Supported IaC Flaw detectors
The detectors for IaC flaws listed below are classified by the target IaC framework / cloud provider and target resource.
AWS CloudFormation
Ansible / AWS
Ansible detectors for AWS IaC Playbooks.
Encryption
Ansible / Azure
Ansible detectors for Azure IaC Playbooks.
IAM
Network
-
The configured minimum TLS version is not the latest version
-
Do not allow the admin user to login to the container registry
-
No Network Security Group is attached to the Virtual Machine
-
A sensitive port for TCP or UDP protocols is open for the whole network
-
Trusted Microsoft Services should be enabled for Storage Account access
Ansible / Gcp
AIM
-
GCP SQL Instance should not have insecure Cross DB Ownership Chaining On
-
PostgreSQL database instance should have a 'log_connections' flag with its value set to 'on'
-
Kubernetes Engine Clusters must have Legacy Authorization set to disabled
-
Google Firewall should not allow SSH access (port 22) from the Internet (public CIDR block)
-
Check if the Google compute firewall allows unrestricted RDP access
-
Kubernetes Clusters must be created with Alias IP ranges enabled
-
SQL Instance should not have Contained Database Authentication On
-
Defaults Kubernetes Engine Clusters should not be configured to use the default service account
Network
-
Google Kubernetes Engine (GKE) Basic Authentication must be disabled
-
Google Compute Engine VM instances should not enable serial ports
-
Google Compute Subnetwork should have Private Google Access enabled
-
Kubernetes Clusters must be created with Client Certificate enabled
-
Kubernetes Clusters must be created with Private Clusters enabled
-
Google Compute Network should not use a firewall rule that allows port range
-
Google Compute Network should not use a firewall rule that allows all ports
Docker
Kubernetes
Multi-Framework / AWS
Multi-Framework / Azure
Multi-Framework detectors for Azure IaC templates (ARM and Terraform).