |
bridgecrew |
Ensure no hard coded API token exist in the provider |
Terraform |
| 683 |
CKV_DIO_1 |
resource |
digitalocean_spaces_bucket |
Ensure the Spaces bucket has versioning enabled |
Terraform |
| 684 |
CKV_DIO_2 |
resource |
digitalocean_droplet |
Ensure the droplet specifies an SSH key |
Terraform |
| 685 |
CKV_DIO_3 |
resource |
digitalocean_spaces_bucket |
Ensure the Spaces bucket is private |
Terraform |
| 686 |
CKV_DIO_4 |
resource |
digitalocean_firewall |
Ensure the firewall ingress is not wide open |
Terraform |
| 687 |
CKV_DOCKER_1 |
dockerfile |
EXPOSE |
Ensure port 22 is not exposed |
dockerfile |
| 688 |
CKV_DOCKER_2 |
dockerfile |
* |
Ensure that HEALTHCHECK instructions have been added to container images |
dockerfile |
| 689 |
CKV_DOCKER_3 |
dockerfile |
* |
Ensure that a user for the container has been created |
dockerfile |
| 690 |
CKV_DOCKER_4 |
dockerfile |
ADD |
Ensure that COPY is used instead of ADD in Dockerfiles |
dockerfile |
| 691 |
CKV_DOCKER_5 |
dockerfile |
RUN |
Ensure update instructions are not use alone in the Dockerfile |
dockerfile |
| 692 |
CKV_DOCKER_6 |
dockerfile |
MAINTAINER |
Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) |
dockerfile |
| 693 |
CKV_DOCKER_7 |
dockerfile |
FROM |
Ensure the base image uses a non latest version tag |
dockerfile |
| 694 |
CKV_DOCKER_8 |
dockerfile |
USER |
Ensure the last USER is not root |
dockerfile |
| 695 |
CKV_GCP_1 |
resource |
google_container_cluster |
Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters |
Terraform |
| 696 |
CKV_GCP_2 |
resource |
google_compute_firewall |
Ensure Google compute firewall ingress does not allow unrestricted ssh access |
Terraform |
| 697 |
CKV_GCP_3 |
resource |
google_compute_firewall |
Ensure Google compute firewall ingress does not allow unrestricted rdp access |
Terraform |
| 698 |
CKV_GCP_4 |
resource |
google_compute_ssl_policy |
Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites |
Terraform |
| 699 |
CKV_GCP_6 |
resource |
google_sql_database_instance |
Ensure all Cloud SQL database instance requires all incoming connections to use SSL |
Terraform |
| 700 |
CKV_GCP_7 |
resource |
google_container_cluster |
Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters |
Terraform |
| 701 |
CKV_GCP_8 |
resource |
google_container_cluster |
Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters |
Terraform |
| 702 |
CKV_GCP_9 |
resource |
google_container_node_pool |
Ensure ‘Automatic node repair’ is enabled for Kubernetes Clusters |
Terraform |
| 703 |
CKV_GCP_10 |
resource |
google_container_node_pool |
Ensure ‘Automatic node upgrade’ is enabled for Kubernetes Clusters |
Terraform |
| 704 |
CKV_GCP_11 |
resource |
google_sql_database_instance |
Ensure that Cloud SQL database Instances are not open to the world |
Terraform |
| 705 |
CKV_GCP_12 |
resource |
google_container_cluster |
Ensure Network Policy is enabled on Kubernetes Engine Clusters |
Terraform |
| 706 |
CKV_GCP_13 |
resource |
google_container_cluster |
Ensure a client certificate is used by clients to authenticate to Kubernetes Engine Clusters |
Terraform |
| 707 |
CKV_GCP_14 |
resource |
google_sql_database_instance |
Ensure all Cloud SQL database instance have backup configuration enabled |
Terraform |
| 708 |
CKV_GCP_15 |
resource |
google_bigquery_dataset |
Ensure that BigQuery datasets are not anonymously or publicly accessible |
Terraform |
| 709 |
CKV_GCP_16 |
resource |
google_dns_managed_zone |
Ensure that DNSSEC is enabled for Cloud DNS |
Terraform |
| 710 |
CKV_GCP_17 |
resource |
google_dns_managed_zone |
Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC |
Terraform |
| 711 |
CKV_GCP_18 |
resource |
google_container_cluster |
Ensure GKE Control Plane is not public |
Terraform |
| 712 |
CKV_GCP_19 |
resource |
google_container_cluster |
Ensure GKE basic auth is disabled |
Terraform |
| 713 |
CKV_GCP_20 |
resource |
google_container_cluster |
Ensure master authorized networks is set to enabled in GKE clusters |
Terraform |
| 714 |
CKV_GCP_21 |
resource |
google_container_cluster |
Ensure Kubernetes Clusters are configured with Labels |
Terraform |
| 715 |
CKV_GCP_22 |
resource |
google_container_node_pool |
Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image |
Terraform |
| 716 |
CKV_GCP_23 |
resource |
google_container_cluster |
Ensure Kubernetes Cluster is created with Alias IP ranges enabled |
Terraform |
| 717 |
CKV_GCP_24 |
resource |
google_container_cluster |
Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters |
Terraform |
| 718 |
CKV_GCP_25 |
resource |
google_container_cluster |
Ensure Kubernetes Cluster is created with Private cluster enabled |
Terraform |
| 719 |
CKV_GCP_26 |
resource |
google_compute_subnetwork |
Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network |
Terraform |
| 720 |
CKV_GCP_27 |
resource |
google_project |
Ensure that the default network does not exist in a project |
Terraform |
| 721 |
CKV_GCP_28 |
resource |
google_storage_bucket_iam_binding |
Ensure that Cloud Storage bucket is not anonymously or publicly accessible |
Terraform |
| 722 |
CKV_GCP_28 |
resource |
google_storage_bucket_iam_member |
Ensure that Cloud Storage bucket is not anonymously or publicly accessible |
Terraform |
| 723 |
CKV_GCP_29 |
resource |
google_storage_bucket |
Ensure that Cloud Storage buckets have uniform bucket-level access enabled |
Terraform |
| 724 |
CKV_GCP_30 |
resource |
google_compute_instance |
Ensure that instances are not configured to use the default service account |
Terraform |
| 725 |
CKV_GCP_30 |
resource |
google_compute_instance_from_template |
Ensure that instances are not configured to use the default service account |
Terraform |
| 726 |
CKV_GCP_30 |
resource |
google_compute_instance_template |
Ensure that instances are not configured to use the default service account |
Terraform |
| 727 |
CKV_GCP_31 |
resource |
google_compute_instance |
Ensure that instances are not configured to use the default service account with full access to all Cloud APIs |
Terraform |
| 728 |
CKV_GCP_31 |
resource |
google_compute_instance_from_template |
Ensure that instances are not configured to use the default service account with full access to all Cloud APIs |
Terraform |
| 729 |
CKV_GCP_31 |
resource |
google_compute_instance_template |
Ensure that instances are not configured to use the default service account with full access to all Cloud APIs |
Terraform |
| 730 |
CKV_GCP_32 |
resource |
google_compute_instance |
Ensure ‘Block Project-wide SSH keys’ is enabled for VM instances |
Terraform |
| 731 |
CKV_GCP_32 |
resource |
google_compute_instance_from_template |
Ensure ‘Block Project-wide SSH keys’ is enabled for VM instances |
Terraform |
| 732 |
CKV_GCP_32 |
resource |
google_compute_instance_template |
Ensure ‘Block Project-wide SSH keys’ is enabled for VM instances |
Terraform |
| 733 |
CKV_GCP_33 |
resource |
google_compute_project_metadata |
Ensure oslogin is enabled for a Project |
Terraform |
| 734 |
CKV_GCP_34 |
resource |
google_compute_instance |
Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) |
Terraform |
| 735 |
CKV_GCP_34 |
resource |
google_compute_instance_from_template |
Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) |
Terraform |
| 736 |
CKV_GCP_34 |
resource |
google_compute_instance_template |
Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) |
Terraform |
| 737 |
CKV_GCP_35 |
resource |
google_compute_instance |
Ensure ‘Enable connecting to serial ports’ is not enabled for VM Instance |
Terraform |
| 738 |
CKV_GCP_35 |
resource |
google_compute_instance_from_template |
Ensure ‘Enable connecting to serial ports’ is not enabled for VM Instance |
Terraform |
| 739 |
CKV_GCP_35 |
resource |
google_compute_instance_template |
Ensure ‘Enable connecting to serial ports’ is not enabled for VM Instance |
Terraform |
| 740 |
CKV_GCP_36 |
resource |
google_compute_instance |
Ensure that IP forwarding is not enabled on Instances |
Terraform |
| 741 |
CKV_GCP_36 |
resource |
google_compute_instance_from_template |
Ensure that IP forwarding is not enabled on Instances |
Terraform |
| 742 |
CKV_GCP_36 |
resource |
google_compute_instance_template |
Ensure that IP forwarding is not enabled on Instances |
Terraform |
| 743 |
CKV_GCP_37 |
resource |
google_compute_disk |
Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) |
Terraform |
| 744 |
CKV_GCP_38 |
resource |
google_compute_instance |
Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) |
Terraform |
| 745 |
CKV_GCP_39 |
resource |
google_compute_instance |
Ensure Compute instances are launched with Shielded VM enabled |
Terraform |
| 746 |
CKV_GCP_39 |
resource |
google_compute_instance_from_template |
Ensure Compute instances are launched with Shielded VM enabled |
Terraform |
| 747 |
CKV_GCP_39 |
resource |
google_compute_instance_template |
Ensure Compute instances are launched with Shielded VM enabled |
Terraform |
| 748 |
CKV_GCP_40 |
resource |
google_compute_instance |
Ensure that Compute instances do not have public IP addresses |
Terraform |
| 749 |
CKV_GCP_40 |
resource |
google_compute_instance_from_template |
Ensure that Compute instances do not have public IP addresses |
Terraform |
| 750 |
CKV_GCP_40 |
resource |
google_compute_instance_template |
Ensure that Compute instances do not have public IP addresses |
Terraform |
| 751 |
CKV_GCP_41 |
resource |
google_project_iam_binding |
Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level |
Terraform |
| 752 |
CKV_GCP_41 |
resource |
google_project_iam_member |
Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level |
Terraform |
| 753 |
CKV_GCP_42 |
resource |
google_project_iam_member |
Ensure that Service Account has no Admin privileges |
Terraform |
| 754 |
CKV_GCP_43 |
resource |
google_kms_crypto_key |
Ensure KMS encryption keys are rotated within a period of 90 days |
Terraform |
| 755 |
CKV_GCP_44 |
resource |
google_folder_iam_binding |
Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level |
Terraform |
| 756 |
CKV_GCP_44 |
resource |
google_folder_iam_member |
Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level |
Terraform |
| 757 |
CKV_GCP_45 |
resource |
google_organization_iam_binding |
Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level |
Terraform |
| 758 |
CKV_GCP_45 |
resource |
google_organization_iam_member |
Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level |
Terraform |
| 759 |
CKV_GCP_46 |
resource |
google_project_iam_binding |
Ensure Default Service account is not used at a project level |
Terraform |
| 760 |
CKV_GCP_46 |
resource |
google_project_iam_member |
Ensure Default Service account is not used at a project level |
Terraform |
| 761 |
CKV_GCP_47 |
resource |
google_organization_iam_binding |
Ensure default service account is not used at an organization level |
Terraform |
| 762 |
CKV_GCP_47 |
resource |
google_organization_iam_member |
Ensure default service account is not used at an organization level |
Terraform |
| 763 |
CKV_GCP_48 |
resource |
google_folder_iam_binding |
Ensure Default Service account is not used at a folder level |
Terraform |
| 764 |
CKV_GCP_48 |
resource |
google_folder_iam_member |
Ensure Default Service account is not used at a folder level |
Terraform |
| 765 |
CKV_GCP_49 |
resource |
google_project_iam_binding |
Ensure no roles that enable to impersonate and manage all service accounts are used at a project level |
Terraform |
| 766 |
CKV_GCP_49 |
resource |
google_project_iam_member |
Ensure no roles that enable to impersonate and manage all service accounts are used at a project level |
Terraform |
| 767 |
CKV_GCP_50 |
resource |
google_sql_database_instance |
Ensure MySQL database ‘local_infile’ flag is set to ‘off’ |
Terraform |
| 768 |
CKV_GCP_51 |
resource |
google_sql_database_instance |
Ensure PostgreSQL database ‘log_checkpoints’ flag is set to ‘on’ |
Terraform |
| 769 |
CKV_GCP_52 |
resource |
google_sql_database_instance |
Ensure PostgreSQL database ‘log_connections’ flag is set to ‘on’ |
Terraform |
| 770 |
CKV_GCP_53 |
resource |
google_sql_database_instance |
Ensure PostgreSQL database ‘log_disconnections’ flag is set to ‘on’ |
Terraform |
| 771 |
CKV_GCP_54 |
resource |
google_sql_database_instance |
Ensure PostgreSQL database ‘log_lock_waits’ flag is set to ‘on’ |
Terraform |
| 772 |
CKV_GCP_55 |
resource |
google_sql_database_instance |
Ensure PostgreSQL database ‘log_min_messages’ flag is set to a valid value |
Terraform |
| 773 |
CKV_GCP_56 |
resource |
google_sql_database_instance |
Ensure PostgreSQL database ‘log_temp_files flag is set to ‘0’ |
Terraform |
| 774 |
CKV_GCP_57 |
resource |
google_sql_database_instance |
Ensure PostgreSQL database ‘log_min_duration_statement’ flag is set to ‘-1’ |
Terraform |
| 775 |
CKV_GCP_58 |
resource |
google_sql_database_instance |
Ensure SQL database ‘cross db ownership chaining’ flag is set to ‘off’ |
Terraform |
| 776 |
CKV_GCP_59 |
resource |
google_sql_database_instance |
Ensure SQL database ‘contained database authentication’ flag is set to ‘off’ |
Terraform |
| 777 |
CKV_GCP_60 |
resource |
google_sql_database_instance |
Ensure SQL database do not have public IP |
Terraform |
| 778 |
CKV_GCP_61 |
resource |
google_container_cluster |
Enable VPC Flow Logs and Intranode Visibility |
Terraform |
| 779 |
CKV_GCP_62 |
resource |
google_storage_bucket |
Bucket should log access |
Terraform |
| 780 |
CKV_GCP_63 |
resource |
google_storage_bucket |
Bucket should not log to itself |
Terraform |
| 781 |
CKV_GCP_64 |
resource |
google_container_cluster |
Ensure clusters are created with Private Nodes |
Terraform |
| 782 |
CKV_GCP_65 |
resource |
google_container_cluster |
Manage Kubernetes RBAC users with Google Groups for GKE |
Terraform |
| 783 |
CKV_GCP_66 |
resource |
google_container_cluster |
Ensure use of Binary Authorization |
Terraform |
| 784 |
CKV_GCP_67 |
resource |
google_container_cluster |
Ensure legacy Compute Engine instance metadata APIs are Disabled |
Terraform |
| 785 |
CKV_GCP_68 |
resource |
google_container_cluster |
Ensure Secure Boot for Shielded GKE Nodes is Enabled |
Terraform |
| 786 |
CKV_GCP_68 |
resource |
google_container_node_pool |
Ensure Secure Boot for Shielded GKE Nodes is Enabled |
Terraform |
| 787 |
CKV_GCP_69 |
resource |
google_container_cluster |
Ensure the GKE Metadata Server is Enabled |
Terraform |
| 788 |
CKV_GCP_69 |
resource |
google_container_node_pool |
Ensure the GKE Metadata Server is Enabled |
Terraform |
| 789 |
CKV_GCP_70 |
resource |
google_container_cluster |
Ensure the GKE Release Channel is set |
Terraform |
| 790 |
CKV_GCP_71 |
resource |
google_container_cluster |
Ensure Shielded GKE Nodes are Enabled |
Terraform |
| 791 |
CKV_GCP_72 |
resource |
google_container_cluster |
Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled |
Terraform |
| 792 |
CKV_GCP_72 |
resource |
google_container_node_pool |
Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled |
Terraform |
| 793 |
CKV_GCP_73 |
resource |
google_compute_security_policy |
Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell |
Terraform |
| 794 |
CKV2_GCP_1 |
resource |
google_project_default_service_accounts |
Ensure GKE clusters are not running using the Compute Engine default service account |
Terraform |
| 795 |
CKV2_GCP_2 |
resource |
google_compute_network |
Ensure legacy networks do not exist for a project |
Terraform |
| 796 |
CKV2_GCP_3 |
resource |
google_service_account_key |
Ensure that there are only GCP-managed service account keys for each service account |
Terraform |
| 797 |
CKV2_GCP_4 |
resource |
google_logging_folder_sink |
Ensure that retention policies on log buckets are configured using Bucket Lock |
Terraform |
| 798 |
CKV2_GCP_4 |
resource |
google_logging_organization_sink |
Ensure that retention policies on log buckets are configured using Bucket Lock |
Terraform |
| 799 |
CKV2_GCP_4 |
resource |
google_logging_project_sink |
Ensure that retention policies on log buckets are configured using Bucket Lock |
Terraform |
| 800 |
CKV2_GCP_4 |
resource |
google_storage_bucket |
Ensure that retention policies on log buckets are configured using Bucket Lock |
Terraform |
| 801 |
CKV2_GCP_5 |
resource |
google_project |
Ensure that Cloud Audit Logging is configured properly across all services and all users from a project |
Terraform |
| 802 |
CKV2_GCP_5 |
resource |
google_project_iam_audit_config |
Ensure that Cloud Audit Logging is configured properly across all services and all users from a project |
Terraform |
| 803 |
CKV2_GCP_6 |
resource |
google_kms_crypto_key |
Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible |
Terraform |
| 804 |
CKV2_GCP_6 |
resource |
google_kms_crypto_key_iam_binding |
Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible |
Terraform |
| 805 |
CKV2_GCP_6 |
resource |
google_kms_crypto_key_iam_member |
Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible |
Terraform |
| 806 |
CKV2_GCP_7 |
resource |
google_sql_database_instance |
Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges |
Terraform |
| 807 |
CKV2_GCP_7 |
resource |
google_sql_user |
Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges |
Terraform |
| 808 |
CKV_GIT_1 |
resource |
github_repository |
Ensure Repository is Private |
Terraform |
| 809 |
CKV_GIT_2 |
resource |
github_repository_webhook |
Ensure Repository Webhook uses secure Ssl |
Terraform |
| 810 |
CKV_GITHUB_1 |
github_configuration |
* |
Ensure GitHub organization security settings require 2FA |
github_configuration |
| 811 |
CKV_GITHUB_2 |
github_configuration |
* |
Ensure GitHub organization security settings require SSO |
github_configuration |
| 812 |
CKV_GITHUB_3 |
github_configuration |
* |
Ensure GitHub organization security settings has IP allow list enabled |
github_configuration |
| 813 |
CKV_GITHUB_4 |
github_configuration |
* |
Ensure GitHub branch protection rules requires signed commits |
github_configuration |
| 814 |
CKV_GITHUB_5 |
github_configuration |
* |
Ensure GitHub branch protection rules does not allow force pushes |
github_configuration |
| 815 |
CKV_GITLAB_1 |
gitlab_configuration |
* |
Merge requests should require at least 2 approvals |
gitlab_configuration |
| 816 |
CKV_GITLAB_2 |
gitlab_configuration |
* |
Ensure all Gitlab groups require two factor authentication |
gitlab_configuration |
| 817 |
CKV_K8S_1 |
resource |
PodSecurityPolicy |
Do not admit containers wishing to share the host process ID namespace |
Kubernetes |
| 818 |
CKV_K8S_2 |
resource |
PodSecurityPolicy |
Do not admit privileged containers |
Kubernetes |
| 819 |
CKV_K8S_3 |
resource |
PodSecurityPolicy |
Do not admit containers wishing to share the host IPC namespace |
Kubernetes |
| 820 |
CKV_K8S_4 |
resource |
PodSecurityPolicy |
Do not admit containers wishing to share the host network namespace |
Kubernetes |
| 821 |
CKV_K8S_5 |
resource |
PodSecurityPolicy |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 822 |
CKV_K8S_6 |
resource |
PodSecurityPolicy |
Do not admit root containers |
Kubernetes |
| 823 |
CKV_K8S_7 |
resource |
PodSecurityPolicy |
Do not admit containers with the NET_RAW capability |
Kubernetes |
| 824 |
CKV_K8S_8 |
resource |
DaemonSet |
Liveness Probe Should be Configured |
Kubernetes |
| 825 |
CKV_K8S_8 |
resource |
Deployment |
Liveness Probe Should be Configured |
Kubernetes |
| 826 |
CKV_K8S_8 |
resource |
Pod |
Liveness Probe Should be Configured |
Kubernetes |
| 827 |
CKV_K8S_8 |
resource |
PodTemplate |
Liveness Probe Should be Configured |
Kubernetes |
| 828 |
CKV_K8S_8 |
resource |
ReplicaSet |
Liveness Probe Should be Configured |
Kubernetes |
| 829 |
CKV_K8S_8 |
resource |
ReplicationController |
Liveness Probe Should be Configured |
Kubernetes |
| 830 |
CKV_K8S_8 |
resource |
StatefulSet |
Liveness Probe Should be Configured |
Kubernetes |
| 831 |
CKV_K8S_9 |
resource |
DaemonSet |
Readiness Probe Should be Configured |
Kubernetes |
| 832 |
CKV_K8S_9 |
resource |
Deployment |
Readiness Probe Should be Configured |
Kubernetes |
| 833 |
CKV_K8S_9 |
resource |
Pod |
Readiness Probe Should be Configured |
Kubernetes |
| 834 |
CKV_K8S_9 |
resource |
PodTemplate |
Readiness Probe Should be Configured |
Kubernetes |
| 835 |
CKV_K8S_9 |
resource |
ReplicaSet |
Readiness Probe Should be Configured |
Kubernetes |
| 836 |
CKV_K8S_9 |
resource |
ReplicationController |
Readiness Probe Should be Configured |
Kubernetes |
| 837 |
CKV_K8S_9 |
resource |
StatefulSet |
Readiness Probe Should be Configured |
Kubernetes |
| 838 |
CKV_K8S_10 |
resource |
CronJob |
CPU requests should be set |
Kubernetes |
| 839 |
CKV_K8S_10 |
resource |
DaemonSet |
CPU requests should be set |
Kubernetes |
| 840 |
CKV_K8S_10 |
resource |
Deployment |
CPU requests should be set |
Kubernetes |
| 841 |
CKV_K8S_10 |
resource |
Job |
CPU requests should be set |
Kubernetes |
| 842 |
CKV_K8S_10 |
resource |
Pod |
CPU requests should be set |
Kubernetes |
| 843 |
CKV_K8S_10 |
resource |
PodTemplate |
CPU requests should be set |
Kubernetes |
| 844 |
CKV_K8S_10 |
resource |
ReplicaSet |
CPU requests should be set |
Kubernetes |
| 845 |
CKV_K8S_10 |
resource |
ReplicationController |
CPU requests should be set |
Kubernetes |
| 846 |
CKV_K8S_10 |
resource |
StatefulSet |
CPU requests should be set |
Kubernetes |
| 847 |
CKV_K8S_11 |
resource |
CronJob |
CPU limits should be set |
Kubernetes |
| 848 |
CKV_K8S_11 |
resource |
DaemonSet |
CPU limits should be set |
Kubernetes |
| 849 |
CKV_K8S_11 |
resource |
Deployment |
CPU limits should be set |
Kubernetes |
| 850 |
CKV_K8S_11 |
resource |
Job |
CPU limits should be set |
Kubernetes |
| 851 |
CKV_K8S_11 |
resource |
Pod |
CPU limits should be set |
Kubernetes |
| 852 |
CKV_K8S_11 |
resource |
PodTemplate |
CPU limits should be set |
Kubernetes |
| 853 |
CKV_K8S_11 |
resource |
ReplicaSet |
CPU limits should be set |
Kubernetes |
| 854 |
CKV_K8S_11 |
resource |
ReplicationController |
CPU limits should be set |
Kubernetes |
| 855 |
CKV_K8S_11 |
resource |
StatefulSet |
CPU limits should be set |
Kubernetes |
| 856 |
CKV_K8S_12 |
resource |
CronJob |
Memory requests should be set |
Kubernetes |
| 857 |
CKV_K8S_12 |
resource |
DaemonSet |
Memory requests should be set |
Kubernetes |
| 858 |
CKV_K8S_12 |
resource |
Deployment |
Memory requests should be set |
Kubernetes |
| 859 |
CKV_K8S_12 |
resource |
Job |
Memory requests should be set |
Kubernetes |
| 860 |
CKV_K8S_12 |
resource |
Pod |
Memory requests should be set |
Kubernetes |
| 861 |
CKV_K8S_12 |
resource |
PodTemplate |
Memory requests should be set |
Kubernetes |
| 862 |
CKV_K8S_12 |
resource |
ReplicaSet |
Memory requests should be set |
Kubernetes |
| 863 |
CKV_K8S_12 |
resource |
ReplicationController |
Memory requests should be set |
Kubernetes |
| 864 |
CKV_K8S_12 |
resource |
StatefulSet |
Memory requests should be set |
Kubernetes |
| 865 |
CKV_K8S_13 |
resource |
CronJob |
Memory limits should be set |
Kubernetes |
| 866 |
CKV_K8S_13 |
resource |
DaemonSet |
Memory limits should be set |
Kubernetes |
| 867 |
CKV_K8S_13 |
resource |
Deployment |
Memory limits should be set |
Kubernetes |
| 868 |
CKV_K8S_13 |
resource |
Job |
Memory limits should be set |
Kubernetes |
| 869 |
CKV_K8S_13 |
resource |
Pod |
Memory limits should be set |
Kubernetes |
| 870 |
CKV_K8S_13 |
resource |
PodTemplate |
Memory limits should be set |
Kubernetes |
| 871 |
CKV_K8S_13 |
resource |
ReplicaSet |
Memory limits should be set |
Kubernetes |
| 872 |
CKV_K8S_13 |
resource |
ReplicationController |
Memory limits should be set |
Kubernetes |
| 873 |
CKV_K8S_13 |
resource |
StatefulSet |
Memory limits should be set |
Kubernetes |
| 874 |
CKV_K8S_14 |
resource |
CronJob |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 875 |
CKV_K8S_14 |
resource |
DaemonSet |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 876 |
CKV_K8S_14 |
resource |
Deployment |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 877 |
CKV_K8S_14 |
resource |
Job |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 878 |
CKV_K8S_14 |
resource |
Pod |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 879 |
CKV_K8S_14 |
resource |
PodTemplate |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 880 |
CKV_K8S_14 |
resource |
ReplicaSet |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 881 |
CKV_K8S_14 |
resource |
ReplicationController |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 882 |
CKV_K8S_14 |
resource |
StatefulSet |
Image Tag should be fixed - not latest or blank |
Kubernetes |
| 883 |
CKV_K8S_15 |
resource |
CronJob |
Image Pull Policy should be Always |
Kubernetes |
| 884 |
CKV_K8S_15 |
resource |
DaemonSet |
Image Pull Policy should be Always |
Kubernetes |
| 885 |
CKV_K8S_15 |
resource |
Deployment |
Image Pull Policy should be Always |
Kubernetes |
| 886 |
CKV_K8S_15 |
resource |
Job |
Image Pull Policy should be Always |
Kubernetes |
| 887 |
CKV_K8S_15 |
resource |
Pod |
Image Pull Policy should be Always |
Kubernetes |
| 888 |
CKV_K8S_15 |
resource |
PodTemplate |
Image Pull Policy should be Always |
Kubernetes |
| 889 |
CKV_K8S_15 |
resource |
ReplicaSet |
Image Pull Policy should be Always |
Kubernetes |
| 890 |
CKV_K8S_15 |
resource |
ReplicationController |
Image Pull Policy should be Always |
Kubernetes |
| 891 |
CKV_K8S_15 |
resource |
StatefulSet |
Image Pull Policy should be Always |
Kubernetes |
| 892 |
CKV_K8S_16 |
resource |
CronJob |
Container should not be privileged |
Kubernetes |
| 893 |
CKV_K8S_16 |
resource |
DaemonSet |
Container should not be privileged |
Kubernetes |
| 894 |
CKV_K8S_16 |
resource |
Deployment |
Container should not be privileged |
Kubernetes |
| 895 |
CKV_K8S_16 |
resource |
Job |
Container should not be privileged |
Kubernetes |
| 896 |
CKV_K8S_16 |
resource |
Pod |
Container should not be privileged |
Kubernetes |
| 897 |
CKV_K8S_16 |
resource |
PodTemplate |
Container should not be privileged |
Kubernetes |
| 898 |
CKV_K8S_16 |
resource |
ReplicaSet |
Container should not be privileged |
Kubernetes |
| 899 |
CKV_K8S_16 |
resource |
ReplicationController |
Container should not be privileged |
Kubernetes |
| 900 |
CKV_K8S_16 |
resource |
StatefulSet |
Container should not be privileged |
Kubernetes |
| 901 |
CKV_K8S_17 |
resource |
CronJob |
Containers should not share the host process ID namespace |
Kubernetes |
| 902 |
CKV_K8S_17 |
resource |
DaemonSet |
Containers should not share the host process ID namespace |
Kubernetes |
| 903 |
CKV_K8S_17 |
resource |
Deployment |
Containers should not share the host process ID namespace |
Kubernetes |
| 904 |
CKV_K8S_17 |
resource |
Job |
Containers should not share the host process ID namespace |
Kubernetes |
| 905 |
CKV_K8S_17 |
resource |
Pod |
Containers should not share the host process ID namespace |
Kubernetes |
| 906 |
CKV_K8S_17 |
resource |
ReplicaSet |
Containers should not share the host process ID namespace |
Kubernetes |
| 907 |
CKV_K8S_17 |
resource |
ReplicationController |
Containers should not share the host process ID namespace |
Kubernetes |
| 908 |
CKV_K8S_17 |
resource |
StatefulSet |
Containers should not share the host process ID namespace |
Kubernetes |
| 909 |
CKV_K8S_18 |
resource |
CronJob |
Containers should not share the host IPC namespace |
Kubernetes |
| 910 |
CKV_K8S_18 |
resource |
DaemonSet |
Containers should not share the host IPC namespace |
Kubernetes |
| 911 |
CKV_K8S_18 |
resource |
Deployment |
Containers should not share the host IPC namespace |
Kubernetes |
| 912 |
CKV_K8S_18 |
resource |
Job |
Containers should not share the host IPC namespace |
Kubernetes |
| 913 |
CKV_K8S_18 |
resource |
Pod |
Containers should not share the host IPC namespace |
Kubernetes |
| 914 |
CKV_K8S_18 |
resource |
ReplicaSet |
Containers should not share the host IPC namespace |
Kubernetes |
| 915 |
CKV_K8S_18 |
resource |
ReplicationController |
Containers should not share the host IPC namespace |
Kubernetes |
| 916 |
CKV_K8S_18 |
resource |
StatefulSet |
Containers should not share the host IPC namespace |
Kubernetes |
| 917 |
CKV_K8S_19 |
resource |
CronJob |
Containers should not share the host network namespace |
Kubernetes |
| 918 |
CKV_K8S_19 |
resource |
DaemonSet |
Containers should not share the host network namespace |
Kubernetes |
| 919 |
CKV_K8S_19 |
resource |
Deployment |
Containers should not share the host network namespace |
Kubernetes |
| 920 |
CKV_K8S_19 |
resource |
Job |
Containers should not share the host network namespace |
Kubernetes |
| 921 |
CKV_K8S_19 |
resource |
Pod |
Containers should not share the host network namespace |
Kubernetes |
| 922 |
CKV_K8S_19 |
resource |
ReplicaSet |
Containers should not share the host network namespace |
Kubernetes |
| 923 |
CKV_K8S_19 |
resource |
ReplicationController |
Containers should not share the host network namespace |
Kubernetes |
| 924 |
CKV_K8S_19 |
resource |
StatefulSet |
Containers should not share the host network namespace |
Kubernetes |
| 925 |
CKV_K8S_20 |
resource |
CronJob |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 926 |
CKV_K8S_20 |
resource |
DaemonSet |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 927 |
CKV_K8S_20 |
resource |
Deployment |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 928 |
CKV_K8S_20 |
resource |
Job |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 929 |
CKV_K8S_20 |
resource |
Pod |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 930 |
CKV_K8S_20 |
resource |
PodTemplate |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 931 |
CKV_K8S_20 |
resource |
ReplicaSet |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 932 |
CKV_K8S_20 |
resource |
ReplicationController |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 933 |
CKV_K8S_20 |
resource |
StatefulSet |
Containers should not run with allowPrivilegeEscalation |
Kubernetes |
| 934 |
CKV_K8S_21 |
resource |
ConfigMap |
The default namespace should not be used |
Kubernetes |
| 935 |
CKV_K8S_21 |
resource |
CronJob |
The default namespace should not be used |
Kubernetes |
| 936 |
CKV_K8S_21 |
resource |
DaemonSet |
The default namespace should not be used |
Kubernetes |
| 937 |
CKV_K8S_21 |
resource |
Deployment |
The default namespace should not be used |
Kubernetes |
| 938 |
CKV_K8S_21 |
resource |
Ingress |
The default namespace should not be used |
Kubernetes |
| 939 |
CKV_K8S_21 |
resource |
Job |
The default namespace should not be used |
Kubernetes |
| 940 |
CKV_K8S_21 |
resource |
Pod |
The default namespace should not be used |
Kubernetes |
| 941 |
CKV_K8S_21 |
resource |
ReplicaSet |
The default namespace should not be used |
Kubernetes |
| 942 |
CKV_K8S_21 |
resource |
ReplicationController |
The default namespace should not be used |
Kubernetes |
| 943 |
CKV_K8S_21 |
resource |
Role |
The default namespace should not be used |
Kubernetes |
| 944 |
CKV_K8S_21 |
resource |
RoleBinding |
The default namespace should not be used |
Kubernetes |
| 945 |
CKV_K8S_21 |
resource |
Secret |
The default namespace should not be used |
Kubernetes |
| 946 |
CKV_K8S_21 |
resource |
Service |
The default namespace should not be used |
Kubernetes |
| 947 |
CKV_K8S_21 |
resource |
ServiceAccount |
The default namespace should not be used |
Kubernetes |
| 948 |
CKV_K8S_21 |
resource |
StatefulSet |
The default namespace should not be used |
Kubernetes |
| 949 |
CKV_K8S_22 |
resource |
CronJob |
Use read-only filesystem for containers where possible |
Kubernetes |
| 950 |
CKV_K8S_22 |
resource |
DaemonSet |
Use read-only filesystem for containers where possible |
Kubernetes |
| 951 |
CKV_K8S_22 |
resource |
Deployment |
Use read-only filesystem for containers where possible |
Kubernetes |
| 952 |
CKV_K8S_22 |
resource |
Job |
Use read-only filesystem for containers where possible |
Kubernetes |
| 953 |
CKV_K8S_22 |
resource |
Pod |
Use read-only filesystem for containers where possible |
Kubernetes |
| 954 |
CKV_K8S_22 |
resource |
PodTemplate |
Use read-only filesystem for containers where possible |
Kubernetes |
| 955 |
CKV_K8S_22 |
resource |
ReplicaSet |
Use read-only filesystem for containers where possible |
Kubernetes |
| 956 |
CKV_K8S_22 |
resource |
ReplicationController |
Use read-only filesystem for containers where possible |
Kubernetes |
| 957 |
CKV_K8S_22 |
resource |
StatefulSet |
Use read-only filesystem for containers where possible |
Kubernetes |
| 958 |
CKV_K8S_23 |
resource |
CronJob |
Minimize the admission of root containers |
Kubernetes |
| 959 |
CKV_K8S_23 |
resource |
DaemonSet |
Minimize the admission of root containers |
Kubernetes |
| 960 |
CKV_K8S_23 |
resource |
Deployment |
Minimize the admission of root containers |
Kubernetes |
| 961 |
CKV_K8S_23 |
resource |
Job |
Minimize the admission of root containers |
Kubernetes |
| 962 |
CKV_K8S_23 |
resource |
Pod |
Minimize the admission of root containers |
Kubernetes |
| 963 |
CKV_K8S_23 |
resource |
ReplicaSet |
Minimize the admission of root containers |
Kubernetes |
| 964 |
CKV_K8S_23 |
resource |
ReplicationController |
Minimize the admission of root containers |
Kubernetes |
| 965 |
CKV_K8S_23 |
resource |
StatefulSet |
Minimize the admission of root containers |
Kubernetes |
| 966 |
CKV_K8S_24 |
resource |
PodSecurityPolicy |
Do not allow containers with added capability |
Kubernetes |
| 967 |
CKV_K8S_25 |
resource |
CronJob |
Minimize the admission of containers with added capability |
Kubernetes |
| 968 |
CKV_K8S_25 |
resource |
DaemonSet |
Minimize the admission of containers with added capability |
Kubernetes |
| 969 |
CKV_K8S_25 |
resource |
Deployment |
Minimize the admission of containers with added capability |
Kubernetes |
| 970 |
CKV_K8S_25 |
resource |
Job |
Minimize the admission of containers with added capability |
Kubernetes |
| 971 |
CKV_K8S_25 |
resource |
Pod |
Minimize the admission of containers with added capability |
Kubernetes |
| 972 |
CKV_K8S_25 |
resource |
PodTemplate |
Minimize the admission of containers with added capability |
Kubernetes |
| 973 |
CKV_K8S_25 |
resource |
ReplicaSet |
Minimize the admission of containers with added capability |
Kubernetes |
| 974 |
CKV_K8S_25 |
resource |
ReplicationController |
Minimize the admission of containers with added capability |
Kubernetes |
| 975 |
CKV_K8S_25 |
resource |
StatefulSet |
Minimize the admission of containers with added capability |
Kubernetes |
| 976 |
CKV_K8S_26 |
resource |
CronJob |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 977 |
CKV_K8S_26 |
resource |
DaemonSet |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 978 |
CKV_K8S_26 |
resource |
Deployment |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 979 |
CKV_K8S_26 |
resource |
Job |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 980 |
CKV_K8S_26 |
resource |
Pod |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 981 |
CKV_K8S_26 |
resource |
PodTemplate |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 982 |
CKV_K8S_26 |
resource |
ReplicaSet |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 983 |
CKV_K8S_26 |
resource |
ReplicationController |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 984 |
CKV_K8S_26 |
resource |
StatefulSet |
Do not specify hostPort unless absolutely necessary |
Kubernetes |
| 985 |
CKV_K8S_27 |
resource |
CronJob |
Do not expose the docker daemon socket to containers |
Kubernetes |
| 986 |
CKV_K8S_27 |
resource |
DaemonSet |
Do not expose the docker daemon socket to containers |
Kubernetes |
| 987 |
CKV_K8S_27 |
resource |
Deployment |
Do not expose the docker daemon socket to containers |
Kubernetes |
| 988 |
CKV_K8S_27 |
resource |
Job |
Do not expose the docker daemon socket to containers |
Kubernetes |
| 989 |
CKV_K8S_27 |
resource |
Pod |
Do not expose the docker daemon socket to containers |
Kubernetes |
| 990 |
CKV_K8S_27 |
resource |
ReplicaSet |
Do not expose the docker daemon socket to containers |
Kubernetes |
| 991 |
CKV_K8S_27 |
resource |
ReplicationController |
Do not expose the docker daemon socket to containers |
Kubernetes |
| 992 |
CKV_K8S_27 |
resource |
StatefulSet |
Do not expose the docker daemon socket to containers |
Kubernetes |
| 993 |
CKV_K8S_28 |
resource |
CronJob |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 994 |
CKV_K8S_28 |
resource |
DaemonSet |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 995 |
CKV_K8S_28 |
resource |
Deployment |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 996 |
CKV_K8S_28 |
resource |
Job |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 997 |
CKV_K8S_28 |
resource |
Pod |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 998 |
CKV_K8S_28 |
resource |
PodTemplate |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 999 |
CKV_K8S_28 |
resource |
ReplicaSet |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 1000 |
CKV_K8S_28 |
resource |
ReplicationController |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 1001 |
CKV_K8S_28 |
resource |
StatefulSet |
Minimize the admission of containers with the NET_RAW capability |
Kubernetes |
| 1002 |
CKV_K8S_29 |
resource |
CronJob |
Apply security context to your pods and containers |
Kubernetes |
| 1003 |
CKV_K8S_29 |
resource |
DaemonSet |
Apply security context to your pods and containers |
Kubernetes |
| 1004 |
CKV_K8S_29 |
resource |
Deployment |
Apply security context to your pods and containers |
Kubernetes |
| 1005 |
CKV_K8S_29 |
resource |
Job |
Apply security context to your pods and containers |
Kubernetes |
| 1006 |
CKV_K8S_29 |
resource |
Pod |
Apply security context to your pods and containers |
Kubernetes |
| 1007 |
CKV_K8S_29 |
resource |
ReplicaSet |
Apply security context to your pods and containers |
Kubernetes |
| 1008 |
CKV_K8S_29 |
resource |
ReplicationController |
Apply security context to your pods and containers |
Kubernetes |
| 1009 |
CKV_K8S_29 |
resource |
StatefulSet |
Apply security context to your pods and containers |
Kubernetes |
| 1010 |
CKV_K8S_30 |
resource |
CronJob |
Apply security context to your pods and containers |
Kubernetes |
| 1011 |
CKV_K8S_30 |
resource |
DaemonSet |
Apply security context to your pods and containers |
Kubernetes |
| 1012 |
CKV_K8S_30 |
resource |
Deployment |
Apply security context to your pods and containers |
Kubernetes |
| 1013 |
CKV_K8S_30 |
resource |
Job |
Apply security context to your pods and containers |
Kubernetes |
| 1014 |
CKV_K8S_30 |
resource |
Pod |
Apply security context to your pods and containers |
Kubernetes |
| 1015 |
CKV_K8S_30 |
resource |
PodTemplate |
Apply security context to your pods and containers |
Kubernetes |
| 1016 |
CKV_K8S_30 |
resource |
ReplicaSet |
Apply security context to your pods and containers |
Kubernetes |
| 1017 |
CKV_K8S_30 |
resource |
ReplicationController |
Apply security context to your pods and containers |
Kubernetes |
| 1018 |
CKV_K8S_30 |
resource |
StatefulSet |
Apply security context to your pods and containers |
Kubernetes |
| 1019 |
CKV_K8S_31 |
resource |
CronJob |
Ensure that the seccomp profile is set to docker/default or runtime/default |
Kubernetes |
| 1020 |
CKV_K8S_31 |
resource |
DaemonSet |
Ensure that the seccomp profile is set to docker/default or runtime/default |
Kubernetes |
| 1021 |
CKV_K8S_31 |
resource |
Deployment |
Ensure that the seccomp profile is set to docker/default or runtime/default |
Kubernetes |
| 1022 |
CKV_K8S_31 |
resource |
Job |
Ensure that the seccomp profile is set to docker/default or runtime/default |
Kubernetes |
| 1023 |
CKV_K8S_31 |
resource |
Pod |
Ensure that the seccomp profile is set to docker/default or runtime/default |
Kubernetes |
| 1024 |
CKV_K8S_31 |
resource |
ReplicaSet |
Ensure that the seccomp profile is set to docker/default or runtime/default |
Kubernetes |
| 1025 |
CKV_K8S_31 |
resource |
ReplicationController |
Ensure that the seccomp profile is set to docker/default or runtime/default |
Kubernetes |
| 1026 |
CKV_K8S_31 |
resource |
StatefulSet |
Ensure that the seccomp profile is set to docker/default or runtime/default |
Kubernetes |
| 1027 |
CKV_K8S_32 |
resource |
PodSecurityPolicy |
Ensure default seccomp profile set to docker/default or runtime/default |
Kubernetes |
| 1028 |
CKV_K8S_33 |
resource |
CronJob |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1029 |
CKV_K8S_33 |
resource |
DaemonSet |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1030 |
CKV_K8S_33 |
resource |
Deployment |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1031 |
CKV_K8S_33 |
resource |
Job |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1032 |
CKV_K8S_33 |
resource |
Pod |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1033 |
CKV_K8S_33 |
resource |
PodTemplate |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1034 |
CKV_K8S_33 |
resource |
ReplicaSet |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1035 |
CKV_K8S_33 |
resource |
ReplicationController |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1036 |
CKV_K8S_33 |
resource |
StatefulSet |
Ensure the Kubernetes dashboard is not deployed |
Kubernetes |
| 1037 |
CKV_K8S_34 |
resource |
CronJob |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1038 |
CKV_K8S_34 |
resource |
DaemonSet |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1039 |
CKV_K8S_34 |
resource |
Deployment |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1040 |
CKV_K8S_34 |
resource |
Job |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1041 |
CKV_K8S_34 |
resource |
Pod |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1042 |
CKV_K8S_34 |
resource |
PodTemplate |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1043 |
CKV_K8S_34 |
resource |
ReplicaSet |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1044 |
CKV_K8S_34 |
resource |
ReplicationController |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1045 |
CKV_K8S_34 |
resource |
StatefulSet |
Ensure that Tiller (Helm v2) is not deployed |
Kubernetes |
| 1046 |
CKV_K8S_35 |
resource |
CronJob |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1047 |
CKV_K8S_35 |
resource |
DaemonSet |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1048 |
CKV_K8S_35 |
resource |
Deployment |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1049 |
CKV_K8S_35 |
resource |
Job |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1050 |
CKV_K8S_35 |
resource |
Pod |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1051 |
CKV_K8S_35 |
resource |
PodTemplate |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1052 |
CKV_K8S_35 |
resource |
ReplicaSet |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1053 |
CKV_K8S_35 |
resource |
ReplicationController |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1054 |
CKV_K8S_35 |
resource |
StatefulSet |
Prefer using secrets as files over secrets as environment variables |
Kubernetes |
| 1055 |
CKV_K8S_36 |
resource |
PodSecurityPolicy |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1056 |
CKV_K8S_37 |
resource |
CronJob |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1057 |
CKV_K8S_37 |
resource |
DaemonSet |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1058 |
CKV_K8S_37 |
resource |
Deployment |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1059 |
CKV_K8S_37 |
resource |
Job |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1060 |
CKV_K8S_37 |
resource |
Pod |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1061 |
CKV_K8S_37 |
resource |
PodTemplate |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1062 |
CKV_K8S_37 |
resource |
ReplicaSet |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1063 |
CKV_K8S_37 |
resource |
ReplicationController |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1064 |
CKV_K8S_37 |
resource |
StatefulSet |
Minimize the admission of containers with capabilities assigned |
Kubernetes |
| 1065 |
CKV_K8S_38 |
resource |
CronJob |
Ensure that Service Account Tokens are only mounted where necessary |
Kubernetes |
| 1066 |
CKV_K8S_38 |
resource |
DaemonSet |
Ensure that Service Account Tokens are only mounted where necessary |
Kubernetes |
| 1067 |
CKV_K8S_38 |
resource |
Deployment |
Ensure that Service Account Tokens are only mounted where necessary |
Kubernetes |
| 1068 |
CKV_K8S_38 |
resource |
Job |
Ensure that Service Account Tokens are only mounted where necessary |
Kubernetes |
| 1069 |
CKV_K8S_38 |
resource |
Pod |
Ensure that Service Account Tokens are only mounted where necessary |
Kubernetes |
| 1070 |
CKV_K8S_38 |
resource |
ReplicaSet |
Ensure that Service Account Tokens are only mounted where necessary |
Kubernetes |
| 1071 |
CKV_K8S_38 |
resource |
ReplicationController |
Ensure that Service Account Tokens are only mounted where necessary |
Kubernetes |
| 1072 |
CKV_K8S_38 |
resource |
StatefulSet |
Ensure that Service Account Tokens are only mounted where necessary |
Kubernetes |
| 1073 |
CKV_K8S_39 |
resource |
CronJob |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1074 |
CKV_K8S_39 |
resource |
DaemonSet |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1075 |
CKV_K8S_39 |
resource |
Deployment |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1076 |
CKV_K8S_39 |
resource |
Job |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1077 |
CKV_K8S_39 |
resource |
Pod |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1078 |
CKV_K8S_39 |
resource |
PodTemplate |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1079 |
CKV_K8S_39 |
resource |
ReplicaSet |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1080 |
CKV_K8S_39 |
resource |
ReplicationController |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1081 |
CKV_K8S_39 |
resource |
StatefulSet |
Do not use the CAP_SYS_ADMIN linux capability |
Kubernetes |
| 1082 |
CKV_K8S_40 |
resource |
CronJob |
Containers should run as a high UID to avoid host conflict |
Kubernetes |
| 1083 |
CKV_K8S_40 |
resource |
DaemonSet |
Containers should run as a high UID to avoid host conflict |
Kubernetes |
| 1084 |
CKV_K8S_40 |
resource |
Deployment |
Containers should run as a high UID to avoid host conflict |
Kubernetes |
| 1085 |
CKV_K8S_40 |
resource |
Job |
Containers should run as a high UID to avoid host conflict |
Kubernetes |
| 1086 |
CKV_K8S_40 |
resource |
Pod |
Containers should run as a high UID to avoid host conflict |
Kubernetes |
| 1087 |
CKV_K8S_40 |
resource |
ReplicaSet |
Containers should run as a high UID to avoid host conflict |
Kubernetes |
| 1088 |
CKV_K8S_40 |
resource |
ReplicationController |
Containers should run as a high UID to avoid host conflict |
Kubernetes |
| 1089 |
CKV_K8S_40 |
resource |
StatefulSet |
Containers should run as a high UID to avoid host conflict |
Kubernetes |
| 1090 |
CKV_K8S_41 |
resource |
ServiceAccount |
Ensure that default service accounts are not actively used |
Kubernetes |
| 1091 |
CKV_K8S_42 |
resource |
ClusterRoleBinding |
Ensure that default service accounts are not actively used |
Kubernetes |
| 1092 |
CKV_K8S_42 |
resource |
RoleBinding |
Ensure that default service accounts are not actively used |
Kubernetes |
| 1093 |
CKV_K8S_43 |
resource |
CronJob |
Image should use digest |
Kubernetes |
| 1094 |
CKV_K8S_43 |
resource |
DaemonSet |
Image should use digest |
Kubernetes |
| 1095 |
CKV_K8S_43 |
resource |
Deployment |
Image should use digest |
Kubernetes |
| 1096 |
CKV_K8S_43 |
resource |
Job |
Image should use digest |
Kubernetes |
| 1097 |
CKV_K8S_43 |
resource |
Pod |
Image should use digest |
Kubernetes |
| 1098 |
CKV_K8S_43 |
resource |
PodTemplate |
Image should use digest |
Kubernetes |
| 1099 |
CKV_K8S_43 |
resource |
ReplicaSet |
Image should use digest |
Kubernetes |
| 1100 |
CKV_K8S_43 |
resource |
ReplicationController |
Image should use digest |
Kubernetes |
| 1101 |
CKV_K8S_43 |
resource |
StatefulSet |
Image should use digest |
Kubernetes |
| 1102 |
CKV_K8S_44 |
resource |
Service |
Ensure that the Tiller Service (Helm v2) is deleted |
Kubernetes |
| 1103 |
CKV_K8S_45 |
resource |
CronJob |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1104 |
CKV_K8S_45 |
resource |
DaemonSet |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1105 |
CKV_K8S_45 |
resource |
Deployment |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1106 |
CKV_K8S_45 |
resource |
Job |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1107 |
CKV_K8S_45 |
resource |
Pod |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1108 |
CKV_K8S_45 |
resource |
PodTemplate |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1109 |
CKV_K8S_45 |
resource |
ReplicaSet |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1110 |
CKV_K8S_45 |
resource |
ReplicationController |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1111 |
CKV_K8S_45 |
resource |
StatefulSet |
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster |
Kubernetes |
| 1112 |
CKV_K8S_49 |
resource |
ClusterRole |
Minimize wildcard use in Roles and ClusterRoles |
Kubernetes |
| 1113 |
CKV_K8S_49 |
resource |
Role |
Minimize wildcard use in Roles and ClusterRoles |
Kubernetes |
| 1114 |
CKV_K8S_68 |
resource |
CronJob |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1115 |
CKV_K8S_68 |
resource |
DaemonSet |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1116 |
CKV_K8S_68 |
resource |
Deployment |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1117 |
CKV_K8S_68 |
resource |
Job |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1118 |
CKV_K8S_68 |
resource |
Pod |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1119 |
CKV_K8S_68 |
resource |
PodTemplate |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1120 |
CKV_K8S_68 |
resource |
ReplicaSet |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1121 |
CKV_K8S_68 |
resource |
ReplicationController |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1122 |
CKV_K8S_68 |
resource |
StatefulSet |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1123 |
CKV_K8S_69 |
resource |
CronJob |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1124 |
CKV_K8S_69 |
resource |
DaemonSet |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1125 |
CKV_K8S_69 |
resource |
Deployment |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1126 |
CKV_K8S_69 |
resource |
Job |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1127 |
CKV_K8S_69 |
resource |
Pod |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1128 |
CKV_K8S_69 |
resource |
PodTemplate |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1129 |
CKV_K8S_69 |
resource |
ReplicaSet |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1130 |
CKV_K8S_69 |
resource |
ReplicationController |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1131 |
CKV_K8S_69 |
resource |
StatefulSet |
Ensure that the –basic-auth-file argument is not set |
Kubernetes |
| 1132 |
CKV_K8S_70 |
resource |
CronJob |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1133 |
CKV_K8S_70 |
resource |
DaemonSet |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1134 |
CKV_K8S_70 |
resource |
Deployment |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1135 |
CKV_K8S_70 |
resource |
Job |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1136 |
CKV_K8S_70 |
resource |
Pod |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1137 |
CKV_K8S_70 |
resource |
PodTemplate |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1138 |
CKV_K8S_70 |
resource |
ReplicaSet |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1139 |
CKV_K8S_70 |
resource |
ReplicationController |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1140 |
CKV_K8S_70 |
resource |
StatefulSet |
Ensure that the –token-auth-file argument is not set |
Kubernetes |
| 1141 |
CKV_K8S_71 |
resource |
CronJob |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1142 |
CKV_K8S_71 |
resource |
DaemonSet |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1143 |
CKV_K8S_71 |
resource |
Deployment |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1144 |
CKV_K8S_71 |
resource |
Job |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1145 |
CKV_K8S_71 |
resource |
Pod |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1146 |
CKV_K8S_71 |
resource |
PodTemplate |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1147 |
CKV_K8S_71 |
resource |
ReplicaSet |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1148 |
CKV_K8S_71 |
resource |
ReplicationController |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1149 |
CKV_K8S_71 |
resource |
StatefulSet |
Ensure that the –kubelet-https argument is set to true |
Kubernetes |
| 1150 |
CKV_K8S_72 |
resource |
CronJob |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1151 |
CKV_K8S_72 |
resource |
DaemonSet |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1152 |
CKV_K8S_72 |
resource |
Deployment |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1153 |
CKV_K8S_72 |
resource |
Job |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1154 |
CKV_K8S_72 |
resource |
Pod |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1155 |
CKV_K8S_72 |
resource |
PodTemplate |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1156 |
CKV_K8S_72 |
resource |
ReplicaSet |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1157 |
CKV_K8S_72 |
resource |
ReplicationController |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1158 |
CKV_K8S_72 |
resource |
StatefulSet |
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate |
Kubernetes |
| 1159 |
CKV_K8S_73 |
resource |
CronJob |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1160 |
CKV_K8S_73 |
resource |
DaemonSet |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1161 |
CKV_K8S_73 |
resource |
Deployment |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1162 |
CKV_K8S_73 |
resource |
Job |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1163 |
CKV_K8S_73 |
resource |
Pod |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1164 |
CKV_K8S_73 |
resource |
PodTemplate |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1165 |
CKV_K8S_73 |
resource |
ReplicaSet |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1166 |
CKV_K8S_73 |
resource |
ReplicationController |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1167 |
CKV_K8S_73 |
resource |
StatefulSet |
Ensure that the –kubelet-certificate-authority argument is set as appropriate |
Kubernetes |
| 1168 |
CKV_K8S_74 |
resource |
CronJob |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1169 |
CKV_K8S_74 |
resource |
DaemonSet |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1170 |
CKV_K8S_74 |
resource |
Deployment |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1171 |
CKV_K8S_74 |
resource |
Job |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1172 |
CKV_K8S_74 |
resource |
Pod |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1173 |
CKV_K8S_74 |
resource |
PodTemplate |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1174 |
CKV_K8S_74 |
resource |
ReplicaSet |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1175 |
CKV_K8S_74 |
resource |
ReplicationController |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1176 |
CKV_K8S_74 |
resource |
StatefulSet |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1177 |
CKV_K8S_75 |
resource |
CronJob |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1178 |
CKV_K8S_75 |
resource |
DaemonSet |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1179 |
CKV_K8S_75 |
resource |
Deployment |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1180 |
CKV_K8S_75 |
resource |
Job |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1181 |
CKV_K8S_75 |
resource |
Pod |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1182 |
CKV_K8S_75 |
resource |
PodTemplate |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1183 |
CKV_K8S_75 |
resource |
ReplicaSet |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1184 |
CKV_K8S_75 |
resource |
ReplicationController |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1185 |
CKV_K8S_75 |
resource |
StatefulSet |
Ensure that the –authorization-mode argument includes Node |
Kubernetes |
| 1186 |
CKV_K8S_77 |
resource |
CronJob |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1187 |
CKV_K8S_77 |
resource |
DaemonSet |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1188 |
CKV_K8S_77 |
resource |
Deployment |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1189 |
CKV_K8S_77 |
resource |
Job |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1190 |
CKV_K8S_77 |
resource |
Pod |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1191 |
CKV_K8S_77 |
resource |
PodTemplate |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1192 |
CKV_K8S_77 |
resource |
ReplicaSet |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1193 |
CKV_K8S_77 |
resource |
ReplicationController |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1194 |
CKV_K8S_77 |
resource |
StatefulSet |
Ensure that the –authorization-mode argument includes RBAC |
Kubernetes |
| 1195 |
CKV_K8S_78 |
resource |
AdmissionConfiguration |
Ensure that the admission control plugin EventRateLimit is set |
Kubernetes |
| 1196 |
CKV_K8S_79 |
resource |
CronJob |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1197 |
CKV_K8S_79 |
resource |
DaemonSet |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1198 |
CKV_K8S_79 |
resource |
Deployment |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1199 |
CKV_K8S_79 |
resource |
Job |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1200 |
CKV_K8S_79 |
resource |
Pod |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1201 |
CKV_K8S_79 |
resource |
PodTemplate |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1202 |
CKV_K8S_79 |
resource |
ReplicaSet |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1203 |
CKV_K8S_79 |
resource |
ReplicationController |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1204 |
CKV_K8S_79 |
resource |
StatefulSet |
Ensure that the admission control plugin AlwaysAdmit is not set |
Kubernetes |
| 1205 |
CKV_K8S_80 |
resource |
CronJob |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1206 |
CKV_K8S_80 |
resource |
DaemonSet |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1207 |
CKV_K8S_80 |
resource |
Deployment |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1208 |
CKV_K8S_80 |
resource |
Job |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1209 |
CKV_K8S_80 |
resource |
Pod |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1210 |
CKV_K8S_80 |
resource |
PodTemplate |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1211 |
CKV_K8S_80 |
resource |
ReplicaSet |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1212 |
CKV_K8S_80 |
resource |
ReplicationController |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1213 |
CKV_K8S_80 |
resource |
StatefulSet |
Ensure that the admission control plugin AlwaysPullImages is set |
Kubernetes |
| 1214 |
CKV_K8S_81 |
resource |
CronJob |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1215 |
CKV_K8S_81 |
resource |
DaemonSet |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1216 |
CKV_K8S_81 |
resource |
Deployment |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1217 |
CKV_K8S_81 |
resource |
Job |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1218 |
CKV_K8S_81 |
resource |
Pod |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1219 |
CKV_K8S_81 |
resource |
PodTemplate |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1220 |
CKV_K8S_81 |
resource |
ReplicaSet |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1221 |
CKV_K8S_81 |
resource |
ReplicationController |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1222 |
CKV_K8S_81 |
resource |
StatefulSet |
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used |
Kubernetes |
| 1223 |
CKV_K8S_82 |
resource |
CronJob |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1224 |
CKV_K8S_82 |
resource |
DaemonSet |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1225 |
CKV_K8S_82 |
resource |
Deployment |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1226 |
CKV_K8S_82 |
resource |
Job |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1227 |
CKV_K8S_82 |
resource |
Pod |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1228 |
CKV_K8S_82 |
resource |
PodTemplate |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1229 |
CKV_K8S_82 |
resource |
ReplicaSet |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1230 |
CKV_K8S_82 |
resource |
ReplicationController |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1231 |
CKV_K8S_82 |
resource |
StatefulSet |
Ensure that the admission control plugin ServiceAccount is set |
Kubernetes |
| 1232 |
CKV_K8S_83 |
resource |
CronJob |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1233 |
CKV_K8S_83 |
resource |
DaemonSet |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1234 |
CKV_K8S_83 |
resource |
Deployment |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1235 |
CKV_K8S_83 |
resource |
Job |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1236 |
CKV_K8S_83 |
resource |
Pod |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1237 |
CKV_K8S_83 |
resource |
PodTemplate |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1238 |
CKV_K8S_83 |
resource |
ReplicaSet |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1239 |
CKV_K8S_83 |
resource |
ReplicationController |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1240 |
CKV_K8S_83 |
resource |
StatefulSet |
Ensure that the admission control plugin NamespaceLifecycle is set |
Kubernetes |
| 1241 |
CKV_K8S_84 |
resource |
CronJob |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1242 |
CKV_K8S_84 |
resource |
DaemonSet |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1243 |
CKV_K8S_84 |
resource |
Deployment |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1244 |
CKV_K8S_84 |
resource |
Job |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1245 |
CKV_K8S_84 |
resource |
Pod |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1246 |
CKV_K8S_84 |
resource |
PodTemplate |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1247 |
CKV_K8S_84 |
resource |
ReplicaSet |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1248 |
CKV_K8S_84 |
resource |
ReplicationController |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1249 |
CKV_K8S_84 |
resource |
StatefulSet |
Ensure that the admission control plugin PodSecurityPolicy is set |
Kubernetes |
| 1250 |
CKV_K8S_85 |
resource |
CronJob |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1251 |
CKV_K8S_85 |
resource |
DaemonSet |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1252 |
CKV_K8S_85 |
resource |
Deployment |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1253 |
CKV_K8S_85 |
resource |
Job |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1254 |
CKV_K8S_85 |
resource |
Pod |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1255 |
CKV_K8S_85 |
resource |
PodTemplate |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1256 |
CKV_K8S_85 |
resource |
ReplicaSet |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1257 |
CKV_K8S_85 |
resource |
ReplicationController |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1258 |
CKV_K8S_85 |
resource |
StatefulSet |
Ensure that the admission control plugin NodeRestriction is set |
Kubernetes |
| 1259 |
CKV_K8S_86 |
resource |
CronJob |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1260 |
CKV_K8S_86 |
resource |
DaemonSet |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1261 |
CKV_K8S_86 |
resource |
Deployment |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1262 |
CKV_K8S_86 |
resource |
Job |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1263 |
CKV_K8S_86 |
resource |
Pod |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1264 |
CKV_K8S_86 |
resource |
PodTemplate |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1265 |
CKV_K8S_86 |
resource |
ReplicaSet |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1266 |
CKV_K8S_86 |
resource |
ReplicationController |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1267 |
CKV_K8S_86 |
resource |
StatefulSet |
Ensure that the –insecure-bind-address argument is not set |
Kubernetes |
| 1268 |
CKV_K8S_88 |
resource |
CronJob |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1269 |
CKV_K8S_88 |
resource |
DaemonSet |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1270 |
CKV_K8S_88 |
resource |
Deployment |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1271 |
CKV_K8S_88 |
resource |
Job |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1272 |
CKV_K8S_88 |
resource |
Pod |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1273 |
CKV_K8S_88 |
resource |
PodTemplate |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1274 |
CKV_K8S_88 |
resource |
ReplicaSet |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1275 |
CKV_K8S_88 |
resource |
ReplicationController |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1276 |
CKV_K8S_88 |
resource |
StatefulSet |
Ensure that the –insecure-port argument is set to 0 |
Kubernetes |
| 1277 |
CKV_K8S_89 |
resource |
CronJob |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1278 |
CKV_K8S_89 |
resource |
DaemonSet |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1279 |
CKV_K8S_89 |
resource |
Deployment |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1280 |
CKV_K8S_89 |
resource |
Job |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1281 |
CKV_K8S_89 |
resource |
Pod |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1282 |
CKV_K8S_89 |
resource |
PodTemplate |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1283 |
CKV_K8S_89 |
resource |
ReplicaSet |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1284 |
CKV_K8S_89 |
resource |
ReplicationController |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1285 |
CKV_K8S_89 |
resource |
StatefulSet |
Ensure that the –secure-port argument is not set to 0 |
Kubernetes |
| 1286 |
CKV_K8S_90 |
resource |
CronJob |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1287 |
CKV_K8S_90 |
resource |
DaemonSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1288 |
CKV_K8S_90 |
resource |
Deployment |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1289 |
CKV_K8S_90 |
resource |
Job |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1290 |
CKV_K8S_90 |
resource |
Pod |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1291 |
CKV_K8S_90 |
resource |
PodTemplate |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1292 |
CKV_K8S_90 |
resource |
ReplicaSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1293 |
CKV_K8S_90 |
resource |
ReplicationController |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1294 |
CKV_K8S_90 |
resource |
StatefulSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1295 |
CKV_K8S_91 |
resource |
CronJob |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1296 |
CKV_K8S_91 |
resource |
DaemonSet |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1297 |
CKV_K8S_91 |
resource |
Deployment |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1298 |
CKV_K8S_91 |
resource |
Job |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1299 |
CKV_K8S_91 |
resource |
Pod |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1300 |
CKV_K8S_91 |
resource |
PodTemplate |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1301 |
CKV_K8S_91 |
resource |
ReplicaSet |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1302 |
CKV_K8S_91 |
resource |
ReplicationController |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1303 |
CKV_K8S_91 |
resource |
StatefulSet |
Ensure that the –audit-log-path argument is set |
Kubernetes |
| 1304 |
CKV_K8S_92 |
resource |
CronJob |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1305 |
CKV_K8S_92 |
resource |
DaemonSet |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1306 |
CKV_K8S_92 |
resource |
Deployment |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1307 |
CKV_K8S_92 |
resource |
Job |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1308 |
CKV_K8S_92 |
resource |
Pod |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1309 |
CKV_K8S_92 |
resource |
PodTemplate |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1310 |
CKV_K8S_92 |
resource |
ReplicaSet |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1311 |
CKV_K8S_92 |
resource |
ReplicationController |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1312 |
CKV_K8S_92 |
resource |
StatefulSet |
Ensure that the –audit-log-maxage argument is set to 30 or as appropriate |
Kubernetes |
| 1313 |
CKV_K8S_93 |
resource |
CronJob |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1314 |
CKV_K8S_93 |
resource |
DaemonSet |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1315 |
CKV_K8S_93 |
resource |
Deployment |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1316 |
CKV_K8S_93 |
resource |
Job |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1317 |
CKV_K8S_93 |
resource |
Pod |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1318 |
CKV_K8S_93 |
resource |
PodTemplate |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1319 |
CKV_K8S_93 |
resource |
ReplicaSet |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1320 |
CKV_K8S_93 |
resource |
ReplicationController |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1321 |
CKV_K8S_93 |
resource |
StatefulSet |
Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate |
Kubernetes |
| 1322 |
CKV_K8S_94 |
resource |
CronJob |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1323 |
CKV_K8S_94 |
resource |
DaemonSet |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1324 |
CKV_K8S_94 |
resource |
Deployment |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1325 |
CKV_K8S_94 |
resource |
Job |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1326 |
CKV_K8S_94 |
resource |
Pod |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1327 |
CKV_K8S_94 |
resource |
PodTemplate |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1328 |
CKV_K8S_94 |
resource |
ReplicaSet |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1329 |
CKV_K8S_94 |
resource |
ReplicationController |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1330 |
CKV_K8S_94 |
resource |
StatefulSet |
Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate |
Kubernetes |
| 1331 |
CKV_K8S_95 |
resource |
CronJob |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1332 |
CKV_K8S_95 |
resource |
DaemonSet |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1333 |
CKV_K8S_95 |
resource |
Deployment |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1334 |
CKV_K8S_95 |
resource |
Job |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1335 |
CKV_K8S_95 |
resource |
Pod |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1336 |
CKV_K8S_95 |
resource |
PodTemplate |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1337 |
CKV_K8S_95 |
resource |
ReplicaSet |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1338 |
CKV_K8S_95 |
resource |
ReplicationController |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1339 |
CKV_K8S_95 |
resource |
StatefulSet |
Ensure that the –request-timeout argument is set as appropriate |
Kubernetes |
| 1340 |
CKV_K8S_96 |
resource |
CronJob |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1341 |
CKV_K8S_96 |
resource |
DaemonSet |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1342 |
CKV_K8S_96 |
resource |
Deployment |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1343 |
CKV_K8S_96 |
resource |
Job |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1344 |
CKV_K8S_96 |
resource |
Pod |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1345 |
CKV_K8S_96 |
resource |
PodTemplate |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1346 |
CKV_K8S_96 |
resource |
ReplicaSet |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1347 |
CKV_K8S_96 |
resource |
ReplicationController |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1348 |
CKV_K8S_96 |
resource |
StatefulSet |
Ensure that the –service-account-lookup argument is set to true |
Kubernetes |
| 1349 |
CKV_K8S_97 |
resource |
CronJob |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1350 |
CKV_K8S_97 |
resource |
DaemonSet |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1351 |
CKV_K8S_97 |
resource |
Deployment |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1352 |
CKV_K8S_97 |
resource |
Job |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1353 |
CKV_K8S_97 |
resource |
Pod |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1354 |
CKV_K8S_97 |
resource |
PodTemplate |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1355 |
CKV_K8S_97 |
resource |
ReplicaSet |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1356 |
CKV_K8S_97 |
resource |
ReplicationController |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1357 |
CKV_K8S_97 |
resource |
StatefulSet |
Ensure that the –service-account-key-file argument is set as appropriate |
Kubernetes |
| 1358 |
CKV_K8S_99 |
resource |
CronJob |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1359 |
CKV_K8S_99 |
resource |
DaemonSet |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1360 |
CKV_K8S_99 |
resource |
Deployment |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1361 |
CKV_K8S_99 |
resource |
Job |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1362 |
CKV_K8S_99 |
resource |
Pod |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1363 |
CKV_K8S_99 |
resource |
PodTemplate |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1364 |
CKV_K8S_99 |
resource |
ReplicaSet |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1365 |
CKV_K8S_99 |
resource |
ReplicationController |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1366 |
CKV_K8S_99 |
resource |
StatefulSet |
Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate |
Kubernetes |
| 1367 |
CKV_K8S_100 |
resource |
CronJob |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1368 |
CKV_K8S_100 |
resource |
DaemonSet |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1369 |
CKV_K8S_100 |
resource |
Deployment |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1370 |
CKV_K8S_100 |
resource |
Job |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1371 |
CKV_K8S_100 |
resource |
Pod |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1372 |
CKV_K8S_100 |
resource |
PodTemplate |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1373 |
CKV_K8S_100 |
resource |
ReplicaSet |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1374 |
CKV_K8S_100 |
resource |
ReplicationController |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1375 |
CKV_K8S_100 |
resource |
StatefulSet |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1376 |
CKV_K8S_102 |
resource |
CronJob |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1377 |
CKV_K8S_102 |
resource |
DaemonSet |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1378 |
CKV_K8S_102 |
resource |
Deployment |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1379 |
CKV_K8S_102 |
resource |
Job |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1380 |
CKV_K8S_102 |
resource |
Pod |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1381 |
CKV_K8S_102 |
resource |
PodTemplate |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1382 |
CKV_K8S_102 |
resource |
ReplicaSet |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1383 |
CKV_K8S_102 |
resource |
ReplicationController |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1384 |
CKV_K8S_102 |
resource |
StatefulSet |
Ensure that the –etcd-ca-file argument is set as appropriate |
Kubernetes |
| 1385 |
CKV_K8S_104 |
resource |
CronJob |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1386 |
CKV_K8S_104 |
resource |
DaemonSet |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1387 |
CKV_K8S_104 |
resource |
Deployment |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1388 |
CKV_K8S_104 |
resource |
Job |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1389 |
CKV_K8S_104 |
resource |
Pod |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1390 |
CKV_K8S_104 |
resource |
PodTemplate |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1391 |
CKV_K8S_104 |
resource |
ReplicaSet |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1392 |
CKV_K8S_104 |
resource |
ReplicationController |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1393 |
CKV_K8S_104 |
resource |
StatefulSet |
Ensure that encryption providers are appropriately configured |
Kubernetes |
| 1394 |
CKV_K8S_105 |
resource |
CronJob |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1395 |
CKV_K8S_105 |
resource |
DaemonSet |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1396 |
CKV_K8S_105 |
resource |
Deployment |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1397 |
CKV_K8S_105 |
resource |
Job |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1398 |
CKV_K8S_105 |
resource |
Pod |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1399 |
CKV_K8S_105 |
resource |
PodTemplate |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1400 |
CKV_K8S_105 |
resource |
ReplicaSet |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1401 |
CKV_K8S_105 |
resource |
ReplicationController |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1402 |
CKV_K8S_105 |
resource |
StatefulSet |
Ensure that the API Server only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1403 |
CKV_K8S_106 |
resource |
CronJob |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1404 |
CKV_K8S_106 |
resource |
DaemonSet |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1405 |
CKV_K8S_106 |
resource |
Deployment |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1406 |
CKV_K8S_106 |
resource |
Job |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1407 |
CKV_K8S_106 |
resource |
Pod |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1408 |
CKV_K8S_106 |
resource |
PodTemplate |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1409 |
CKV_K8S_106 |
resource |
ReplicaSet |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1410 |
CKV_K8S_106 |
resource |
ReplicationController |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1411 |
CKV_K8S_106 |
resource |
StatefulSet |
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate |
Kubernetes |
| 1412 |
CKV_K8S_107 |
resource |
CronJob |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1413 |
CKV_K8S_107 |
resource |
DaemonSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1414 |
CKV_K8S_107 |
resource |
Deployment |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1415 |
CKV_K8S_107 |
resource |
Job |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1416 |
CKV_K8S_107 |
resource |
Pod |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1417 |
CKV_K8S_107 |
resource |
PodTemplate |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1418 |
CKV_K8S_107 |
resource |
ReplicaSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1419 |
CKV_K8S_107 |
resource |
ReplicationController |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1420 |
CKV_K8S_107 |
resource |
StatefulSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1421 |
CKV_K8S_108 |
resource |
CronJob |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1422 |
CKV_K8S_108 |
resource |
DaemonSet |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1423 |
CKV_K8S_108 |
resource |
Deployment |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1424 |
CKV_K8S_108 |
resource |
Job |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1425 |
CKV_K8S_108 |
resource |
Pod |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1426 |
CKV_K8S_108 |
resource |
PodTemplate |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1427 |
CKV_K8S_108 |
resource |
ReplicaSet |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1428 |
CKV_K8S_108 |
resource |
ReplicationController |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1429 |
CKV_K8S_108 |
resource |
StatefulSet |
Ensure that the –use-service-account-credentials argument is set to true |
Kubernetes |
| 1430 |
CKV_K8S_110 |
resource |
CronJob |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1431 |
CKV_K8S_110 |
resource |
DaemonSet |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1432 |
CKV_K8S_110 |
resource |
Deployment |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1433 |
CKV_K8S_110 |
resource |
Job |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1434 |
CKV_K8S_110 |
resource |
Pod |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1435 |
CKV_K8S_110 |
resource |
PodTemplate |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1436 |
CKV_K8S_110 |
resource |
ReplicaSet |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1437 |
CKV_K8S_110 |
resource |
ReplicationController |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1438 |
CKV_K8S_110 |
resource |
StatefulSet |
Ensure that the –service-account-private-key-file argument is set as appropriate |
Kubernetes |
| 1439 |
CKV_K8S_111 |
resource |
CronJob |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1440 |
CKV_K8S_111 |
resource |
DaemonSet |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1441 |
CKV_K8S_111 |
resource |
Deployment |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1442 |
CKV_K8S_111 |
resource |
Job |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1443 |
CKV_K8S_111 |
resource |
Pod |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1444 |
CKV_K8S_111 |
resource |
PodTemplate |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1445 |
CKV_K8S_111 |
resource |
ReplicaSet |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1446 |
CKV_K8S_111 |
resource |
ReplicationController |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1447 |
CKV_K8S_111 |
resource |
StatefulSet |
Ensure that the –root-ca-file argument is set as appropriate |
Kubernetes |
| 1448 |
CKV_K8S_112 |
resource |
CronJob |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1449 |
CKV_K8S_112 |
resource |
DaemonSet |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1450 |
CKV_K8S_112 |
resource |
Deployment |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1451 |
CKV_K8S_112 |
resource |
Job |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1452 |
CKV_K8S_112 |
resource |
Pod |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1453 |
CKV_K8S_112 |
resource |
PodTemplate |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1454 |
CKV_K8S_112 |
resource |
ReplicaSet |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1455 |
CKV_K8S_112 |
resource |
ReplicationController |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1456 |
CKV_K8S_112 |
resource |
StatefulSet |
Ensure that the RotateKubeletServerCertificate argument is set to true |
Kubernetes |
| 1457 |
CKV_K8S_113 |
resource |
CronJob |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1458 |
CKV_K8S_113 |
resource |
DaemonSet |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1459 |
CKV_K8S_113 |
resource |
Deployment |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1460 |
CKV_K8S_113 |
resource |
Job |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1461 |
CKV_K8S_113 |
resource |
Pod |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1462 |
CKV_K8S_113 |
resource |
PodTemplate |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1463 |
CKV_K8S_113 |
resource |
ReplicaSet |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1464 |
CKV_K8S_113 |
resource |
ReplicationController |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1465 |
CKV_K8S_113 |
resource |
StatefulSet |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1466 |
CKV_K8S_114 |
resource |
CronJob |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1467 |
CKV_K8S_114 |
resource |
DaemonSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1468 |
CKV_K8S_114 |
resource |
Deployment |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1469 |
CKV_K8S_114 |
resource |
Job |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1470 |
CKV_K8S_114 |
resource |
Pod |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1471 |
CKV_K8S_114 |
resource |
PodTemplate |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1472 |
CKV_K8S_114 |
resource |
ReplicaSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1473 |
CKV_K8S_114 |
resource |
ReplicationController |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1474 |
CKV_K8S_114 |
resource |
StatefulSet |
Ensure that the –profiling argument is set to false |
Kubernetes |
| 1475 |
CKV_K8S_115 |
resource |
CronJob |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1476 |
CKV_K8S_115 |
resource |
DaemonSet |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1477 |
CKV_K8S_115 |
resource |
Deployment |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1478 |
CKV_K8S_115 |
resource |
Job |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1479 |
CKV_K8S_115 |
resource |
Pod |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1480 |
CKV_K8S_115 |
resource |
PodTemplate |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1481 |
CKV_K8S_115 |
resource |
ReplicaSet |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1482 |
CKV_K8S_115 |
resource |
ReplicationController |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1483 |
CKV_K8S_115 |
resource |
StatefulSet |
Ensure that the –bind-address argument is set to 127.0.0.1 |
Kubernetes |
| 1484 |
CKV_K8S_116 |
resource |
CronJob |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1485 |
CKV_K8S_116 |
resource |
DaemonSet |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1486 |
CKV_K8S_116 |
resource |
Deployment |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1487 |
CKV_K8S_116 |
resource |
Job |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1488 |
CKV_K8S_116 |
resource |
Pod |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1489 |
CKV_K8S_116 |
resource |
PodTemplate |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1490 |
CKV_K8S_116 |
resource |
ReplicaSet |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1491 |
CKV_K8S_116 |
resource |
ReplicationController |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1492 |
CKV_K8S_116 |
resource |
StatefulSet |
Ensure that the –cert-file and –key-file arguments are set as appropriate |
Kubernetes |
| 1493 |
CKV_K8S_117 |
resource |
CronJob |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1494 |
CKV_K8S_117 |
resource |
DaemonSet |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1495 |
CKV_K8S_117 |
resource |
Deployment |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1496 |
CKV_K8S_117 |
resource |
Job |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1497 |
CKV_K8S_117 |
resource |
Pod |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1498 |
CKV_K8S_117 |
resource |
PodTemplate |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1499 |
CKV_K8S_117 |
resource |
ReplicaSet |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1500 |
CKV_K8S_117 |
resource |
ReplicationController |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1501 |
CKV_K8S_117 |
resource |
StatefulSet |
Ensure that the –client-cert-auth argument is set to true |
Kubernetes |
| 1502 |
CKV_K8S_118 |
resource |
CronJob |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1503 |
CKV_K8S_118 |
resource |
DaemonSet |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1504 |
CKV_K8S_118 |
resource |
Deployment |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1505 |
CKV_K8S_118 |
resource |
Job |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1506 |
CKV_K8S_118 |
resource |
Pod |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1507 |
CKV_K8S_118 |
resource |
PodTemplate |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1508 |
CKV_K8S_118 |
resource |
ReplicaSet |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1509 |
CKV_K8S_118 |
resource |
ReplicationController |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1510 |
CKV_K8S_118 |
resource |
StatefulSet |
Ensure that the –auto-tls argument is not set to true |
Kubernetes |
| 1511 |
CKV_K8S_119 |
resource |
CronJob |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1512 |
CKV_K8S_119 |
resource |
DaemonSet |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1513 |
CKV_K8S_119 |
resource |
Deployment |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1514 |
CKV_K8S_119 |
resource |
Job |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1515 |
CKV_K8S_119 |
resource |
Pod |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1516 |
CKV_K8S_119 |
resource |
PodTemplate |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1517 |
CKV_K8S_119 |
resource |
ReplicaSet |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1518 |
CKV_K8S_119 |
resource |
ReplicationController |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1519 |
CKV_K8S_119 |
resource |
StatefulSet |
Ensure that the –peer-cert-file and –peer-key-file arguments are set as appropriate |
Kubernetes |
| 1520 |
CKV_K8S_121 |
resource |
Pod |
Ensure that the –peer-client-cert-auth argument is set to true |
Kubernetes |
| 1521 |
CKV_K8S_138 |
resource |
CronJob |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1522 |
CKV_K8S_138 |
resource |
DaemonSet |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1523 |
CKV_K8S_138 |
resource |
Deployment |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1524 |
CKV_K8S_138 |
resource |
Job |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1525 |
CKV_K8S_138 |
resource |
Pod |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1526 |
CKV_K8S_138 |
resource |
PodTemplate |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1527 |
CKV_K8S_138 |
resource |
ReplicaSet |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1528 |
CKV_K8S_138 |
resource |
ReplicationController |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1529 |
CKV_K8S_138 |
resource |
StatefulSet |
Ensure that the –anonymous-auth argument is set to false |
Kubernetes |
| 1530 |
CKV_K8S_139 |
resource |
CronJob |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1531 |
CKV_K8S_139 |
resource |
DaemonSet |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1532 |
CKV_K8S_139 |
resource |
Deployment |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1533 |
CKV_K8S_139 |
resource |
Job |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1534 |
CKV_K8S_139 |
resource |
Pod |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1535 |
CKV_K8S_139 |
resource |
PodTemplate |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1536 |
CKV_K8S_139 |
resource |
ReplicaSet |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1537 |
CKV_K8S_139 |
resource |
ReplicationController |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1538 |
CKV_K8S_139 |
resource |
StatefulSet |
Ensure that the –authorization-mode argument is not set to AlwaysAllow |
Kubernetes |
| 1539 |
CKV_K8S_140 |
resource |
CronJob |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1540 |
CKV_K8S_140 |
resource |
DaemonSet |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1541 |
CKV_K8S_140 |
resource |
Deployment |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1542 |
CKV_K8S_140 |
resource |
Job |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1543 |
CKV_K8S_140 |
resource |
Pod |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1544 |
CKV_K8S_140 |
resource |
PodTemplate |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1545 |
CKV_K8S_140 |
resource |
ReplicaSet |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1546 |
CKV_K8S_140 |
resource |
ReplicationController |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1547 |
CKV_K8S_140 |
resource |
StatefulSet |
Ensure that the –client-ca-file argument is set as appropriate |
Kubernetes |
| 1548 |
CKV_K8S_141 |
resource |
CronJob |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1549 |
CKV_K8S_141 |
resource |
DaemonSet |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1550 |
CKV_K8S_141 |
resource |
Deployment |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1551 |
CKV_K8S_141 |
resource |
Job |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1552 |
CKV_K8S_141 |
resource |
Pod |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1553 |
CKV_K8S_141 |
resource |
PodTemplate |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1554 |
CKV_K8S_141 |
resource |
ReplicaSet |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1555 |
CKV_K8S_141 |
resource |
ReplicationController |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1556 |
CKV_K8S_141 |
resource |
StatefulSet |
Ensure that the –read-only-port argument is set to 0 |
Kubernetes |
| 1557 |
CKV_K8S_143 |
resource |
CronJob |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1558 |
CKV_K8S_143 |
resource |
DaemonSet |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1559 |
CKV_K8S_143 |
resource |
Deployment |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1560 |
CKV_K8S_143 |
resource |
Job |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1561 |
CKV_K8S_143 |
resource |
Pod |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1562 |
CKV_K8S_143 |
resource |
PodTemplate |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1563 |
CKV_K8S_143 |
resource |
ReplicaSet |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1564 |
CKV_K8S_143 |
resource |
ReplicationController |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1565 |
CKV_K8S_143 |
resource |
StatefulSet |
Ensure that the –streaming-connection-idle-timeout argument is not set to 0 |
Kubernetes |
| 1566 |
CKV_K8S_144 |
resource |
CronJob |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1567 |
CKV_K8S_144 |
resource |
DaemonSet |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1568 |
CKV_K8S_144 |
resource |
Deployment |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1569 |
CKV_K8S_144 |
resource |
Job |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1570 |
CKV_K8S_144 |
resource |
Pod |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1571 |
CKV_K8S_144 |
resource |
PodTemplate |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1572 |
CKV_K8S_144 |
resource |
ReplicaSet |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1573 |
CKV_K8S_144 |
resource |
ReplicationController |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1574 |
CKV_K8S_144 |
resource |
StatefulSet |
Ensure that the –protect-kernel-defaults argument is set to true |
Kubernetes |
| 1575 |
CKV_K8S_145 |
resource |
CronJob |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1576 |
CKV_K8S_145 |
resource |
DaemonSet |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1577 |
CKV_K8S_145 |
resource |
Deployment |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1578 |
CKV_K8S_145 |
resource |
Job |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1579 |
CKV_K8S_145 |
resource |
Pod |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1580 |
CKV_K8S_145 |
resource |
PodTemplate |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1581 |
CKV_K8S_145 |
resource |
ReplicaSet |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1582 |
CKV_K8S_145 |
resource |
ReplicationController |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1583 |
CKV_K8S_145 |
resource |
StatefulSet |
Ensure that the –make-iptables-util-chains argument is set to true |
Kubernetes |
| 1584 |
CKV_K8S_146 |
resource |
CronJob |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1585 |
CKV_K8S_146 |
resource |
DaemonSet |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1586 |
CKV_K8S_146 |
resource |
Deployment |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1587 |
CKV_K8S_146 |
resource |
Job |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1588 |
CKV_K8S_146 |
resource |
Pod |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1589 |
CKV_K8S_146 |
resource |
PodTemplate |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1590 |
CKV_K8S_146 |
resource |
ReplicaSet |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1591 |
CKV_K8S_146 |
resource |
ReplicationController |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1592 |
CKV_K8S_146 |
resource |
StatefulSet |
Ensure that the –hostname-override argument is not set |
Kubernetes |
| 1593 |
CKV_K8S_147 |
resource |
CronJob |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1594 |
CKV_K8S_147 |
resource |
DaemonSet |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1595 |
CKV_K8S_147 |
resource |
Deployment |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1596 |
CKV_K8S_147 |
resource |
Job |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1597 |
CKV_K8S_147 |
resource |
Pod |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1598 |
CKV_K8S_147 |
resource |
PodTemplate |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1599 |
CKV_K8S_147 |
resource |
ReplicaSet |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1600 |
CKV_K8S_147 |
resource |
ReplicationController |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1601 |
CKV_K8S_147 |
resource |
StatefulSet |
Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture |
Kubernetes |
| 1602 |
CKV_K8S_148 |
resource |
CronJob |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1603 |
CKV_K8S_148 |
resource |
DaemonSet |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1604 |
CKV_K8S_148 |
resource |
Deployment |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1605 |
CKV_K8S_148 |
resource |
Job |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1606 |
CKV_K8S_148 |
resource |
Pod |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1607 |
CKV_K8S_148 |
resource |
PodTemplate |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1608 |
CKV_K8S_148 |
resource |
ReplicaSet |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1609 |
CKV_K8S_148 |
resource |
ReplicationController |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1610 |
CKV_K8S_148 |
resource |
StatefulSet |
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate |
Kubernetes |
| 1611 |
CKV_K8S_149 |
resource |
CronJob |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1612 |
CKV_K8S_149 |
resource |
DaemonSet |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1613 |
CKV_K8S_149 |
resource |
Deployment |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1614 |
CKV_K8S_149 |
resource |
Job |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1615 |
CKV_K8S_149 |
resource |
Pod |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1616 |
CKV_K8S_149 |
resource |
PodTemplate |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1617 |
CKV_K8S_149 |
resource |
ReplicaSet |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1618 |
CKV_K8S_149 |
resource |
ReplicationController |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1619 |
CKV_K8S_149 |
resource |
StatefulSet |
Ensure that the –rotate-certificates argument is not set to false |
Kubernetes |
| 1620 |
CKV_K8S_151 |
resource |
CronJob |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1621 |
CKV_K8S_151 |
resource |
DaemonSet |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1622 |
CKV_K8S_151 |
resource |
Deployment |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1623 |
CKV_K8S_151 |
resource |
Job |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1624 |
CKV_K8S_151 |
resource |
Pod |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1625 |
CKV_K8S_151 |
resource |
PodTemplate |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1626 |
CKV_K8S_151 |
resource |
ReplicaSet |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1627 |
CKV_K8S_151 |
resource |
ReplicationController |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1628 |
CKV_K8S_151 |
resource |
StatefulSet |
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers |
Kubernetes |
| 1629 |
CKV_K8S_152 |
resource |
Ingress |
Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742 |
Kubernetes |
| 1630 |
CKV_K8S_153 |
resource |
Ingress |
Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742 |
Kubernetes |
| 1631 |
CKV_K8S_154 |
resource |
Ingress |
Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742 |
Kubernetes |
| 1632 |
CKV_LIN_1 |
provider |
linode |
Ensure no hard coded Linode tokens exist in provider |
Terraform |
| 1633 |
CKV_LIN_2 |
resource |
linode_instance |
Ensure SSH key set in authorized_keys |
Terraform |
| 1634 |
CKV_LIN_3 |
resource |
linode_user |
Ensure email is set |
Terraform |
| 1635 |
CKV_LIN_4 |
resource |
linode_user |
Ensure username is set |
Terraform |
| 1636 |
CKV_LIN_5 |
resource |
linode_firewall |
Ensure Inbound Firewall Policy is not set to ACCEPT |
Terraform |
| 1637 |
CKV_LIN_6 |
resource |
linode_firewall |
Ensure Outbound Firewall Policy is not set to ACCEPT |
Terraform |
| 1638 |
CKV_OCI_1 |
provider |
oci |
Ensure no hard coded OCI private key in provider |
Terraform |
| 1639 |
CKV_OCI_2 |
resource |
oci_core_volume |
Ensure OCI Block Storage Block Volume has backup enabled |
Terraform |
| 1640 |
CKV_OCI_3 |
resource |
oci_core_volume |
OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) |
Terraform |
| 1641 |
CKV_OCI_4 |
resource |
oci_core_instance |
Ensure OCI Compute Instance boot volume has in-transit data encryption enabled |
Terraform |
| 1642 |
CKV_OCI_5 |
resource |
oci_core_instance |
Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled |
Terraform |
| 1643 |
CKV_OCI_6 |
resource |
oci_core_instance |
Ensure OCI Compute Instance has monitoring enabled |
Terraform |
| 1644 |
CKV_OCI_7 |
resource |
oci_objectstorage_bucket |
Ensure OCI Object Storage bucket can emit object events |
Terraform |
| 1645 |
CKV_OCI_8 |
resource |
oci_objectstorage_bucket |
Ensure OCI Object Storage has versioning enabled |
Terraform |
| 1646 |
CKV_OCI_9 |
resource |
oci_objectstorage_bucket |
Ensure OCI Object Storage is encrypted with Customer Managed Key |
Terraform |
| 1647 |
CKV_OCI_10 |
resource |
oci_objectstorage_bucket |
Ensure OCI Object Storage is not Public |
Terraform |
| 1648 |
CKV_OCI_11 |
resource |
oci_identity_authentication_policy |
OCI IAM password policy - must contain lower case |
Terraform |
| 1649 |
CKV_OCI_12 |
resource |
oci_identity_authentication_policy |
OCI IAM password policy - must contain Numeric characters |
Terraform |
| 1650 |
CKV_OCI_13 |
resource |
oci_identity_authentication_policy |
OCI IAM password policy - must contain Special characters |
Terraform |
| 1651 |
CKV_OCI_14 |
resource |
oci_identity_authentication_policy |
OCI IAM password policy - must contain Uppercase characters |
Terraform |
| 1652 |
CKV_OCI_15 |
resource |
oci_file_storage_file_system |
Ensure OCI File System is Encrypted with a customer Managed Key |
Terraform |
| 1653 |
CKV_OCI_16 |
resource |
oci_core_security_list |
Ensure VCN has an inbound security list |
Terraform |
| 1654 |
CKV_OCI_17 |
resource |
oci_core_security_list |
Ensure VCN inbound security lists are stateless |
Terraform |
| 1655 |
CKV_OCI_18 |
resource |
oci_identity_authentication_policy |
OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters |
Terraform |
| 1656 |
CKV_OPENSTACK_1 |
provider |
openstack |
Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider |
Terraform |
| 1657 |
CKV_OPENSTACK_2 |
resource |
openstack_compute_secgroup_v2 |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) |
Terraform |
| 1658 |
CKV_OPENSTACK_2 |
resource |
openstack_networking_secgroup_rule_v2 |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) |
Terraform |
| 1659 |
CKV_OPENSTACK_3 |
resource |
openstack_compute_secgroup_v2 |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) |
Terraform |
| 1660 |
CKV_OPENSTACK_3 |
resource |
openstack_networking_secgroup_rule_v2 |
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) |
Terraform |
| 1661 |
CKV_OPENSTACK_4 |
resource |
openstack_compute_instance_v2 |
Ensure that instance does not use basic credentials |
Terraform |
| 1662 |
CKV_OPENSTACK_5 |
resource |
openstack_fw_rule_v1 |
Ensure firewall rule set a destination IP |
Terraform |
| 1663 |
CKV_PAN_1 |
provider |
panos |
Ensure no hard coded PAN-OS credentials exist in provider |
Terraform |
| 1664 |
CKV_SECRET_1 |
Artifactory Credentials |
secrets |
Artifactory Credentials |
secrets |
| 1665 |
CKV_SECRET_2 |
AWS Access Key |
secrets |
AWS Access Key |
secrets |
| 1666 |
CKV_SECRET_3 |
Azure Storage Account access key |
secrets |
Azure Storage Account access key |
secrets |
| 1667 |
CKV_SECRET_4 |
Basic Auth Credentials |
secrets |
Basic Auth Credentials |
secrets |
| 1668 |
CKV_SECRET_5 |
Cloudant Credentials |
secrets |
Cloudant Credentials |
secrets |
| 1669 |
CKV_SECRET_6 |
Base64 High Entropy String |
secrets |
Base64 High Entropy String |
secrets |
| 1670 |
CKV_SECRET_7 |
IBM Cloud IAM Key |
secrets |
IBM Cloud IAM Key |
secrets |
| 1671 |
CKV_SECRET_8 |
IBM COS HMAC Credentials |
secrets |
IBM COS HMAC Credentials |
secrets |
| 1672 |
CKV_SECRET_9 |
JSON Web Token |
secrets |
JSON Web Token |
secrets |
| 1673 |
CKV_SECRET_11 |
Mailchimp Access Key |
secrets |
Mailchimp Access Key |
secrets |
| 1674 |
CKV_SECRET_12 |
NPM tokens |
secrets |
NPM tokens |
secrets |
| 1675 |
CKV_SECRET_13 |
Private Key |
secrets |
Private Key |
secrets |
| 1676 |
CKV_SECRET_14 |
Slack Token |
secrets |
Slack Token |
secrets |
| 1677 |
CKV_SECRET_15 |
SoftLayer Credentials |
secrets |
SoftLayer Credentials |
secrets |
| 1678 |
CKV_SECRET_16 |
Square OAuth Secret |
secrets |
Square OAuth Secret |
secrets |
| 1679 |
CKV_SECRET_17 |
Stripe Access Key |
secrets |
Stripe Access Key |
secrets |
| 1680 |
CKV_SECRET_18 |
Twilio API Key |
secrets |
Twilio API Key |
secrets |
| 1681 |
CKV_SECRET_19 |
Hex High Entropy String |
secrets |
Hex High Entropy String |
secrets |