From d98511020a11c6fe8071baa606e0799b174de205 Mon Sep 17 00:00:00 2001 From: James Woolfenden Date: Thu, 1 Dec 2022 10:57:45 +0000 Subject: [PATCH] fix(general): fix doc links on windows (#3959) fix doc links on windows --- docs/5.Policy Index/all.md | 6082 ++++++++--------- docs/5.Policy Index/argo_workflows.md | 8 +- docs/5.Policy Index/arm.md | 118 +- docs/5.Policy Index/azure_pipelines.md | 16 +- docs/5.Policy Index/bicep.md | 122 +- .../5.Policy Index/bitbucket_configuration.md | 6 +- docs/5.Policy Index/bitbucket_pipelines.md | 10 +- docs/5.Policy Index/circleci_pipelines.md | 20 +- docs/5.Policy Index/cloudformation.md | 324 +- docs/5.Policy Index/dockerfile.md | 28 +- docs/5.Policy Index/github_actions.md | 28 +- docs/5.Policy Index/github_configuration.md | 38 +- docs/5.Policy Index/gitlab_ci.md | 12 +- docs/5.Policy Index/gitlab_configuration.md | 8 +- docs/5.Policy Index/kubernetes.md | 1804 ++--- docs/5.Policy Index/openapi.md | 18 +- docs/5.Policy Index/secrets.md | 42 +- docs/5.Policy Index/serverless.md | 334 +- docs/5.Policy Index/terraform.md | 3538 +++++----- 19 files changed, 6278 insertions(+), 6278 deletions(-) diff --git a/docs/5.Policy Index/all.md b/docs/5.Policy Index/all.md index ab5b5e2b926..0d2dd6f550f 100644 --- a/docs/5.Policy Index/all.md +++ b/docs/5.Policy Index/all.md @@ -6,3047 +6,3047 @@ nav_order: 1 # all resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|------|--------------------------|----------------------------------|--------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------|-------------------------------------------------------------| -| 0 | CKV2_ADO_1 | resource | azuredevops_branch_policy_min_reviewers | Ensure at least two approving reviews for PRs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV2_ADO_1 | resource | azuredevops_git_repository | Ensure at least two approving reviews for PRs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_ALI_1 | resource | alicloud_oss_bucket | Alibaba Cloud OSS bucket accessible to public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_ALI_2 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_ALI_3 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_ALI_4 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_ALI_5 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all events | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_ALI_6 | resource | alicloud_oss_bucket | Ensure OSS bucket is encrypted with Customer Master Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_ALI_7 | resource | alicloud_disk | Ensure disk is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_ALI_8 | resource | alicloud_disk | Ensure Disk is encrypted with Customer Master Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_ALI_9 | resource | alicloud_db_instance | Ensure database instance is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_ALI_10 | resource | alicloud_oss_bucket | Ensure OSS bucket has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_ALI_11 | resource | alicloud_oss_bucket | Ensure OSS bucket has transfer Acceleration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_ALI_12 | resource | alicloud_oss_bucket | Ensure the OSS bucket has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_ALI_13 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires minimum length of 14 or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_ALI_14 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one number | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_ALI_15 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one symbol | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 17 | CKV_ALI_16 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy expires passwords within 90 days or less | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 18 | CKV_ALI_17 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one lowercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 19 | CKV_ALI_18 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy prevents password reuse | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 20 | CKV_ALI_19 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one uppercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 21 | CKV_ALI_20 | resource | alicloud_db_instance | Ensure RDS instance uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 22 | CKV_ALI_21 | resource | alicloud_api_gateway_api | Ensure API Gateway API Protocol HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 23 | CKV_ALI_22 | resource | alicloud_db_instance | Ensure Transparent Data Encryption is Enabled on instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 24 | CKV_ALI_23 | resource | alicloud_ram_account_password_policy | Ensure Ram Account Password Policy Max Login Attempts not > 5 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 25 | CKV_ALI_24 | resource | alicloud_ram_security_preference | Ensure RAM enforces MFA | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 26 | CKV_ALI_25 | resource | alicloud_db_instance | Ensure RDS Instance SQL Collector Retention Period should be greater than 180 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 27 | CKV_ALI_26 | resource | alicloud_cs_kubernetes | Ensure Kubernetes installs plugin Terway or Flannel to support standard policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 28 | CKV_ALI_27 | resource | alicloud_kms_key | Ensure KMS Key Rotation is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 29 | CKV_ALI_28 | resource | alicloud_kms_key | Ensure KMS Keys are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 30 | CKV_ALI_29 | resource | alicloud_alb_acl_entry_attachment | Alibaba ALB ACL does not restrict Access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 31 | CKV_ALI_30 | resource | alicloud_db_instance | Ensure RDS instance auto upgrades for minor versions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 32 | CKV_ALI_31 | resource | alicloud_cs_kubernetes_node_pool | Ensure K8s nodepools are set to auto repair | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 33 | CKV_ALI_32 | resource | alicloud_ecs_launch_template | Ensure launch template data disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 34 | CKV_ALI_33 | resource | alicloud_slb_tls_cipher_policy | Alibaba Cloud Cypher Policy are secure | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 35 | CKV_ALI_35 | resource | alicloud_db_instance | Ensure RDS instance has log_duration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 36 | CKV_ALI_36 | resource | alicloud_db_instance | Ensure RDS instance has log_disconnections enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 37 | CKV_ALI_37 | resource | alicloud_db_instance | Ensure RDS instance has log_connections enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 38 | CKV_ALI_38 | resource | alicloud_log_audit | Ensure log audit is enabled for RDS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 39 | CKV_ALI_41 | resource | alicloud_mongodb_instance | Ensure MongoDB is deployed inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 40 | CKV_ALI_42 | resource | alicloud_mongodb_instance | Ensure Mongodb instance uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 41 | CKV_ALI_43 | resource | alicloud_mongodb_instance | Ensure MongoDB instance is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 42 | CKV_ALI_44 | resource | alicloud_mongodb_instance | Ensure MongoDB has Transparent Data Encryption Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 43 | CKV_ARGO_1 | argo_workflows | spec | Ensure Workflow pods are not using the default ServiceAccount | Argo Workflows | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 44 | CKV_ARGO_2 | argo_workflows | spec | Ensure Workflow pods are running as non-root user | Argo Workflows | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 45 | CKV_AWS_1 | data | aws_iam_policy_document | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 46 | CKV_AWS_1 | resource | serverless_aws | Ensure IAM policies that allow full "*-*" administrative privileges are not created | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 47 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 48 | CKV_AWS_2 | resource | aws_alb_listener | Ensure ALB protocol is HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 49 | CKV_AWS_2 | resource | aws_lb_listener | Ensure ALB protocol is HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 50 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 51 | CKV_AWS_3 | resource | aws_ebs_volume | Ensure all data stored in the EBS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 52 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 53 | CKV_AWS_5 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 54 | CKV_AWS_5 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 55 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 56 | CKV_AWS_6 | resource | aws_elasticsearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 57 | CKV_AWS_6 | resource | aws_opensearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 58 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 59 | CKV_AWS_7 | resource | aws_kms_key | Ensure rotation for customer created CMKs is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 60 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 61 | CKV_AWS_8 | resource | aws_instance | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 62 | CKV_AWS_8 | resource | aws_launch_configuration | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 63 | CKV_AWS_9 | resource | aws_iam_account_password_policy | Ensure IAM password policy expires passwords within 90 days or less | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 64 | CKV_AWS_10 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires minimum length of 14 or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 65 | CKV_AWS_11 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one lowercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 66 | CKV_AWS_12 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one number | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 67 | CKV_AWS_13 | resource | aws_iam_account_password_policy | Ensure IAM password policy prevents password reuse | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 68 | CKV_AWS_14 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one symbol | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 69 | CKV_AWS_15 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one uppercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 70 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 71 | CKV_AWS_16 | resource | aws_db_instance | Ensure all data stored in the RDS is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 72 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 73 | CKV_AWS_17 | resource | aws_db_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 74 | CKV_AWS_17 | resource | aws_rds_cluster_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 75 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 76 | CKV_AWS_18 | resource | aws_s3_bucket | Ensure the S3 bucket has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 77 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 78 | CKV_AWS_19 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 79 | CKV_AWS_19 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 80 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 81 | CKV_AWS_20 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public READ access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 82 | CKV_AWS_20 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public READ access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 83 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 84 | CKV_AWS_21 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 85 | CKV_AWS_21 | resource | aws_s3_bucket_versioning | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 86 | CKV_AWS_22 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker Notebook is encrypted at rest using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 87 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 88 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 89 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 90 | CKV_AWS_23 | resource | aws_db_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 91 | CKV_AWS_23 | resource | aws_elasticache_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 92 | CKV_AWS_23 | resource | aws_redshift_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 93 | CKV_AWS_23 | resource | aws_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 94 | CKV_AWS_23 | resource | aws_security_group_rule | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 95 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 96 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 97 | CKV_AWS_24 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 98 | CKV_AWS_24 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 99 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 100 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 101 | CKV_AWS_25 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 102 | CKV_AWS_25 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 103 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 104 | CKV_AWS_26 | resource | aws_sns_topic | Ensure all data stored in the SNS topic is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 105 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 106 | CKV_AWS_27 | resource | aws_sqs_queue | Ensure all data stored in the SQS queue is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 107 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure Dynamodb point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 108 | CKV_AWS_28 | resource | aws_dynamodb_table | Ensure Dynamodb point in time recovery (backup) is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 109 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 110 | CKV_AWS_29 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 111 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 112 | CKV_AWS_30 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 113 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 114 | CKV_AWS_31 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 115 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 116 | CKV_AWS_32 | resource | aws_ecr_repository_policy | Ensure ECR policy is not set to public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 117 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 118 | CKV_AWS_33 | resource | aws_kms_key | Ensure KMS key policy does not contain wildcard (*) principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 119 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 120 | CKV_AWS_34 | resource | aws_cloudfront_distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 121 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 122 | CKV_AWS_35 | resource | aws_cloudtrail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 123 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 124 | CKV_AWS_36 | resource | aws_cloudtrail | Ensure CloudTrail log file validation is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 125 | CKV_AWS_37 | resource | aws_eks_cluster | Ensure Amazon EKS control plane logging enabled for all log types | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 126 | CKV_AWS_38 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 127 | CKV_AWS_39 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 128 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 129 | CKV_AWS_40 | resource | aws_iam_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 130 | CKV_AWS_40 | resource | aws_iam_user_policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 131 | CKV_AWS_40 | resource | aws_iam_user_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 132 | CKV_AWS_41 | provider | aws | Ensure no hard coded AWS access key and secret key exists in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 133 | CKV_AWS_41 | resource | serverless_aws | Ensure no hard coded AWS access key and secret key exists in provider | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 134 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 135 | CKV_AWS_42 | resource | aws_efs_file_system | Ensure EFS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 136 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 137 | CKV_AWS_43 | resource | aws_kinesis_stream | Ensure Kinesis Stream is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 138 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 139 | CKV_AWS_44 | resource | aws_neptune_cluster | Ensure Neptune storage is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 140 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 141 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 142 | CKV_AWS_45 | resource | aws_lambda_function | Ensure no hard-coded secrets exist in lambda environment | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 143 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 144 | CKV_AWS_46 | resource | aws_instance | Ensure no hard-coded secrets exist in EC2 user data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 145 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 146 | CKV_AWS_47 | resource | aws_dax_cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 147 | CKV_AWS_48 | resource | aws_mq_broker | Ensure MQ Broker logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 148 | CKV_AWS_49 | data | aws_iam_policy_document | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 149 | CKV_AWS_49 | resource | serverless_aws | Ensure no IAM policies documents allow "*" as a statement's actions | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 150 | CKV_AWS_50 | resource | aws_lambda_function | X-ray tracing is enabled for Lambda | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 151 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 152 | CKV_AWS_51 | resource | aws_ecr_repository | Ensure ECR Image Tags are immutable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 153 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLS enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 154 | CKV_AWS_53 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public ACLS enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 155 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 156 | CKV_AWS_54 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public policy enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 157 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 158 | CKV_AWS_55 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has ignore public ACLs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 159 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has 'restrict_public_bucket' enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 160 | CKV_AWS_56 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has 'restrict_public_bucket' enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 161 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 162 | CKV_AWS_57 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 163 | CKV_AWS_57 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 164 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 165 | CKV_AWS_58 | resource | aws_eks_cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 166 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 167 | CKV_AWS_59 | resource | aws_api_gateway_method | Ensure there is no open access to back-end resources through API | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 168 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 169 | CKV_AWS_60 | resource | aws_iam_role | Ensure IAM role allows only specific services or principals to assume it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 170 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 171 | CKV_AWS_61 | resource | aws_iam_role | Ensure AWS IAM policy does not allow assume role permission across all services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 172 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 173 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 174 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 175 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 176 | CKV_AWS_62 | resource | aws_iam_group_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 177 | CKV_AWS_62 | resource | aws_iam_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 178 | CKV_AWS_62 | resource | aws_iam_role_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 179 | CKV_AWS_62 | resource | aws_iam_user_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 180 | CKV_AWS_62 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 181 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 182 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 183 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 184 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 185 | CKV_AWS_63 | resource | aws_iam_group_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 186 | CKV_AWS_63 | resource | aws_iam_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 187 | CKV_AWS_63 | resource | aws_iam_role_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 188 | CKV_AWS_63 | resource | aws_iam_user_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 189 | CKV_AWS_63 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 190 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 191 | CKV_AWS_64 | resource | aws_redshift_cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 192 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 193 | CKV_AWS_65 | resource | aws_ecs_cluster | Ensure container insights are enabled on ECS cluster | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 194 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 195 | CKV_AWS_66 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group specifies retention days | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 196 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 197 | CKV_AWS_67 | resource | aws_cloudtrail | Ensure CloudTrail is enabled in all Regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 198 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 199 | CKV_AWS_68 | resource | aws_cloudfront_distribution | CloudFront Distribution should have WAF enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 200 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 201 | CKV_AWS_69 | resource | aws_mq_broker | Ensure MQ Broker is not publicly exposed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 202 | CKV_AWS_70 | resource | aws_s3_bucket | Ensure S3 bucket does not allow an action with any Principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 203 | CKV_AWS_70 | resource | aws_s3_bucket_policy | Ensure S3 bucket does not allow an action with any Principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 204 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 205 | CKV_AWS_71 | resource | aws_redshift_cluster | Ensure Redshift Cluster logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 206 | CKV_AWS_72 | resource | aws_sqs_queue_policy | Ensure SQS policy does not allow ALL (*) actions. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 207 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 208 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 209 | CKV_AWS_73 | resource | aws_api_gateway_stage | Ensure API Gateway has X-Ray Tracing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 210 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 211 | CKV_AWS_74 | resource | aws_docdb_cluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 212 | CKV_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure Global Accelerator accelerator has flow logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 213 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 214 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 215 | CKV_AWS_76 | resource | aws_api_gateway_stage | Ensure API Gateway has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 216 | CKV_AWS_76 | resource | aws_apigatewayv2_stage | Ensure API Gateway has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 217 | CKV_AWS_77 | resource | aws_athena_database | Ensure Athena Database is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 218 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 219 | CKV_AWS_78 | resource | aws_codebuild_project | Ensure that CodeBuild Project encryption is not disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 220 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 221 | CKV_AWS_79 | resource | aws_instance | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 222 | CKV_AWS_79 | resource | aws_launch_configuration | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 223 | CKV_AWS_79 | resource | aws_launch_template | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 224 | CKV_AWS_80 | resource | aws_msk_cluster | Ensure MSK Cluster logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 225 | CKV_AWS_81 | resource | aws_msk_cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 226 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 227 | CKV_AWS_82 | resource | aws_athena_workgroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 228 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 229 | CKV_AWS_83 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 230 | CKV_AWS_83 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 231 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 232 | CKV_AWS_84 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 233 | CKV_AWS_84 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 234 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocDB Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 235 | CKV_AWS_85 | resource | aws_docdb_cluster | Ensure DocDB Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 236 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure Cloudfront distribution has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 237 | CKV_AWS_86 | resource | aws_cloudfront_distribution | Ensure Cloudfront distribution has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 238 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 239 | CKV_AWS_87 | resource | aws_redshift_cluster | Redshift cluster should not be publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 240 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 241 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 242 | CKV_AWS_88 | resource | aws_instance | EC2 instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 243 | CKV_AWS_88 | resource | aws_launch_template | EC2 instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 244 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 245 | CKV_AWS_89 | resource | aws_dms_replication_instance | DMS replication instance should not be publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 246 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB TLS is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 247 | CKV_AWS_90 | resource | aws_docdb_cluster_parameter_group | Ensure DocDB TLS is not disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 248 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 249 | CKV_AWS_91 | resource | aws_alb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 250 | CKV_AWS_91 | resource | aws_lb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 251 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 252 | CKV_AWS_92 | resource | aws_elb | Ensure the ELB has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 253 | CKV_AWS_93 | resource | aws_s3_bucket | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 254 | CKV_AWS_93 | resource | aws_s3_bucket_policy | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 255 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 256 | CKV_AWS_94 | resource | aws_glue_data_catalog_encryption_settings | Ensure Glue Data Catalog Encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 257 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 258 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 259 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 260 | CKV_AWS_96 | resource | aws_rds_cluster | Ensure all data stored in Aurora is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 261 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 262 | CKV_AWS_97 | resource | aws_ecs_task_definition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 263 | CKV_AWS_98 | resource | aws_sagemaker_endpoint_configuration | Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 264 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 265 | CKV_AWS_99 | resource | aws_glue_security_configuration | Ensure Glue Security Configuration Encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 266 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 267 | CKV_AWS_100 | resource | aws_eks_node_group | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 268 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 269 | CKV_AWS_101 | resource | aws_neptune_cluster | Ensure Neptune logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 270 | CKV_AWS_102 | resource | aws_neptune_cluster_instance | Ensure Neptune Cluster instance is not publicly available | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 271 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 272 | CKV_AWS_103 | resource | aws_alb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 273 | CKV_AWS_103 | resource | aws_lb | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 274 | CKV_AWS_103 | resource | aws_lb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 275 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB has audit logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 276 | CKV_AWS_104 | resource | aws_docdb_cluster_parameter_group | Ensure DocDB has audit logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 277 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 278 | CKV_AWS_105 | resource | aws_redshift_parameter_group | Ensure Redshift uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 279 | CKV_AWS_106 | resource | aws_ebs_encryption_by_default | Ensure EBS default encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 280 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 281 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 282 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 283 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 284 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 285 | CKV_AWS_107 | data | aws_iam_policy_document | Ensure IAM policies does not allow credentials exposure | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 286 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 287 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 288 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 289 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 290 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 291 | CKV_AWS_108 | data | aws_iam_policy_document | Ensure IAM policies does not allow data exfiltration | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 292 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 293 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 294 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 295 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 296 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 297 | CKV_AWS_109 | data | aws_iam_policy_document | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 298 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 299 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 300 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 301 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 302 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 303 | CKV_AWS_110 | data | aws_iam_policy_document | Ensure IAM policies does not allow privilege escalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 304 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 305 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 306 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 307 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 308 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 309 | CKV_AWS_111 | data | aws_iam_policy_document | Ensure IAM policies does not allow write access without constraints | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 310 | CKV_AWS_112 | resource | aws_ssm_document | Ensure Session Manager data is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 311 | CKV_AWS_113 | resource | aws_ssm_document | Ensure Session Manager logs are enabled and encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 312 | CKV_AWS_114 | resource | aws_emr_cluster | Ensure that EMR clusters with Kerberos have Kerberos Realm set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 313 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 314 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 315 | CKV_AWS_115 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 316 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 317 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 318 | CKV_AWS_116 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 319 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 320 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 321 | CKV_AWS_117 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 322 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 323 | CKV_AWS_118 | resource | aws_db_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 324 | CKV_AWS_118 | resource | aws_rds_cluster_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 325 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 326 | CKV_AWS_119 | resource | aws_dynamodb_table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 327 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 328 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 329 | CKV_AWS_120 | resource | aws_api_gateway_stage | Ensure API Gateway caching is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 330 | CKV_AWS_121 | resource | aws_config_configuration_aggregator | Ensure AWS Config is enabled in all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 331 | CKV_AWS_122 | resource | aws_sagemaker_notebook_instance | Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 332 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 333 | CKV_AWS_123 | resource | aws_vpc_endpoint_service | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 334 | CKV_AWS_124 | resource | aws_cloudformation_stack | Ensure that CloudFormation stacks are sending event notifications to an SNS topic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 335 | CKV_AWS_126 | resource | aws_instance | Ensure that detailed monitoring is enabled for EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 336 | CKV_AWS_127 | resource | aws_elb | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 337 | CKV_AWS_128 | resource | aws_rds_cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 338 | CKV_AWS_129 | resource | aws_db_instance | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 339 | CKV_AWS_130 | resource | aws_subnet | Ensure VPC subnets do not assign public IP by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 340 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 341 | CKV_AWS_131 | resource | aws_alb | Ensure that ALB drops HTTP headers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 342 | CKV_AWS_131 | resource | aws_lb | Ensure that ALB drops HTTP headers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 343 | CKV_AWS_133 | resource | aws_db_instance | Ensure that RDS instances has backup policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 344 | CKV_AWS_133 | resource | aws_rds_cluster | Ensure that RDS instances has backup policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 345 | CKV_AWS_134 | resource | aws_elasticache_cluster | Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 346 | CKV_AWS_135 | resource | aws_instance | Ensure that EC2 is EBS optimized | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 347 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 348 | CKV_AWS_136 | resource | aws_ecr_repository | Ensure that ECR repositories are encrypted using KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 349 | CKV_AWS_137 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 350 | CKV_AWS_137 | resource | aws_opensearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 351 | CKV_AWS_138 | resource | aws_elb | Ensure that ELB is cross-zone-load-balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 352 | CKV_AWS_139 | resource | aws_rds_cluster | Ensure that RDS clusters have deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 353 | CKV_AWS_140 | resource | aws_rds_global_cluster | Ensure that RDS global clusters are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 354 | CKV_AWS_141 | resource | aws_redshift_cluster | Ensured that redshift cluster allowing version upgrade by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 355 | CKV_AWS_142 | resource | aws_redshift_cluster | Ensure that Redshift cluster is encrypted by KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 356 | CKV_AWS_143 | resource | aws_s3_bucket | Ensure that S3 bucket has lock configuration enabled by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 357 | CKV_AWS_144 | resource | aws_s3_bucket | Ensure that S3 bucket has cross-region replication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 358 | CKV_AWS_144 | resource | aws_s3_bucket_replication_configuration | Ensure that S3 bucket has cross-region replication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 359 | CKV_AWS_145 | resource | aws_s3_bucket | Ensure that S3 buckets are encrypted with KMS by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 360 | CKV_AWS_145 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure that S3 buckets are encrypted with KMS by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 361 | CKV_AWS_146 | resource | aws_db_cluster_snapshot | Ensure that RDS database cluster snapshot is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 362 | CKV_AWS_147 | resource | aws_codebuild_project | Ensure that CodeBuild projects are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 363 | CKV_AWS_148 | resource | aws_default_vpc | Ensure no default VPC is planned to be provisioned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 364 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 365 | CKV_AWS_149 | resource | aws_secretsmanager_secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 366 | CKV_AWS_150 | resource | aws_alb | Ensure that Load Balancer has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 367 | CKV_AWS_150 | resource | aws_lb | Ensure that Load Balancer has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 368 | CKV_AWS_152 | resource | aws_alb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 369 | CKV_AWS_152 | resource | aws_lb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 370 | CKV_AWS_153 | resource | aws_autoscaling_group | Autoscaling groups should supply tags to launch configurations | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 371 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 372 | CKV_AWS_154 | resource | aws_redshift_cluster | Ensure Redshift is not deployed outside of a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 373 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 374 | CKV_AWS_155 | resource | aws_workspaces_workspace | Ensure that Workspace user volumes are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 375 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 376 | CKV_AWS_156 | resource | aws_workspaces_workspace | Ensure that Workspace root volumes are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 377 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 378 | CKV_AWS_157 | resource | aws_db_instance | Ensure that RDS instances have Multi-AZ enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 379 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 380 | CKV_AWS_158 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group is encrypted by KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 381 | CKV_AWS_159 | resource | aws_athena_workgroup | Ensure that Athena Workgroup is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 382 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 383 | CKV_AWS_160 | resource | aws_timestreamwrite_database | Ensure that Timestream database is encrypted with KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 384 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 385 | CKV_AWS_161 | resource | aws_db_instance | Ensure RDS database has IAM authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 386 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 387 | CKV_AWS_162 | resource | aws_rds_cluster | Ensure RDS cluster has IAM authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 388 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 389 | CKV_AWS_163 | resource | aws_ecr_repository | Ensure ECR image scanning on push is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 390 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 391 | CKV_AWS_164 | resource | aws_transfer_server | Ensure Transfer Server is not exposed publicly. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 392 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure Dynamodb global table point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 393 | CKV_AWS_165 | resource | aws_dynamodb_global_table | Ensure Dynamodb point in time recovery (backup) is enabled for global tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 394 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 395 | CKV_AWS_166 | resource | aws_backup_vault | Ensure Backup Vault is encrypted at rest using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 396 | CKV_AWS_167 | resource | aws_glacier_vault | Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 397 | CKV_AWS_168 | resource | aws_sqs_queue | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 398 | CKV_AWS_168 | resource | aws_sqs_queue_policy | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 399 | CKV_AWS_169 | resource | aws_sns_topic_policy | Ensure SNS topic policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 400 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 401 | CKV_AWS_170 | resource | aws_qldb_ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 402 | CKV_AWS_171 | resource | aws_emr_security_configuration | Ensure Cluster security configuration encryption is using SSE-KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 403 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 404 | CKV_AWS_172 | resource | aws_qldb_ledger | Ensure QLDB ledger has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 405 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 406 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 407 | CKV_AWS_173 | resource | aws_lambda_function | Check encryption settings for Lambda environmental variable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 408 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 409 | CKV_AWS_174 | resource | aws_cloudfront_distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 410 | CKV_AWS_175 | resource | aws_waf_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 411 | CKV_AWS_175 | resource | aws_wafregional_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 412 | CKV_AWS_175 | resource | aws_wafv2_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 413 | CKV_AWS_176 | resource | aws_waf_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 414 | CKV_AWS_176 | resource | aws_wafregional_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 415 | CKV_AWS_177 | resource | aws_kinesis_video_stream | Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 416 | CKV_AWS_178 | resource | aws_fsx_ontap_file_system | Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 417 | CKV_AWS_179 | resource | aws_fsx_windows_file_system | Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 418 | CKV_AWS_180 | resource | aws_imagebuilder_component | Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 419 | CKV_AWS_181 | resource | aws_s3_object_copy | Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 420 | CKV_AWS_182 | resource | aws_docdb_cluster | Ensure Doc DB is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 421 | CKV_AWS_183 | resource | aws_ebs_snapshot_copy | Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 422 | CKV_AWS_184 | resource | aws_efs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 423 | CKV_AWS_185 | resource | aws_kinesis_stream | Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 424 | CKV_AWS_186 | resource | aws_s3_bucket_object | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 425 | CKV_AWS_187 | resource | aws_sagemaker_domain | Ensure Sagemaker domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 426 | CKV_AWS_188 | resource | aws_redshift_cluster | Ensure RedShift Cluster is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 427 | CKV_AWS_189 | resource | aws_ebs_volume | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 428 | CKV_AWS_190 | resource | aws_fsx_lustre_file_system | Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 429 | CKV_AWS_191 | resource | aws_elasticache_replication_group | Ensure Elasticache replication group is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 430 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 431 | CKV_AWS_192 | resource | aws_wafv2_web_acl | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 432 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 433 | CKV_AWS_193 | resource | aws_appsync_graphql_api | Ensure AppSync has Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 434 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 435 | CKV_AWS_194 | resource | aws_appsync_graphql_api | Ensure AppSync has Field-Level logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 436 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 437 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 438 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 439 | CKV_AWS_195 | resource | aws_glue_crawler | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 440 | CKV_AWS_195 | resource | aws_glue_dev_endpoint | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 441 | CKV_AWS_195 | resource | aws_glue_job | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 442 | CKV_AWS_196 | resource | aws_elasticache_security_group | Ensure no aws_elasticache_security_group resources exist | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 443 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 444 | CKV_AWS_197 | resource | aws_mq_broker | Ensure MQ Broker Audit logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 445 | CKV_AWS_198 | resource | aws_db_security_group | Ensure no aws_db_security_group resources exist | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 446 | CKV_AWS_199 | resource | aws_imagebuilder_distribution_configuration | Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 447 | CKV_AWS_200 | resource | aws_imagebuilder_image_recipe | Ensure that Image Recipe EBS Disk are encrypted with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 448 | CKV_AWS_201 | resource | aws_memorydb_cluster | Ensure MemoryDB is encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 449 | CKV_AWS_202 | resource | aws_memorydb_cluster | Ensure MemoryDB data is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 450 | CKV_AWS_203 | resource | aws_fsx_openzfs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 451 | CKV_AWS_204 | resource | aws_ami | Ensure AMIs are encrypted using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 452 | CKV_AWS_205 | resource | aws_ami_launch_permission | Ensure to Limit AMI launch Permissions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 453 | CKV_AWS_206 | resource | aws_api_gateway_domain_name | Ensure API Gateway Domain uses a modern security Policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 454 | CKV_AWS_207 | resource | aws_mq_broker | Ensure MQ Broker minor version updates are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 455 | CKV_AWS_208 | resource | aws_mq_broker | Ensure MQBroker version is current | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 456 | CKV_AWS_208 | resource | aws_mq_configuration | Ensure MQBroker version is current | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 457 | CKV_AWS_209 | resource | aws_mq_broker | Ensure MQ broker encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 458 | CKV_AWS_210 | resource | aws_batch_job_definition | Batch job does not define a privileged container | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 459 | CKV_AWS_211 | resource | aws_db_instance | Ensure RDS uses a modern CaCert | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 460 | CKV_AWS_212 | resource | aws_dms_replication_instance | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 461 | CKV_AWS_213 | resource | aws_load_balancer_policy | Ensure ELB Policy uses only secure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 462 | CKV_AWS_214 | resource | aws_appsync_api_cache | Ensure Appsync API Cache is encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 463 | CKV_AWS_215 | resource | aws_appsync_api_cache | Ensure Appsync API Cache is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 464 | CKV_AWS_216 | resource | aws_cloudfront_distribution | Ensure Cloudfront distribution is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 465 | CKV_AWS_217 | resource | aws_api_gateway_deployment | Ensure Create before destroy for API deployments | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 466 | CKV_AWS_218 | resource | aws_cloudsearch_domain | Ensure that Cloudsearch is using latest TLS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 467 | CKV_AWS_219 | resource | aws_codepipeline | Ensure Code Pipeline Artifact store is using a KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 468 | CKV_AWS_220 | resource | aws_cloudsearch_domain | Ensure that Cloudsearch is using https | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 469 | CKV_AWS_221 | resource | aws_codeartifact_domain | Ensure Code artifact Domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 470 | CKV_AWS_222 | resource | aws_dms_replication_instance | Ensure DMS instance gets all minor upgrade automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 471 | CKV_AWS_223 | resource | aws_ecs_cluster | Ensure ECS Cluster enables logging of ECS Exec | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 472 | CKV_AWS_224 | resource | aws_ecs_cluster | Ensure Cluster logging with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 473 | CKV_AWS_225 | resource | aws_api_gateway_method_settings | Ensure API Gateway method setting caching is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 474 | CKV_AWS_226 | resource | aws_db_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 475 | CKV_AWS_226 | resource | aws_rds_cluster_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 476 | CKV_AWS_227 | resource | aws_kms_key | Ensure KMS key is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 477 | CKV_AWS_228 | resource | aws_elasticsearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 478 | CKV_AWS_228 | resource | aws_opensearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 479 | CKV_AWS_229 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 480 | CKV_AWS_229 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 481 | CKV_AWS_230 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 482 | CKV_AWS_230 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 483 | CKV_AWS_231 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 484 | CKV_AWS_231 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 485 | CKV_AWS_232 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 486 | CKV_AWS_232 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 487 | CKV_AWS_233 | resource | aws_acm_certificate | Ensure Create before destroy for ACM certificates | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 488 | CKV_AWS_234 | resource | aws_acm_certificate | Verify logging preference for ACM certificates | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 489 | CKV_AWS_235 | resource | aws_ami_copy | Ensure that copied AMIs are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 490 | CKV_AWS_236 | resource | aws_ami_copy | Ensure AMI copying uses a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 491 | CKV_AWS_237 | resource | aws_api_gateway_rest_api | Ensure Create before destroy for API GATEWAY | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 492 | CKV_AWS_238 | resource | aws_guardduty_detector | Ensure that Guard Duty detector is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 493 | CKV_AWS_239 | resource | aws_dax_cluster | Ensure DAX cluster endpoint is using TLS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 494 | CKV_AWS_240 | resource | aws_kinesis_firehose_delivery_stream | Ensure Kinesis Firehose delivery stream is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 495 | CKV_AWS_241 | resource | aws_kinesis_firehose_delivery_stream | Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 496 | CKV_AWS_242 | resource | aws_mwaa_environment | Ensure MWAA environment has scheduler logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 497 | CKV_AWS_243 | resource | aws_mwaa_environment | Ensure MWAA environment has worker logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 498 | CKV_AWS_244 | resource | aws_mwaa_environment | Ensure MWAA environment has webserver logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 499 | CKV_AWS_245 | resource | aws_db_instance_automated_backups_replication | Ensure replicated backups are encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 500 | CKV_AWS_246 | resource | aws_rds_cluster_activity_stream | Ensure RDS Cluster activity streams are encrypted using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 501 | CKV_AWS_247 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 502 | CKV_AWS_247 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 503 | CKV_AWS_248 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 504 | CKV_AWS_248 | resource | aws_opensearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 505 | CKV_AWS_249 | resource | aws_ecs_task_definition | Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 506 | CKV_AWS_250 | resource | aws_db_instance | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 507 | CKV_AWS_250 | resource | aws_rds_cluster | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 508 | CKV_AWS_251 | resource | aws_cloudtrail | Ensure CloudTrail logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 509 | CKV_AWS_252 | resource | aws_cloudtrail | Ensure CloudTrail defines an SNS Topic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 510 | CKV_AWS_253 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 511 | CKV_AWS_254 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 512 | CKV_AWS_255 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 513 | CKV_AWS_256 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted using a Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 514 | CKV_AWS_257 | resource | aws_codecommit_approval_rule_template | Ensure codecommit branch changes have at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 515 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 516 | CKV_AWS_258 | resource | aws_lambda_function_url | Ensure that Lambda function URLs AuthType is not None | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 517 | CKV_AWS_259 | resource | aws_cloudfront_response_headers_policy | Ensure CloudFront response header policy enforces Strict Transport Security | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 518 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 519 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 520 | CKV_AWS_260 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 521 | CKV_AWS_260 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 522 | CKV_AWS_261 | resource | aws_alb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 523 | CKV_AWS_261 | resource | aws_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 524 | CKV_AWS_262 | resource | aws_kendra_index | Ensure Kendra index Server side encryption uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 525 | CKV_AWS_263 | resource | aws_appflow_flow | Ensure App Flow flow uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 526 | CKV_AWS_264 | resource | aws_appflow_connector_profile | Ensure App Flow connector profile uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 527 | CKV_AWS_265 | resource | aws_keyspaces_table | Ensure Keyspaces Table uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 528 | CKV_AWS_266 | resource | aws_db_snapshot_copy | Ensure App Flow connector profile uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 529 | CKV_AWS_267 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 530 | CKV_AWS_268 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 531 | CKV_AWS_269 | resource | aws_connect_instance_storage_config | Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 532 | CKV_AWS_270 | resource | aws_connect_instance_storage_config | Ensure Connect Instance S3 Storage Config uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 533 | CKV_AWS_271 | resource | aws_dynamodb_table_replica | Ensure DynamoDB table replica KMS encryption uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 534 | CKV_AWS_272 | resource | aws_lambda_function | Ensure AWS Lambda function is configured to validate code-signing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 535 | CKV_AWS_273 | resource | aws_iam_user | Ensure access is controlled through SSO and not AWS IAM defined users | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 536 | CKV_AWS_274 | resource | aws_iam_group_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 537 | CKV_AWS_274 | resource | aws_iam_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 538 | CKV_AWS_274 | resource | aws_iam_role | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 539 | CKV_AWS_274 | resource | aws_iam_role_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 540 | CKV_AWS_274 | resource | aws_iam_user_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 541 | CKV_AWS_275 | data | aws_iam_policy | Disallow policies from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 542 | CKV_AWS_276 | resource | aws_api_gateway_method_settings | Ensure Data Trace is not enabled in API Gateway Method Settings | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 543 | CKV_AWS_277 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 544 | CKV_AWS_277 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 545 | CKV_AWS_278 | resource | aws_memorydb_snapshot | Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 546 | CKV_AWS_279 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 547 | CKV_AWS_280 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 548 | CKV_AWS_281 | resource | aws_redshift_snapshot_copy_grant | Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 549 | CKV_AWS_282 | resource | aws_redshiftserverless_namespace | Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 550 | CKV2_AWS_1 | resource | aws_network_acl | Ensure that all NACL are attached to subnets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 551 | CKV2_AWS_1 | resource | aws_subnet | Ensure that all NACL are attached to subnets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 552 | CKV2_AWS_2 | resource | aws_ebs_volume | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 553 | CKV2_AWS_2 | resource | aws_volume_attachment | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 554 | CKV2_AWS_3 | resource | aws_guardduty_detector | Ensure GuardDuty is enabled to specific org/region | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 555 | CKV2_AWS_3 | resource | aws_guardduty_organization_configuration | Ensure GuardDuty is enabled to specific org/region | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 556 | CKV2_AWS_4 | resource | aws_api_gateway_method_settings | Ensure API Gateway stage have logging level defined as appropriate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 557 | CKV2_AWS_4 | resource | aws_api_gateway_stage | Ensure API Gateway stage have logging level defined as appropriate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 558 | CKV2_AWS_5 | resource | aws_security_group | Ensure that Security Groups are attached to another resource | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 559 | CKV2_AWS_6 | resource | aws_s3_bucket | Ensure that S3 bucket has a Public Access block | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 560 | CKV2_AWS_6 | resource | aws_s3_bucket_public_access_block | Ensure that S3 bucket has a Public Access block | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 561 | CKV2_AWS_7 | resource | aws_emr_cluster | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 562 | CKV2_AWS_7 | resource | aws_security_group | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 563 | CKV2_AWS_8 | resource | aws_rds_cluster | Ensure that RDS clusters has backup plan of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 564 | CKV2_AWS_9 | resource | aws_backup_selection | Ensure that EBS are added in the backup plans of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 565 | CKV2_AWS_10 | resource | aws_cloudtrail | Ensure CloudTrail trails are integrated with CloudWatch Logs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 566 | CKV2_AWS_11 | resource | aws_vpc | Ensure VPC flow logging is enabled in all VPCs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 567 | CKV2_AWS_12 | resource | aws_default_security_group | Ensure the default security group of every VPC restricts all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 568 | CKV2_AWS_12 | resource | aws_vpc | Ensure the default security group of every VPC restricts all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 569 | CKV2_AWS_14 | resource | aws_iam_group | Ensure that IAM groups includes at least one IAM user | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 570 | CKV2_AWS_14 | resource | aws_iam_group_membership | Ensure that IAM groups includes at least one IAM user | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 571 | CKV2_AWS_15 | resource | aws_autoscaling_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 572 | CKV2_AWS_15 | resource | aws_elb | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 573 | CKV2_AWS_15 | resource | aws_lb_target_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 574 | CKV2_AWS_16 | resource | aws_appautoscaling_target | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 575 | CKV2_AWS_16 | resource | aws_dynamodb_table | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 576 | CKV2_AWS_18 | resource | aws_backup_selection | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 577 | CKV2_AWS_19 | resource | aws_eip | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 578 | CKV2_AWS_19 | resource | aws_eip_association | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 579 | CKV2_AWS_20 | resource | aws_alb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 580 | CKV2_AWS_20 | resource | aws_alb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 581 | CKV2_AWS_20 | resource | aws_lb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 582 | CKV2_AWS_20 | resource | aws_lb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 583 | CKV2_AWS_21 | resource | aws_iam_group_membership | Ensure that all IAM users are members of at least one IAM group. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 584 | CKV2_AWS_22 | resource | aws_iam_user | Ensure an IAM User does not have access to the console | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 585 | CKV2_AWS_23 | resource | aws_route53_record | Route53 A Record has Attached Resource | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 586 | CKV2_AWS_27 | resource | aws_rds_cluster | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 587 | CKV2_AWS_27 | resource | aws_rds_cluster_parameter_group | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 588 | CKV2_AWS_28 | resource | aws_alb | Ensure public facing ALB are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 589 | CKV2_AWS_28 | resource | aws_lb | Ensure public facing ALB are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 590 | CKV2_AWS_29 | resource | aws_api_gateway_rest_api | Ensure public API gateway are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 591 | CKV2_AWS_29 | resource | aws_api_gateway_stage | Ensure public API gateway are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 592 | CKV2_AWS_30 | resource | aws_db_instance | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 593 | CKV2_AWS_30 | resource | aws_db_parameter_group | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 594 | CKV2_AWS_31 | resource | aws_wafv2_web_acl | Ensure WAF2 has a Logging Configuration | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 595 | CKV2_AWS_32 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has a response headers policy attached | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 596 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 597 | CKV2_AWS_33 | resource | aws_appsync_graphql_api | Ensure AppSync is protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 598 | CKV2_AWS_34 | resource | aws_ssm_parameter | AWS SSM Parameter should be Encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 599 | CKV2_AWS_35 | resource | aws_route | AWS NAT Gateways should be utilized for the default route | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 600 | CKV2_AWS_35 | resource | aws_route_table | AWS NAT Gateways should be utilized for the default route | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 601 | CKV2_AWS_36 | resource | aws_ssm_parameter | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 602 | CKV2_AWS_36 | resource | data.http | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 603 | CKV2_AWS_37 | resource | aws | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 604 | CKV2_AWS_37 | resource | aws_accessanalyzer_analyzer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 605 | CKV2_AWS_37 | resource | aws_acm_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 606 | CKV2_AWS_37 | resource | aws_acm_certificate_validation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 607 | CKV2_AWS_37 | resource | aws_acmpca_certificate_authority | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 608 | CKV2_AWS_37 | resource | aws_ami | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 609 | CKV2_AWS_37 | resource | aws_ami_copy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 610 | CKV2_AWS_37 | resource | aws_ami_from_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 611 | CKV2_AWS_37 | resource | aws_ami_launch_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 612 | CKV2_AWS_37 | resource | aws_api_gateway_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 613 | CKV2_AWS_37 | resource | aws_api_gateway_api_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 614 | CKV2_AWS_37 | resource | aws_api_gateway_authorizer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 615 | CKV2_AWS_37 | resource | aws_api_gateway_base_path_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 616 | CKV2_AWS_37 | resource | aws_api_gateway_client_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 617 | CKV2_AWS_37 | resource | aws_api_gateway_deployment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 618 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_part | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 619 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 620 | CKV2_AWS_37 | resource | aws_api_gateway_domain_name | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 621 | CKV2_AWS_37 | resource | aws_api_gateway_gateway_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 622 | CKV2_AWS_37 | resource | aws_api_gateway_integration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 623 | CKV2_AWS_37 | resource | aws_api_gateway_integration_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 624 | CKV2_AWS_37 | resource | aws_api_gateway_method | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 625 | CKV2_AWS_37 | resource | aws_api_gateway_method_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 626 | CKV2_AWS_37 | resource | aws_api_gateway_method_settings | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 627 | CKV2_AWS_37 | resource | aws_api_gateway_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 628 | CKV2_AWS_37 | resource | aws_api_gateway_request_validator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 629 | CKV2_AWS_37 | resource | aws_api_gateway_resource | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 630 | CKV2_AWS_37 | resource | aws_api_gateway_rest_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 631 | CKV2_AWS_37 | resource | aws_api_gateway_stage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 632 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 633 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 634 | CKV2_AWS_37 | resource | aws_api_gateway_vpc_link | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 635 | CKV2_AWS_37 | resource | aws_apigatewayv2_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 636 | CKV2_AWS_37 | resource | aws_apigatewayv2_api_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 637 | CKV2_AWS_37 | resource | aws_apigatewayv2_authorizer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 638 | CKV2_AWS_37 | resource | aws_apigatewayv2_deployment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 639 | CKV2_AWS_37 | resource | aws_apigatewayv2_domain_name | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 640 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 641 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 642 | CKV2_AWS_37 | resource | aws_apigatewayv2_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 643 | CKV2_AWS_37 | resource | aws_apigatewayv2_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 644 | CKV2_AWS_37 | resource | aws_apigatewayv2_route_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 645 | CKV2_AWS_37 | resource | aws_apigatewayv2_stage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 646 | CKV2_AWS_37 | resource | aws_apigatewayv2_vpc_link | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 647 | CKV2_AWS_37 | resource | aws_app_cookie_stickiness_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 648 | CKV2_AWS_37 | resource | aws_appautoscaling_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 649 | CKV2_AWS_37 | resource | aws_appautoscaling_scheduled_action | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 650 | CKV2_AWS_37 | resource | aws_appautoscaling_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 651 | CKV2_AWS_37 | resource | aws_appmesh_mesh | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 652 | CKV2_AWS_37 | resource | aws_appmesh_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 653 | CKV2_AWS_37 | resource | aws_appmesh_virtual_node | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 654 | CKV2_AWS_37 | resource | aws_appmesh_virtual_router | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 655 | CKV2_AWS_37 | resource | aws_appmesh_virtual_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 656 | CKV2_AWS_37 | resource | aws_appsync_api_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 657 | CKV2_AWS_37 | resource | aws_appsync_datasource | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 658 | CKV2_AWS_37 | resource | aws_appsync_function | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 659 | CKV2_AWS_37 | resource | aws_appsync_graphql_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 660 | CKV2_AWS_37 | resource | aws_appsync_resolver | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 661 | CKV2_AWS_37 | resource | aws_athena_database | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 662 | CKV2_AWS_37 | resource | aws_athena_named_query | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 663 | CKV2_AWS_37 | resource | aws_athena_workgroup | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 664 | CKV2_AWS_37 | resource | aws_autoscaling_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 665 | CKV2_AWS_37 | resource | aws_autoscaling_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 666 | CKV2_AWS_37 | resource | aws_autoscaling_lifecycle_hook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 667 | CKV2_AWS_37 | resource | aws_autoscaling_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 668 | CKV2_AWS_37 | resource | aws_autoscaling_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 669 | CKV2_AWS_37 | resource | aws_autoscaling_schedule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 670 | CKV2_AWS_37 | resource | aws_backup_plan | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 671 | CKV2_AWS_37 | resource | aws_backup_selection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 672 | CKV2_AWS_37 | resource | aws_backup_vault | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 673 | CKV2_AWS_37 | resource | aws_batch_compute_environment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 674 | CKV2_AWS_37 | resource | aws_batch_job_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 675 | CKV2_AWS_37 | resource | aws_batch_job_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 676 | CKV2_AWS_37 | resource | aws_budgets_budget | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 677 | CKV2_AWS_37 | resource | aws_cloud9_environment_ec2 | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 678 | CKV2_AWS_37 | resource | aws_cloudformation_stack | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 679 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 680 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 681 | CKV2_AWS_37 | resource | aws_cloudfront_distribution | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 682 | CKV2_AWS_37 | resource | aws_cloudfront_origin_access_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 683 | CKV2_AWS_37 | resource | aws_cloudfront_public_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 684 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 685 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_hsm | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 686 | CKV2_AWS_37 | resource | aws_cloudtrail | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 687 | CKV2_AWS_37 | resource | aws_cloudwatch_dashboard | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 688 | CKV2_AWS_37 | resource | aws_cloudwatch_event_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 689 | CKV2_AWS_37 | resource | aws_cloudwatch_event_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 690 | CKV2_AWS_37 | resource | aws_cloudwatch_event_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 691 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 692 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 693 | CKV2_AWS_37 | resource | aws_cloudwatch_log_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 694 | CKV2_AWS_37 | resource | aws_cloudwatch_log_metric_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 695 | CKV2_AWS_37 | resource | aws_cloudwatch_log_resource_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 696 | CKV2_AWS_37 | resource | aws_cloudwatch_log_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 697 | CKV2_AWS_37 | resource | aws_cloudwatch_log_subscription_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 698 | CKV2_AWS_37 | resource | aws_cloudwatch_metric_alarm | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 699 | CKV2_AWS_37 | resource | aws_codebuild_project | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 700 | CKV2_AWS_37 | resource | aws_codebuild_source_credential | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 701 | CKV2_AWS_37 | resource | aws_codebuild_webhook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 702 | CKV2_AWS_37 | resource | aws_codecommit_repository | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 703 | CKV2_AWS_37 | resource | aws_codecommit_trigger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 704 | CKV2_AWS_37 | resource | aws_codedeploy_app | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 705 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 706 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 707 | CKV2_AWS_37 | resource | aws_codepipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 708 | CKV2_AWS_37 | resource | aws_codepipeline_webhook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 709 | CKV2_AWS_37 | resource | aws_codestarnotifications_notification_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 710 | CKV2_AWS_37 | resource | aws_cognito_identity_pool | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 711 | CKV2_AWS_37 | resource | aws_cognito_identity_pool_roles_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 712 | CKV2_AWS_37 | resource | aws_cognito_identity_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 713 | CKV2_AWS_37 | resource | aws_cognito_resource_server | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 714 | CKV2_AWS_37 | resource | aws_cognito_user_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 715 | CKV2_AWS_37 | resource | aws_cognito_user_pool | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 716 | CKV2_AWS_37 | resource | aws_cognito_user_pool_client | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 717 | CKV2_AWS_37 | resource | aws_cognito_user_pool_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 718 | CKV2_AWS_37 | resource | aws_config_aggregate_authorization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 719 | CKV2_AWS_37 | resource | aws_config_config_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 720 | CKV2_AWS_37 | resource | aws_config_configuration_aggregator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 721 | CKV2_AWS_37 | resource | aws_config_configuration_recorder | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 722 | CKV2_AWS_37 | resource | aws_config_configuration_recorder_status | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 723 | CKV2_AWS_37 | resource | aws_config_delivery_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 724 | CKV2_AWS_37 | resource | aws_config_organization_custom_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 725 | CKV2_AWS_37 | resource | aws_config_organization_managed_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 726 | CKV2_AWS_37 | resource | aws_cur_report_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 727 | CKV2_AWS_37 | resource | aws_customer_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 728 | CKV2_AWS_37 | resource | aws_datapipeline_pipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 729 | CKV2_AWS_37 | resource | aws_datasync_agent | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 730 | CKV2_AWS_37 | resource | aws_datasync_location_efs | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 731 | CKV2_AWS_37 | resource | aws_datasync_location_nfs | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 732 | CKV2_AWS_37 | resource | aws_datasync_location_s3 | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 733 | CKV2_AWS_37 | resource | aws_datasync_location_smb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 734 | CKV2_AWS_37 | resource | aws_datasync_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 735 | CKV2_AWS_37 | resource | aws_dax_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 736 | CKV2_AWS_37 | resource | aws_dax_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 737 | CKV2_AWS_37 | resource | aws_dax_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 738 | CKV2_AWS_37 | resource | aws_db_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 739 | CKV2_AWS_37 | resource | aws_db_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 740 | CKV2_AWS_37 | resource | aws_db_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 741 | CKV2_AWS_37 | resource | aws_db_instance_role_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 742 | CKV2_AWS_37 | resource | aws_db_option_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 743 | CKV2_AWS_37 | resource | aws_db_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 744 | CKV2_AWS_37 | resource | aws_db_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 745 | CKV2_AWS_37 | resource | aws_db_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 746 | CKV2_AWS_37 | resource | aws_db_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 747 | CKV2_AWS_37 | resource | aws_default_network_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 748 | CKV2_AWS_37 | resource | aws_default_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 749 | CKV2_AWS_37 | resource | aws_default_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 750 | CKV2_AWS_37 | resource | aws_default_subnet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 751 | CKV2_AWS_37 | resource | aws_default_vpc | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 752 | CKV2_AWS_37 | resource | aws_default_vpc_dhcp_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 753 | CKV2_AWS_37 | resource | aws_devicefarm_project | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 754 | CKV2_AWS_37 | resource | aws_directory_service_conditional_forwarder | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 755 | CKV2_AWS_37 | resource | aws_directory_service_directory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 756 | CKV2_AWS_37 | resource | aws_directory_service_log_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 757 | CKV2_AWS_37 | resource | aws_dlm_lifecycle_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 758 | CKV2_AWS_37 | resource | aws_dms_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 759 | CKV2_AWS_37 | resource | aws_dms_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 760 | CKV2_AWS_37 | resource | aws_dms_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 761 | CKV2_AWS_37 | resource | aws_dms_replication_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 762 | CKV2_AWS_37 | resource | aws_dms_replication_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 763 | CKV2_AWS_37 | resource | aws_dms_replication_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 764 | CKV2_AWS_37 | resource | aws_docdb_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 765 | CKV2_AWS_37 | resource | aws_docdb_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 766 | CKV2_AWS_37 | resource | aws_docdb_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 767 | CKV2_AWS_37 | resource | aws_docdb_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 768 | CKV2_AWS_37 | resource | aws_docdb_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 769 | CKV2_AWS_37 | resource | aws_dx_bgp_peer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 770 | CKV2_AWS_37 | resource | aws_dx_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 771 | CKV2_AWS_37 | resource | aws_dx_connection_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 772 | CKV2_AWS_37 | resource | aws_dx_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 773 | CKV2_AWS_37 | resource | aws_dx_gateway_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 774 | CKV2_AWS_37 | resource | aws_dx_gateway_association_proposal | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 775 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 776 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 777 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 778 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 779 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 780 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 781 | CKV2_AWS_37 | resource | aws_dx_lag | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 782 | CKV2_AWS_37 | resource | aws_dx_private_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 783 | CKV2_AWS_37 | resource | aws_dx_public_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 784 | CKV2_AWS_37 | resource | aws_dx_transit_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 785 | CKV2_AWS_37 | resource | aws_dynamodb_global_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 786 | CKV2_AWS_37 | resource | aws_dynamodb_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 787 | CKV2_AWS_37 | resource | aws_dynamodb_table_item | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 788 | CKV2_AWS_37 | resource | aws_ebs_default_kms_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 789 | CKV2_AWS_37 | resource | aws_ebs_encryption_by_default | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 790 | CKV2_AWS_37 | resource | aws_ebs_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 791 | CKV2_AWS_37 | resource | aws_ebs_snapshot_copy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 792 | CKV2_AWS_37 | resource | aws_ebs_volume | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 793 | CKV2_AWS_37 | resource | aws_ec2_availability_zone_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 794 | CKV2_AWS_37 | resource | aws_ec2_capacity_reservation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 795 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_authorization_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 796 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 797 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_network_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 798 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 799 | CKV2_AWS_37 | resource | aws_ec2_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 800 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 801 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 802 | CKV2_AWS_37 | resource | aws_ec2_tag | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 803 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 804 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 805 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_session | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 806 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 807 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 808 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 809 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 810 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 811 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 812 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 813 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 814 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 815 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 816 | CKV2_AWS_37 | resource | aws_ecr_lifecycle_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 817 | CKV2_AWS_37 | resource | aws_ecr_repository | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 818 | CKV2_AWS_37 | resource | aws_ecr_repository_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 819 | CKV2_AWS_37 | resource | aws_ecs_capacity_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 820 | CKV2_AWS_37 | resource | aws_ecs_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 821 | CKV2_AWS_37 | resource | aws_ecs_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 822 | CKV2_AWS_37 | resource | aws_ecs_task_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 823 | CKV2_AWS_37 | resource | aws_efs_access_point | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 824 | CKV2_AWS_37 | resource | aws_efs_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 825 | CKV2_AWS_37 | resource | aws_efs_file_system_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 826 | CKV2_AWS_37 | resource | aws_efs_mount_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 827 | CKV2_AWS_37 | resource | aws_egress_only_internet_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 828 | CKV2_AWS_37 | resource | aws_eip | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 829 | CKV2_AWS_37 | resource | aws_eip_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 830 | CKV2_AWS_37 | resource | aws_eks_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 831 | CKV2_AWS_37 | resource | aws_eks_fargate_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 832 | CKV2_AWS_37 | resource | aws_eks_node_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 833 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 834 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 835 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_configuration_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 836 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_environment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 837 | CKV2_AWS_37 | resource | aws_elasticache_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 838 | CKV2_AWS_37 | resource | aws_elasticache_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 839 | CKV2_AWS_37 | resource | aws_elasticache_replication_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 840 | CKV2_AWS_37 | resource | aws_elasticache_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 841 | CKV2_AWS_37 | resource | aws_elasticache_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 842 | CKV2_AWS_37 | resource | aws_elasticsearch_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 843 | CKV2_AWS_37 | resource | aws_elasticsearch_domain_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 844 | CKV2_AWS_37 | resource | aws_elastictranscoder_pipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 845 | CKV2_AWS_37 | resource | aws_elastictranscoder_preset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 846 | CKV2_AWS_37 | resource | aws_elb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 847 | CKV2_AWS_37 | resource | aws_elb_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 848 | CKV2_AWS_37 | resource | aws_emr_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 849 | CKV2_AWS_37 | resource | aws_emr_instance_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 850 | CKV2_AWS_37 | resource | aws_emr_security_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 851 | CKV2_AWS_37 | resource | aws_flow_log | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 852 | CKV2_AWS_37 | resource | aws_fms_admin_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 853 | CKV2_AWS_37 | resource | aws_fsx_lustre_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 854 | CKV2_AWS_37 | resource | aws_fsx_windows_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 855 | CKV2_AWS_37 | resource | aws_gamelift_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 856 | CKV2_AWS_37 | resource | aws_gamelift_build | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 857 | CKV2_AWS_37 | resource | aws_gamelift_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 858 | CKV2_AWS_37 | resource | aws_gamelift_game_session_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 859 | CKV2_AWS_37 | resource | aws_glacier_vault | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 860 | CKV2_AWS_37 | resource | aws_glacier_vault_lock | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 861 | CKV2_AWS_37 | resource | aws_globalaccelerator_accelerator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 862 | CKV2_AWS_37 | resource | aws_globalaccelerator_endpoint_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 863 | CKV2_AWS_37 | resource | aws_globalaccelerator_listener | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 864 | CKV2_AWS_37 | resource | aws_glue_catalog_database | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 865 | CKV2_AWS_37 | resource | aws_glue_catalog_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 866 | CKV2_AWS_37 | resource | aws_glue_classifier | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 867 | CKV2_AWS_37 | resource | aws_glue_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 868 | CKV2_AWS_37 | resource | aws_glue_crawler | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 869 | CKV2_AWS_37 | resource | aws_glue_job | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 870 | CKV2_AWS_37 | resource | aws_glue_security_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 871 | CKV2_AWS_37 | resource | aws_glue_trigger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 872 | CKV2_AWS_37 | resource | aws_glue_workflow | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 873 | CKV2_AWS_37 | resource | aws_guardduty_detector | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 874 | CKV2_AWS_37 | resource | aws_guardduty_invite_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 875 | CKV2_AWS_37 | resource | aws_guardduty_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 876 | CKV2_AWS_37 | resource | aws_guardduty_member | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 877 | CKV2_AWS_37 | resource | aws_guardduty_organization_admin_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 878 | CKV2_AWS_37 | resource | aws_guardduty_organization_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 879 | CKV2_AWS_37 | resource | aws_guardduty_threatintelset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 880 | CKV2_AWS_37 | resource | aws_iam_access_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 881 | CKV2_AWS_37 | resource | aws_iam_account_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 882 | CKV2_AWS_37 | resource | aws_iam_account_password_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 883 | CKV2_AWS_37 | resource | aws_iam_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 884 | CKV2_AWS_37 | resource | aws_iam_group_membership | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 885 | CKV2_AWS_37 | resource | aws_iam_group_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 886 | CKV2_AWS_37 | resource | aws_iam_group_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 887 | CKV2_AWS_37 | resource | aws_iam_instance_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 888 | CKV2_AWS_37 | resource | aws_iam_openid_connect_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 889 | CKV2_AWS_37 | resource | aws_iam_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 890 | CKV2_AWS_37 | resource | aws_iam_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 891 | CKV2_AWS_37 | resource | aws_iam_policy_document | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 892 | CKV2_AWS_37 | resource | aws_iam_role | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 893 | CKV2_AWS_37 | resource | aws_iam_role_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 894 | CKV2_AWS_37 | resource | aws_iam_role_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 895 | CKV2_AWS_37 | resource | aws_iam_saml_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 896 | CKV2_AWS_37 | resource | aws_iam_server_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 897 | CKV2_AWS_37 | resource | aws_iam_service_linked_role | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 898 | CKV2_AWS_37 | resource | aws_iam_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 899 | CKV2_AWS_37 | resource | aws_iam_user_group_membership | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 900 | CKV2_AWS_37 | resource | aws_iam_user_login_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 901 | CKV2_AWS_37 | resource | aws_iam_user_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 902 | CKV2_AWS_37 | resource | aws_iam_user_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 903 | CKV2_AWS_37 | resource | aws_iam_user_ssh_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 904 | CKV2_AWS_37 | resource | aws_inspector_assessment_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 905 | CKV2_AWS_37 | resource | aws_inspector_assessment_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 906 | CKV2_AWS_37 | resource | aws_inspector_resource_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 907 | CKV2_AWS_37 | resource | aws_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 908 | CKV2_AWS_37 | resource | aws_internet_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 909 | CKV2_AWS_37 | resource | aws_iot_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 910 | CKV2_AWS_37 | resource | aws_iot_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 911 | CKV2_AWS_37 | resource | aws_iot_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 912 | CKV2_AWS_37 | resource | aws_iot_role_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 913 | CKV2_AWS_37 | resource | aws_iot_thing | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 914 | CKV2_AWS_37 | resource | aws_iot_thing_principal_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 915 | CKV2_AWS_37 | resource | aws_iot_thing_type | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 916 | CKV2_AWS_37 | resource | aws_iot_topic_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 917 | CKV2_AWS_37 | resource | aws_key_pair | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 918 | CKV2_AWS_37 | resource | aws_kinesis_analytics_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 919 | CKV2_AWS_37 | resource | aws_kinesis_firehose_delivery_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 920 | CKV2_AWS_37 | resource | aws_kinesis_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 921 | CKV2_AWS_37 | resource | aws_kinesis_video_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 922 | CKV2_AWS_37 | resource | aws_kms_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 923 | CKV2_AWS_37 | resource | aws_kms_ciphertext | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 924 | CKV2_AWS_37 | resource | aws_kms_external_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 925 | CKV2_AWS_37 | resource | aws_kms_grant | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 926 | CKV2_AWS_37 | resource | aws_kms_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 927 | CKV2_AWS_37 | resource | aws_lambda_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 928 | CKV2_AWS_37 | resource | aws_lambda_event_source_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 929 | CKV2_AWS_37 | resource | aws_lambda_function | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 930 | CKV2_AWS_37 | resource | aws_lambda_function_event_invoke_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 931 | CKV2_AWS_37 | resource | aws_lambda_layer_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 932 | CKV2_AWS_37 | resource | aws_lambda_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 933 | CKV2_AWS_37 | resource | aws_lambda_provisioned_concurrency_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 934 | CKV2_AWS_37 | resource | aws_launch_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 935 | CKV2_AWS_37 | resource | aws_launch_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 936 | CKV2_AWS_37 | resource | aws_lb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 937 | CKV2_AWS_37 | resource | aws_lb_cookie_stickiness_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 938 | CKV2_AWS_37 | resource | aws_lb_listener | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 939 | CKV2_AWS_37 | resource | aws_lb_listener_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 940 | CKV2_AWS_37 | resource | aws_lb_listener_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 941 | CKV2_AWS_37 | resource | aws_lb_ssl_negotiation_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 942 | CKV2_AWS_37 | resource | aws_lb_target_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 943 | CKV2_AWS_37 | resource | aws_lb_target_group_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 944 | CKV2_AWS_37 | resource | aws_licensemanager_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 945 | CKV2_AWS_37 | resource | aws_licensemanager_license_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 946 | CKV2_AWS_37 | resource | aws_lightsail_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 947 | CKV2_AWS_37 | resource | aws_lightsail_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 948 | CKV2_AWS_37 | resource | aws_lightsail_key_pair | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 949 | CKV2_AWS_37 | resource | aws_lightsail_static_ip | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 950 | CKV2_AWS_37 | resource | aws_lightsail_static_ip_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 951 | CKV2_AWS_37 | resource | aws_load_balancer_backend_server_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 952 | CKV2_AWS_37 | resource | aws_load_balancer_listener_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 953 | CKV2_AWS_37 | resource | aws_load_balancer_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 954 | CKV2_AWS_37 | resource | aws_macie_member_account_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 955 | CKV2_AWS_37 | resource | aws_macie_s3_bucket_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 956 | CKV2_AWS_37 | resource | aws_main_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 957 | CKV2_AWS_37 | resource | aws_media_convert_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 958 | CKV2_AWS_37 | resource | aws_media_package_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 959 | CKV2_AWS_37 | resource | aws_media_store_container | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 960 | CKV2_AWS_37 | resource | aws_media_store_container_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 961 | CKV2_AWS_37 | resource | aws_mq_broker | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 962 | CKV2_AWS_37 | resource | aws_mq_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 963 | CKV2_AWS_37 | resource | aws_msk_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 964 | CKV2_AWS_37 | resource | aws_msk_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 965 | CKV2_AWS_37 | resource | aws_nat_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 966 | CKV2_AWS_37 | resource | aws_neptune_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 967 | CKV2_AWS_37 | resource | aws_neptune_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 968 | CKV2_AWS_37 | resource | aws_neptune_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 969 | CKV2_AWS_37 | resource | aws_neptune_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 970 | CKV2_AWS_37 | resource | aws_neptune_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 971 | CKV2_AWS_37 | resource | aws_neptune_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 972 | CKV2_AWS_37 | resource | aws_neptune_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 973 | CKV2_AWS_37 | resource | aws_network_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 974 | CKV2_AWS_37 | resource | aws_network_acl_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 975 | CKV2_AWS_37 | resource | aws_network_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 976 | CKV2_AWS_37 | resource | aws_network_interface_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 977 | CKV2_AWS_37 | resource | aws_network_interface_sg_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 978 | CKV2_AWS_37 | resource | aws_opsworks_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 979 | CKV2_AWS_37 | resource | aws_opsworks_custom_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 980 | CKV2_AWS_37 | resource | aws_opsworks_ganglia_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 981 | CKV2_AWS_37 | resource | aws_opsworks_haproxy_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 982 | CKV2_AWS_37 | resource | aws_opsworks_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 983 | CKV2_AWS_37 | resource | aws_opsworks_java_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 984 | CKV2_AWS_37 | resource | aws_opsworks_memcached_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 985 | CKV2_AWS_37 | resource | aws_opsworks_mysql_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 986 | CKV2_AWS_37 | resource | aws_opsworks_nodejs_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 987 | CKV2_AWS_37 | resource | aws_opsworks_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 988 | CKV2_AWS_37 | resource | aws_opsworks_php_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 989 | CKV2_AWS_37 | resource | aws_opsworks_rails_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 990 | CKV2_AWS_37 | resource | aws_opsworks_rds_db_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 991 | CKV2_AWS_37 | resource | aws_opsworks_stack | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 992 | CKV2_AWS_37 | resource | aws_opsworks_static_web_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 993 | CKV2_AWS_37 | resource | aws_opsworks_user_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 994 | CKV2_AWS_37 | resource | aws_organizations_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 995 | CKV2_AWS_37 | resource | aws_organizations_organization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 996 | CKV2_AWS_37 | resource | aws_organizations_organizational_unit | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 997 | CKV2_AWS_37 | resource | aws_organizations_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 998 | CKV2_AWS_37 | resource | aws_organizations_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 999 | CKV2_AWS_37 | resource | aws_pinpoint_adm_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1000 | CKV2_AWS_37 | resource | aws_pinpoint_apns_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1001 | CKV2_AWS_37 | resource | aws_pinpoint_apns_sandbox_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1002 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1003 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1004 | CKV2_AWS_37 | resource | aws_pinpoint_app | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1005 | CKV2_AWS_37 | resource | aws_pinpoint_baidu_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1006 | CKV2_AWS_37 | resource | aws_pinpoint_email_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1007 | CKV2_AWS_37 | resource | aws_pinpoint_event_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1008 | CKV2_AWS_37 | resource | aws_pinpoint_gcm_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1009 | CKV2_AWS_37 | resource | aws_pinpoint_sms_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1010 | CKV2_AWS_37 | resource | aws_placement_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1011 | CKV2_AWS_37 | resource | aws_proxy_protocol_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1012 | CKV2_AWS_37 | resource | aws_qldb_ledger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1013 | CKV2_AWS_37 | resource | aws_quicksight_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1014 | CKV2_AWS_37 | resource | aws_quicksight_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1015 | CKV2_AWS_37 | resource | aws_ram_principal_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1016 | CKV2_AWS_37 | resource | aws_ram_resource_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1017 | CKV2_AWS_37 | resource | aws_ram_resource_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1018 | CKV2_AWS_37 | resource | aws_ram_resource_share_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1019 | CKV2_AWS_37 | resource | aws_rds_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1020 | CKV2_AWS_37 | resource | aws_rds_cluster_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1021 | CKV2_AWS_37 | resource | aws_rds_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1022 | CKV2_AWS_37 | resource | aws_rds_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1023 | CKV2_AWS_37 | resource | aws_rds_global_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1024 | CKV2_AWS_37 | resource | aws_redshift_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1025 | CKV2_AWS_37 | resource | aws_redshift_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1026 | CKV2_AWS_37 | resource | aws_redshift_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1027 | CKV2_AWS_37 | resource | aws_redshift_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1028 | CKV2_AWS_37 | resource | aws_redshift_snapshot_copy_grant | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1029 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1030 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1031 | CKV2_AWS_37 | resource | aws_redshift_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1032 | CKV2_AWS_37 | resource | aws_resourcegroups_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1033 | CKV2_AWS_37 | resource | aws_root | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1034 | CKV2_AWS_37 | resource | aws_root_access_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1035 | CKV2_AWS_37 | resource | aws_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1036 | CKV2_AWS_37 | resource | aws_route53_delegation_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1037 | CKV2_AWS_37 | resource | aws_route53_health_check | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1038 | CKV2_AWS_37 | resource | aws_route53_query_log | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1039 | CKV2_AWS_37 | resource | aws_route53_record | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1040 | CKV2_AWS_37 | resource | aws_route53_resolver_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1041 | CKV2_AWS_37 | resource | aws_route53_resolver_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1042 | CKV2_AWS_37 | resource | aws_route53_resolver_rule_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1043 | CKV2_AWS_37 | resource | aws_route53_vpc_association_authorization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1044 | CKV2_AWS_37 | resource | aws_route53_zone | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1045 | CKV2_AWS_37 | resource | aws_route53_zone_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1046 | CKV2_AWS_37 | resource | aws_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1047 | CKV2_AWS_37 | resource | aws_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1048 | CKV2_AWS_37 | resource | aws_s3_access_point | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1049 | CKV2_AWS_37 | resource | aws_s3_account_public_access_block | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1050 | CKV2_AWS_37 | resource | aws_s3_bucket | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1051 | CKV2_AWS_37 | resource | aws_s3_bucket_analytics_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1052 | CKV2_AWS_37 | resource | aws_s3_bucket_inventory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1053 | CKV2_AWS_37 | resource | aws_s3_bucket_metric | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1054 | CKV2_AWS_37 | resource | aws_s3_bucket_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1055 | CKV2_AWS_37 | resource | aws_s3_bucket_object | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1056 | CKV2_AWS_37 | resource | aws_s3_bucket_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1057 | CKV2_AWS_37 | resource | aws_s3_bucket_public_access_block | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1058 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1059 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1060 | CKV2_AWS_37 | resource | aws_sagemaker_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1061 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1062 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1063 | CKV2_AWS_37 | resource | aws_secretsmanager_secret | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1064 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_rotation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1065 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1066 | CKV2_AWS_37 | resource | aws_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1067 | CKV2_AWS_37 | resource | aws_security_group_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1068 | CKV2_AWS_37 | resource | aws_securityhub_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1069 | CKV2_AWS_37 | resource | aws_securityhub_member | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1070 | CKV2_AWS_37 | resource | aws_securityhub_product_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1071 | CKV2_AWS_37 | resource | aws_securityhub_standards_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1072 | CKV2_AWS_37 | resource | aws_service_discovery_http_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1073 | CKV2_AWS_37 | resource | aws_service_discovery_private_dns_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1074 | CKV2_AWS_37 | resource | aws_service_discovery_public_dns_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1075 | CKV2_AWS_37 | resource | aws_service_discovery_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1076 | CKV2_AWS_37 | resource | aws_servicecatalog_portfolio | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1077 | CKV2_AWS_37 | resource | aws_servicequotas_service_quota | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1078 | CKV2_AWS_37 | resource | aws_ses_active_receipt_rule_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1079 | CKV2_AWS_37 | resource | aws_ses_configuration_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1080 | CKV2_AWS_37 | resource | aws_ses_domain_dkim | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1081 | CKV2_AWS_37 | resource | aws_ses_domain_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1082 | CKV2_AWS_37 | resource | aws_ses_domain_identity_verification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1083 | CKV2_AWS_37 | resource | aws_ses_domain_mail_from | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1084 | CKV2_AWS_37 | resource | aws_ses_email_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1085 | CKV2_AWS_37 | resource | aws_ses_event_destination | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1086 | CKV2_AWS_37 | resource | aws_ses_identity_notification_topic | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1087 | CKV2_AWS_37 | resource | aws_ses_identity_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1088 | CKV2_AWS_37 | resource | aws_ses_receipt_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1089 | CKV2_AWS_37 | resource | aws_ses_receipt_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1090 | CKV2_AWS_37 | resource | aws_ses_receipt_rule_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1091 | CKV2_AWS_37 | resource | aws_ses_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1092 | CKV2_AWS_37 | resource | aws_sfn_activity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1093 | CKV2_AWS_37 | resource | aws_sfn_state_machine | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1094 | CKV2_AWS_37 | resource | aws_shield_protection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1095 | CKV2_AWS_37 | resource | aws_simpledb_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1096 | CKV2_AWS_37 | resource | aws_snapshot_create_volume_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1097 | CKV2_AWS_37 | resource | aws_sns_platform_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1098 | CKV2_AWS_37 | resource | aws_sns_sms_preferences | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1099 | CKV2_AWS_37 | resource | aws_sns_topic | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1100 | CKV2_AWS_37 | resource | aws_sns_topic_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1101 | CKV2_AWS_37 | resource | aws_sns_topic_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1102 | CKV2_AWS_37 | resource | aws_spot_datafeed_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1103 | CKV2_AWS_37 | resource | aws_spot_fleet_request | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1104 | CKV2_AWS_37 | resource | aws_spot_instance_request | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1105 | CKV2_AWS_37 | resource | aws_sqs_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1106 | CKV2_AWS_37 | resource | aws_sqs_queue_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1107 | CKV2_AWS_37 | resource | aws_ssm_activation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1108 | CKV2_AWS_37 | resource | aws_ssm_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1109 | CKV2_AWS_37 | resource | aws_ssm_document | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1110 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1111 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1112 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1113 | CKV2_AWS_37 | resource | aws_ssm_parameter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1114 | CKV2_AWS_37 | resource | aws_ssm_patch_baseline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1115 | CKV2_AWS_37 | resource | aws_ssm_patch_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1116 | CKV2_AWS_37 | resource | aws_ssm_resource_data_sync | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1117 | CKV2_AWS_37 | resource | aws_storagegateway_cache | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1118 | CKV2_AWS_37 | resource | aws_storagegateway_cached_iscsi_volume | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1119 | CKV2_AWS_37 | resource | aws_storagegateway_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1120 | CKV2_AWS_37 | resource | aws_storagegateway_nfs_file_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1121 | CKV2_AWS_37 | resource | aws_storagegateway_smb_file_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1122 | CKV2_AWS_37 | resource | aws_storagegateway_upload_buffer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1123 | CKV2_AWS_37 | resource | aws_storagegateway_working_storage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1124 | CKV2_AWS_37 | resource | aws_subnet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1125 | CKV2_AWS_37 | resource | aws_swf_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1126 | CKV2_AWS_37 | resource | aws_transfer_server | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1127 | CKV2_AWS_37 | resource | aws_transfer_ssh_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1128 | CKV2_AWS_37 | resource | aws_transfer_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1129 | CKV2_AWS_37 | resource | aws_volume_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1130 | CKV2_AWS_37 | resource | aws_vpc | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1131 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1132 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1133 | CKV2_AWS_37 | resource | aws_vpc_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1134 | CKV2_AWS_37 | resource | aws_vpc_endpoint_connection_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1135 | CKV2_AWS_37 | resource | aws_vpc_endpoint_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1136 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1137 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1138 | CKV2_AWS_37 | resource | aws_vpc_endpoint_subnet_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1139 | CKV2_AWS_37 | resource | aws_vpc_ipv4_cidr_block_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1140 | CKV2_AWS_37 | resource | aws_vpc_peering_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1141 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1142 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1143 | CKV2_AWS_37 | resource | aws_vpn_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1144 | CKV2_AWS_37 | resource | aws_vpn_connection_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1145 | CKV2_AWS_37 | resource | aws_vpn_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1146 | CKV2_AWS_37 | resource | aws_vpn_gateway_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1147 | CKV2_AWS_37 | resource | aws_vpn_gateway_route_propagation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1148 | CKV2_AWS_37 | resource | aws_waf_byte_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1149 | CKV2_AWS_37 | resource | aws_waf_geo_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1150 | CKV2_AWS_37 | resource | aws_waf_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1151 | CKV2_AWS_37 | resource | aws_waf_rate_based_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1152 | CKV2_AWS_37 | resource | aws_waf_regex_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1153 | CKV2_AWS_37 | resource | aws_waf_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1154 | CKV2_AWS_37 | resource | aws_waf_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1155 | CKV2_AWS_37 | resource | aws_waf_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1156 | CKV2_AWS_37 | resource | aws_waf_size_constraint_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1157 | CKV2_AWS_37 | resource | aws_waf_sql_injection_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1158 | CKV2_AWS_37 | resource | aws_waf_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1159 | CKV2_AWS_37 | resource | aws_waf_xss_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1160 | CKV2_AWS_37 | resource | aws_wafregional_byte_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1161 | CKV2_AWS_37 | resource | aws_wafregional_geo_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1162 | CKV2_AWS_37 | resource | aws_wafregional_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1163 | CKV2_AWS_37 | resource | aws_wafregional_rate_based_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1164 | CKV2_AWS_37 | resource | aws_wafregional_regex_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1165 | CKV2_AWS_37 | resource | aws_wafregional_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1166 | CKV2_AWS_37 | resource | aws_wafregional_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1167 | CKV2_AWS_37 | resource | aws_wafregional_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1168 | CKV2_AWS_37 | resource | aws_wafregional_size_constraint_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1169 | CKV2_AWS_37 | resource | aws_wafregional_sql_injection_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1170 | CKV2_AWS_37 | resource | aws_wafregional_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1171 | CKV2_AWS_37 | resource | aws_wafregional_web_acl_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1172 | CKV2_AWS_37 | resource | aws_wafregional_xss_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1173 | CKV2_AWS_37 | resource | aws_wafv2_ip_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1174 | CKV2_AWS_37 | resource | aws_wafv2_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1175 | CKV2_AWS_37 | resource | aws_wafv2_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1176 | CKV2_AWS_37 | resource | aws_wafv2_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1177 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1178 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_logging_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1179 | CKV2_AWS_37 | resource | aws_worklink_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1180 | CKV2_AWS_37 | resource | aws_worklink_website_certificate_authority_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1181 | CKV2_AWS_37 | resource | aws_workspaces_directory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1182 | CKV2_AWS_37 | resource | aws_workspaces_ip_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1183 | CKV2_AWS_37 | resource | aws_workspaces_workspace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1184 | CKV2_AWS_37 | resource | aws_xray_sampling_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1185 | CKV2_AWS_38 | resource | aws_route53_zone | Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1186 | CKV2_AWS_39 | resource | aws_route53_zone | Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1187 | CKV2_AWS_40 | resource | aws_iam_group_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1188 | CKV2_AWS_40 | resource | aws_iam_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1189 | CKV2_AWS_40 | resource | aws_iam_role_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1190 | CKV2_AWS_40 | resource | aws_iam_user_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1191 | CKV2_AWS_40 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1192 | CKV2_AWS_40 | resource | data.aws_iam_policy_document | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1193 | CKV2_AWS_41 | resource | aws_instance | Ensure an IAM role is attached to EC2 instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1194 | CKV2_AWS_42 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront distribution uses custom SSL certificate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1195 | CKV2_AWS_43 | resource | aws_s3_bucket_acl | Ensure S3 Bucket does not allow access to all Authenticated users | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1196 | CKV2_AWS_44 | resource | aws_route | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1197 | CKV2_AWS_44 | resource | aws_route_table | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1198 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1199 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1200 | CKV_AZURE_1 | resource | azurerm_linux_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1201 | CKV_AZURE_1 | resource | azurerm_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1202 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1203 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1204 | CKV_AZURE_2 | resource | azurerm_managed_disk | Ensure Azure managed disk has encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1205 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1206 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1207 | CKV_AZURE_3 | resource | azurerm_storage_account | Ensure that 'Secure transfer required' is set to 'Enabled' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1208 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1209 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1210 | CKV_AZURE_4 | resource | azurerm_kubernetes_cluster | Ensure AKS logging to Azure Monitoring is Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1211 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1212 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1213 | CKV_AZURE_5 | resource | azurerm_kubernetes_cluster | Ensure RBAC is enabled on AKS clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1214 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1215 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1216 | CKV_AZURE_6 | resource | azurerm_kubernetes_cluster | Ensure AKS has an API Server Authorized IP Ranges enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1217 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1218 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1219 | CKV_AZURE_7 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster has Network Policy configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1220 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1221 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1222 | CKV_AZURE_8 | resource | azurerm_kubernetes_cluster | Ensure Kubernetes Dashboard is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1223 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1224 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1225 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1226 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1227 | CKV_AZURE_9 | resource | azurerm_network_security_group | Ensure that RDP access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1228 | CKV_AZURE_9 | resource | azurerm_network_security_rule | Ensure that RDP access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1229 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1230 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1231 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1232 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1233 | CKV_AZURE_10 | resource | azurerm_network_security_group | Ensure that SSH access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1234 | CKV_AZURE_10 | resource | azurerm_network_security_rule | Ensure that SSH access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1235 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1236 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1237 | CKV_AZURE_11 | resource | azurerm_mariadb_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1238 | CKV_AZURE_11 | resource | azurerm_mysql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1239 | CKV_AZURE_11 | resource | azurerm_postgresql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1240 | CKV_AZURE_11 | resource | azurerm_sql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1241 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1242 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1243 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1244 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1245 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1246 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1247 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1248 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1249 | CKV_AZURE_12 | resource | azurerm_network_watcher_flow_log | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1250 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1251 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1252 | CKV_AZURE_13 | resource | azurerm_app_service | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1253 | CKV_AZURE_13 | resource | azurerm_linux_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1254 | CKV_AZURE_13 | resource | azurerm_windows_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1255 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1256 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1257 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1258 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1259 | CKV_AZURE_14 | resource | azurerm_app_service | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1260 | CKV_AZURE_14 | resource | azurerm_linux_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1261 | CKV_AZURE_14 | resource | azurerm_windows_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1262 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1263 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1264 | CKV_AZURE_15 | resource | azurerm_app_service | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1265 | CKV_AZURE_15 | resource | azurerm_linux_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1266 | CKV_AZURE_15 | resource | azurerm_windows_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1267 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1268 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1269 | CKV_AZURE_16 | resource | azurerm_app_service | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1270 | CKV_AZURE_16 | resource | azurerm_linux_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1271 | CKV_AZURE_16 | resource | azurerm_windows_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1272 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1273 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1274 | CKV_AZURE_17 | resource | azurerm_app_service | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1275 | CKV_AZURE_17 | resource | azurerm_linux_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1276 | CKV_AZURE_17 | resource | azurerm_windows_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1277 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1278 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1279 | CKV_AZURE_18 | resource | azurerm_app_service | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1280 | CKV_AZURE_18 | resource | azurerm_linux_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1281 | CKV_AZURE_18 | resource | azurerm_windows_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1282 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1283 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1284 | CKV_AZURE_19 | resource | azurerm_security_center_subscription_pricing | Ensure that standard pricing tier is selected | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1285 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1286 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1287 | CKV_AZURE_20 | resource | azurerm_security_center_contact | Ensure that security contact 'Phone number' is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1288 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1289 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1290 | CKV_AZURE_21 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1291 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1292 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1293 | CKV_AZURE_22 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1294 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1295 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1296 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1297 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1298 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1299 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1300 | CKV_AZURE_23 | resource | azurerm_mssql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1301 | CKV_AZURE_23 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1302 | CKV_AZURE_23 | resource | azurerm_sql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1303 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1304 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1305 | CKV_AZURE_24 | resource | azurerm_mssql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1306 | CKV_AZURE_24 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1307 | CKV_AZURE_24 | resource | azurerm_sql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1308 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1309 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1310 | CKV_AZURE_25 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Threat Detection types' is set to 'All' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1311 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1312 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1313 | CKV_AZURE_26 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1314 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1315 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1316 | CKV_AZURE_27 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1317 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1318 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1319 | CKV_AZURE_28 | resource | azurerm_mysql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1320 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1321 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1322 | CKV_AZURE_29 | resource | azurerm_postgresql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1323 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1324 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1325 | CKV_AZURE_30 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1326 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1327 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1328 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1329 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1330 | CKV_AZURE_31 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1331 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1332 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1333 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1334 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1335 | CKV_AZURE_32 | resource | azurerm_postgresql_configuration | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1336 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1337 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1338 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1339 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1340 | CKV_AZURE_33 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1341 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1342 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1343 | CKV_AZURE_34 | resource | azurerm_storage_container | Ensure that 'Public access level' is set to Private for blob containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1344 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1345 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1346 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1347 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1348 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1349 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1350 | CKV_AZURE_35 | resource | azurerm_storage_account | Ensure default network access rule for Storage Accounts is set to deny | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1351 | CKV_AZURE_35 | resource | azurerm_storage_account_network_rules | Ensure default network access rule for Storage Accounts is set to deny | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1352 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1353 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1354 | CKV_AZURE_36 | resource | azurerm_storage_account | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1355 | CKV_AZURE_36 | resource | azurerm_storage_account_network_rules | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1356 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1357 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1358 | CKV_AZURE_37 | resource | azurerm_monitor_log_profile | Ensure that Activity Log Retention is set 365 days or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1359 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1360 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1361 | CKV_AZURE_38 | resource | azurerm_monitor_log_profile | Ensure audit profile captures all the activities | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1362 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1363 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1364 | CKV_AZURE_39 | resource | azurerm_role_definition | Ensure that no custom subscription owner roles are created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1365 | CKV_AZURE_40 | resource | azurerm_key_vault_key | Ensure that the expiration date is set on all keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1366 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1367 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1368 | CKV_AZURE_41 | resource | azurerm_key_vault_secret | Ensure that the expiration date is set on all secrets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1369 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1370 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1371 | CKV_AZURE_42 | resource | azurerm_key_vault | Ensure the key vault is recoverable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1372 | CKV_AZURE_43 | resource | azurerm_storage_account | Ensure Storage Accounts adhere to the naming rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1373 | CKV_AZURE_44 | resource | azurerm_storage_account | Ensure Storage Account is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1374 | CKV_AZURE_45 | resource | azurerm_virtual_machine | Ensure that no sensitive credentials are exposed in VM custom_data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1375 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1376 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1377 | CKV_AZURE_47 | resource | azurerm_mariadb_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1378 | CKV_AZURE_48 | resource | azurerm_mariadb_server | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1379 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1380 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1381 | CKV_AZURE_49 | resource | azurerm_linux_virtual_machine_scale_set | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1382 | CKV_AZURE_50 | resource | azurerm_linux_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1383 | CKV_AZURE_50 | resource | azurerm_windows_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1384 | CKV_AZURE_52 | resource | azurerm_mssql_server | Ensure MSSQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1385 | CKV_AZURE_53 | resource | azurerm_mysql_server | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1386 | CKV_AZURE_54 | resource | azurerm_mysql_server | Ensure MySQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1387 | CKV_AZURE_55 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1388 | CKV_AZURE_56 | resource | azurerm_function_app | Ensure that function apps enables Authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1389 | CKV_AZURE_57 | resource | azurerm_app_service | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1390 | CKV_AZURE_57 | resource | azurerm_linux_web_app | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1391 | CKV_AZURE_57 | resource | azurerm_windows_web_app | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1392 | CKV_AZURE_58 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces enables managed virtual networks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1393 | CKV_AZURE_59 | resource | azurerm_storage_account | Ensure that Storage accounts disallow public access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1394 | CKV_AZURE_61 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1395 | CKV_AZURE_62 | resource | azurerm_function_app | Ensure function apps are not accessible from all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1396 | CKV_AZURE_63 | resource | azurerm_app_service | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1397 | CKV_AZURE_63 | resource | azurerm_linux_web_app | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1398 | CKV_AZURE_63 | resource | azurerm_windows_web_app | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1399 | CKV_AZURE_64 | resource | azurerm_storage_sync | Ensure that Azure File Sync disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1400 | CKV_AZURE_65 | resource | azurerm_app_service | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1401 | CKV_AZURE_65 | resource | azurerm_linux_web_app | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1402 | CKV_AZURE_65 | resource | azurerm_windows_web_app | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1403 | CKV_AZURE_66 | resource | azurerm_app_service | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1404 | CKV_AZURE_66 | resource | azurerm_linux_web_app | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1405 | CKV_AZURE_66 | resource | azurerm_windows_web_app | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1406 | CKV_AZURE_67 | resource | azurerm_function_app | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1407 | CKV_AZURE_67 | resource | azurerm_function_app_slot | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1408 | CKV_AZURE_68 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1409 | CKV_AZURE_69 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Azure SQL database servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1410 | CKV_AZURE_70 | resource | azurerm_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1411 | CKV_AZURE_71 | resource | azurerm_app_service | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1412 | CKV_AZURE_71 | resource | azurerm_linux_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1413 | CKV_AZURE_71 | resource | azurerm_windows_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1414 | CKV_AZURE_72 | resource | azurerm_app_service | Ensure that remote debugging is not enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1415 | CKV_AZURE_73 | resource | azurerm_automation_variable_bool | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1416 | CKV_AZURE_73 | resource | azurerm_automation_variable_datetime | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1417 | CKV_AZURE_73 | resource | azurerm_automation_variable_int | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1418 | CKV_AZURE_73 | resource | azurerm_automation_variable_string | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1419 | CKV_AZURE_74 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses disk encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1420 | CKV_AZURE_75 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses double encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1421 | CKV_AZURE_76 | resource | azurerm_batch_account | Ensure that Azure Batch account uses key vault to encrypt data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1422 | CKV_AZURE_77 | resource | azurerm_network_security_group | Ensure that UDP Services are restricted from the Internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1423 | CKV_AZURE_77 | resource | azurerm_network_security_rule | Ensure that UDP Services are restricted from the Internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1424 | CKV_AZURE_78 | resource | azurerm_app_service | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1425 | CKV_AZURE_78 | resource | azurerm_linux_web_app | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1426 | CKV_AZURE_78 | resource | azurerm_windows_web_app | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1427 | CKV_AZURE_79 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for SQL servers on machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1428 | CKV_AZURE_80 | resource | azurerm_app_service | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1429 | CKV_AZURE_81 | resource | azurerm_app_service | Ensure that 'PHP version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1430 | CKV_AZURE_82 | resource | azurerm_app_service | Ensure that 'Python version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1431 | CKV_AZURE_83 | resource | azurerm_app_service | Ensure that 'Java version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1432 | CKV_AZURE_84 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Storage | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1433 | CKV_AZURE_85 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Kubernetes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1434 | CKV_AZURE_86 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Container Registries | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1435 | CKV_AZURE_87 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Key Vault | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1436 | CKV_AZURE_88 | resource | azurerm_app_service | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1437 | CKV_AZURE_88 | resource | azurerm_linux_web_app | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1438 | CKV_AZURE_88 | resource | azurerm_windows_web_app | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1439 | CKV_AZURE_89 | resource | azurerm_redis_cache | Ensure that Azure Cache for Redis disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1440 | CKV_AZURE_91 | resource | azurerm_redis_cache | Ensure that only SSL are enabled for Cache for Redis | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1441 | CKV_AZURE_92 | resource | azurerm_linux_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1442 | CKV_AZURE_92 | resource | azurerm_windows_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1443 | CKV_AZURE_93 | resource | azurerm_managed_disk | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1444 | CKV_AZURE_94 | resource | azurerm_mysql_server | Ensure that My SQL server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1445 | CKV_AZURE_95 | resource | azurerm_virtual_machine_scale_set | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1446 | CKV_AZURE_96 | resource | azurerm_mysql_server | Ensure that MySQL server enables infrastructure encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1447 | CKV_AZURE_97 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1448 | CKV_AZURE_97 | resource | azurerm_windows_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1449 | CKV_AZURE_98 | resource | azurerm_container_group | Ensure that Azure Container group is deployed into virtual network | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1450 | CKV_AZURE_99 | resource | azurerm_cosmosdb_account | Ensure Cosmos DB accounts have restricted access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1451 | CKV_AZURE_100 | resource | azurerm_cosmosdb_account | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1452 | CKV_AZURE_101 | resource | azurerm_cosmosdb_account | Ensure that Azure Cosmos DB disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1453 | CKV_AZURE_102 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1454 | CKV_AZURE_103 | resource | azurerm_data_factory | Ensure that Azure Data Factory uses Git repository for source control | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1455 | CKV_AZURE_104 | resource | azurerm_data_factory | Ensure that Azure Data factory public network access is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1456 | CKV_AZURE_105 | resource | azurerm_data_lake_store | Ensure that Data Lake Store accounts enables encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1457 | CKV_AZURE_106 | resource | azurerm_eventgrid_domain | Ensure that Azure Event Grid Domain public network access is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1458 | CKV_AZURE_107 | resource | azurerm_api_management | Ensure that API management services use virtual networks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1459 | CKV_AZURE_108 | resource | azurerm_iothub | Ensure that Azure IoT Hub disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1460 | CKV_AZURE_109 | resource | azurerm_key_vault | Ensure that key vault allows firewall rules settings | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1461 | CKV_AZURE_110 | resource | azurerm_key_vault | Ensure that key vault enables purge protection | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1462 | CKV_AZURE_111 | resource | azurerm_key_vault | Ensure that key vault enables soft delete | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1463 | CKV_AZURE_112 | resource | azurerm_key_vault_key | Ensure that key vault key is backed by HSM | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1464 | CKV_AZURE_113 | resource | azurerm_mssql_server | Ensure that SQL server disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1465 | CKV_AZURE_114 | resource | azurerm_key_vault_secret | Ensure that key vault secrets have "content_type" set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1466 | CKV_AZURE_115 | resource | azurerm_kubernetes_cluster | Ensure that AKS enables private clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1467 | CKV_AZURE_116 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses Azure Policies Add-on | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1468 | CKV_AZURE_117 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses disk encryption set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1469 | CKV_AZURE_118 | resource | azurerm_network_interface | Ensure that Network Interfaces disable IP forwarding | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1470 | CKV_AZURE_119 | resource | azurerm_network_interface | Ensure that Network Interfaces don't use public IPs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1471 | CKV_AZURE_120 | resource | azurerm_application_gateway | Ensure that Application Gateway enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1472 | CKV_AZURE_120 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1473 | CKV_AZURE_121 | resource | azurerm_frontdoor | Ensure that Azure Front Door enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1474 | CKV_AZURE_122 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway uses WAF in "Detection" or "Prevention" modes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1475 | CKV_AZURE_123 | resource | azurerm_frontdoor_firewall_policy | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1476 | CKV_AZURE_124 | resource | azurerm_search_service | Ensure that Azure Cognitive Search disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1477 | CKV_AZURE_125 | resource | azurerm_service_fabric_cluster | Ensures that Service Fabric use three levels of protection available | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1478 | CKV_AZURE_126 | resource | azurerm_service_fabric_cluster | Ensures that Active Directory is used for authentication for Service Fabric | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1479 | CKV_AZURE_127 | resource | azurerm_mysql_server | Ensure that My SQL server enables Threat detection policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1480 | CKV_AZURE_128 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables Threat detection policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1481 | CKV_AZURE_129 | resource | azurerm_mariadb_server | Ensure that MariaDB server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1482 | CKV_AZURE_130 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables infrastructure encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1483 | CKV_AZURE_131 | resource | azurerm_security_center_contact | Ensure that 'Security contact emails' is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1484 | CKV_AZURE_131 | parameter | secureString | SecureString parameter should not have hardcoded default values | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1485 | CKV_AZURE_131 | parameter | string | SecureString parameter should not have hardcoded default values | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1486 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1487 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1488 | CKV_AZURE_132 | resource | azurerm_cosmosdb_account | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1489 | CKV_AZURE_133 | resource | azurerm_frontdoor_firewall_policy | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1490 | CKV_AZURE_134 | resource | azurerm_cognitive_account | Ensure that Cognitive Services accounts disable public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1491 | CKV_AZURE_135 | resource | azurerm_web_application_firewall_policy | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1492 | CKV_AZURE_136 | resource | azurerm_postgresql_flexible_server | Ensure that PostgreSQL Flexible server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1493 | CKV_AZURE_137 | resource | azurerm_container_registry | Ensure ACR admin account is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1494 | CKV_AZURE_138 | resource | azurerm_container_registry | Ensures that ACR disables anonymous pulling of images | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1495 | CKV_AZURE_139 | resource | azurerm_container_registry | Ensure ACR set to disable public networking | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1496 | CKV_AZURE_140 | resource | azurerm_cosmosdb_account | Ensure that Local Authentication is disabled on CosmosDB | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1497 | CKV_AZURE_141 | resource | azurerm_kubernetes_cluster | Ensure AKS local admin account is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1498 | CKV_AZURE_142 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Local Authentication is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1499 | CKV_AZURE_143 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster nodes do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1500 | CKV_AZURE_144 | resource | azurerm_machine_learning_workspace | Ensure that Public Access is disabled for Machine Learning Workspace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1501 | CKV_AZURE_145 | resource | azurerm_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1502 | CKV_AZURE_146 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1503 | CKV_AZURE_147 | resource | azurerm_postgresql_server | Ensure PostgreSQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1504 | CKV_AZURE_148 | resource | azurerm_redis_cache | Ensure Redis Cache is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1505 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine | Ensure that Virtual machine does not enable password authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1506 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine does not enable password authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1507 | CKV_AZURE_150 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1508 | CKV_AZURE_151 | resource | azurerm_windows_virtual_machine | Ensure Windows VM enables encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1509 | CKV_AZURE_152 | resource | azurerm_api_management | Ensure Client Certificates are enforced for API management | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1510 | CKV_AZURE_153 | resource | azurerm_app_service_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1511 | CKV_AZURE_154 | resource | azurerm_app_service_slot | Ensure the App service slot is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1512 | CKV_AZURE_155 | resource | azurerm_app_service_slot | Ensure debugging is disabled for the App service slot | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1513 | CKV_AZURE_156 | resource | azurerm_mssql_database_extended_auditing_policy | Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1514 | CKV_AZURE_157 | resource | azurerm_synapse_workspace | Ensure that Synapse workspace has data_exfiltration_protection_enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1515 | CKV_AZURE_158 | resource | azurerm_databricks_workspace | Ensure that databricks workspace has not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1516 | CKV_AZURE_159 | resource | azurerm_function_app | Ensure function app builtin logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1517 | CKV_AZURE_159 | resource | azurerm_function_app_slot | Ensure function app builtin logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1518 | CKV_AZURE_160 | resource | azurerm_network_security_group | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1519 | CKV_AZURE_160 | resource | azurerm_network_security_rule | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1520 | CKV_AZURE_161 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal is enabled on for HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1521 | CKV_AZURE_162 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal Public Access Is Disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1522 | CKV_AZURE_163 | resource | azurerm_container_registry | Enable vulnerability scanning for container images. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1523 | CKV_AZURE_164 | resource | azurerm_container_registry | Ensures that ACR uses signed/trusted images | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1524 | CKV_AZURE_165 | resource | azurerm_container_registry | Ensure geo-replicated container registries to match multi-region container deployments. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1525 | CKV_AZURE_166 | resource | azurerm_container_registry | Ensure container image quarantine, scan, and mark images verified | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1526 | CKV_AZURE_167 | resource | azurerm_container_registry | Ensure a retention policy is set to cleanup untagged manifests. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1527 | CKV2_AZURE_1 | resource | azurerm_storage_account | Ensure storage for critical data are encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1528 | CKV2_AZURE_2 | resource | azurerm_mssql_server_security_alert_policy | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1529 | CKV2_AZURE_2 | resource | azurerm_sql_server | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1530 | CKV2_AZURE_3 | resource | azurerm_mssql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1531 | CKV2_AZURE_3 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1532 | CKV2_AZURE_3 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1533 | CKV2_AZURE_3 | resource | azurerm_sql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1534 | CKV2_AZURE_4 | resource | azurerm_mssql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1535 | CKV2_AZURE_4 | resource | azurerm_mssql_server_security_alert_policy | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1536 | CKV2_AZURE_4 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1537 | CKV2_AZURE_4 | resource | azurerm_sql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1538 | CKV2_AZURE_5 | resource | azurerm_mssql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1539 | CKV2_AZURE_5 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1540 | CKV2_AZURE_5 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1541 | CKV2_AZURE_5 | resource | azurerm_sql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1542 | CKV2_AZURE_6 | resource | azurerm_sql_firewall_rule | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1543 | CKV2_AZURE_6 | resource | azurerm_sql_server | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1544 | CKV2_AZURE_7 | resource | azurerm_sql_server | Ensure that Azure Active Directory Admin is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1545 | CKV2_AZURE_8 | resource | azurerm_monitor_activity_log_alert | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1546 | CKV2_AZURE_8 | resource | azurerm_storage_account | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1547 | CKV2_AZURE_8 | resource | azurerm_storage_container | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1548 | CKV2_AZURE_9 | resource | azurerm_virtual_machine | Ensure Virtual Machines are utilizing Managed Disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1549 | CKV2_AZURE_10 | resource | azurerm_virtual_machine | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1550 | CKV2_AZURE_10 | resource | azurerm_virtual_machine_extension | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1551 | CKV2_AZURE_11 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer encryption at rest uses a customer-managed key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1552 | CKV2_AZURE_12 | resource | azurerm_virtual_machine | Ensure that virtual machines are backed up using Azure Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1553 | CKV2_AZURE_13 | resource | azurerm_mssql_server_security_alert_policy | Ensure that sql servers enables data security policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1554 | CKV2_AZURE_13 | resource | azurerm_sql_server | Ensure that sql servers enables data security policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1555 | CKV2_AZURE_14 | resource | azurerm_managed_disk | Ensure that Unattached disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1556 | CKV2_AZURE_14 | resource | azurerm_virtual_machine | Ensure that Unattached disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1557 | CKV2_AZURE_15 | resource | azurerm_data_factory | Ensure that Azure data factories are encrypted with a customer-managed key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1558 | CKV2_AZURE_16 | resource | azurerm_mysql_server | Ensure that MySQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1559 | CKV2_AZURE_16 | resource | azurerm_mysql_server_key | Ensure that MySQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1560 | CKV2_AZURE_17 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1561 | CKV2_AZURE_17 | resource | azurerm_postgresql_server_key | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1562 | CKV2_AZURE_18 | resource | azurerm_storage_account | Ensure that Storage Accounts use customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1563 | CKV2_AZURE_18 | resource | azurerm_storage_account_customer_managed_key | Ensure that Storage Accounts use customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1564 | CKV2_AZURE_19 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1565 | CKV2_AZURE_20 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1566 | CKV2_AZURE_20 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1567 | CKV2_AZURE_20 | resource | azurerm_storage_table | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1568 | CKV2_AZURE_21 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1569 | CKV2_AZURE_21 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1570 | CKV2_AZURE_21 | resource | azurerm_storage_container | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1571 | CKV2_AZURE_22 | resource | azurerm_cognitive_account | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1572 | CKV2_AZURE_22 | resource | azurerm_cognitive_account_customer_managed_key | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1573 | CKV_AZUREPIPELINES_1 | azure_pipelines | jobs | Ensure container job uses a non latest version tag | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1574 | CKV_AZUREPIPELINES_1 | azure_pipelines | stages[].jobs[] | Ensure container job uses a non latest version tag | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1575 | CKV_AZUREPIPELINES_2 | azure_pipelines | jobs | Ensure container job uses a version digest | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1576 | CKV_AZUREPIPELINES_2 | azure_pipelines | stages[].jobs[] | Ensure container job uses a version digest | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1577 | CKV_AZUREPIPELINES_3 | azure_pipelines | jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1578 | CKV_AZUREPIPELINES_3 | azure_pipelines | stages[].jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1579 | CKV_BCW_1 | provider | bridgecrew | Ensure no hard coded API token exist in the provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1580 | CKV_BITBUCKET_1 | bitbucket_configuration | * | Merge requests should require at least 2 approvals | bitbucket_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1581 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | [{image:image,__startline__:__startline__,__endline__:__endline__}] | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1582 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.*.[*][][][].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1583 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.default[].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1584 | CKV_CIRCLECIPIPELINES_1 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1585 | CKV_CIRCLECIPIPELINES_2 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image version is referenced via hash not arbitrary tag. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1586 | CKV_CIRCLECIPIPELINES_3 | circleci_pipelines | orbs.{orbs: @} | Ensure mutable development orbs are not used. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1587 | CKV_CIRCLECIPIPELINES_4 | circleci_pipelines | orbs.{orbs: @} | Ensure unversioned volatile orbs are not used. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1588 | CKV_CIRCLECIPIPELINES_5 | circleci_pipelines | jobs.*.steps[] | Suspicious use of netcat with IP address | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1589 | CKV_CIRCLECIPIPELINES_6 | circleci_pipelines | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1590 | CKV_CIRCLECIPIPELINES_7 | circleci_pipelines | jobs.*.steps[] | Suspicious use of curl in run task | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1591 | CKV_CIRCLECIPIPELINES_8 | circleci_pipelines | executors.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Detecting image usages in circleci pipelines | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1592 | CKV_DIO_1 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1593 | CKV_DIO_2 | resource | digitalocean_droplet | Ensure the droplet specifies an SSH key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1594 | CKV_DIO_3 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket is private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1595 | CKV_DIO_4 | resource | digitalocean_firewall | Ensure the firewall ingress is not wide open | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1596 | CKV_DOCKER_1 | dockerfile | EXPOSE | Ensure port 22 is not exposed | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1597 | CKV_DOCKER_2 | dockerfile | * | Ensure that HEALTHCHECK instructions have been added to container images | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1598 | CKV_DOCKER_3 | dockerfile | * | Ensure that a user for the container has been created | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1599 | CKV_DOCKER_4 | dockerfile | ADD | Ensure that COPY is used instead of ADD in Dockerfiles | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1600 | CKV_DOCKER_5 | dockerfile | RUN | Ensure update instructions are not use alone in the Dockerfile | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1601 | CKV_DOCKER_6 | dockerfile | MAINTAINER | Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1602 | CKV_DOCKER_7 | dockerfile | FROM | Ensure the base image uses a non latest version tag | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1603 | CKV_DOCKER_8 | dockerfile | USER | Ensure the last USER is not root | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1604 | CKV_DOCKER_9 | dockerfile | RUN | Ensure that APT isn't used | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1605 | CKV_DOCKER_10 | dockerfile | WORKDIR | Ensure that WORKDIR values are absolute paths | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1606 | CKV_DOCKER_11 | dockerfile | FROM | Ensure From Alias are unique for multistage builds. | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1607 | CKV2_DOCKER_1 | resource | RUN | Ensure that sudo isn't used | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1608 | CKV_GCP_1 | resource | google_container_cluster | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1609 | CKV_GCP_2 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted ssh access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1610 | CKV_GCP_3 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted rdp access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1611 | CKV_GCP_4 | resource | google_compute_ssl_policy | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1612 | CKV_GCP_6 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance requires all incoming connections to use SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1613 | CKV_GCP_7 | resource | google_container_cluster | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1614 | CKV_GCP_8 | resource | google_container_cluster | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1615 | CKV_GCP_9 | resource | google_container_node_pool | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1616 | CKV_GCP_10 | resource | google_container_node_pool | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1617 | CKV_GCP_11 | resource | google_sql_database_instance | Ensure that Cloud SQL database Instances are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1618 | CKV_GCP_12 | resource | google_container_cluster | Ensure Network Policy is enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1619 | CKV_GCP_13 | resource | google_container_cluster | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1620 | CKV_GCP_14 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance have backup configuration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1621 | CKV_GCP_15 | resource | google_bigquery_dataset | Ensure that BigQuery datasets are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1622 | CKV_GCP_16 | resource | google_dns_managed_zone | Ensure that DNSSEC is enabled for Cloud DNS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1623 | CKV_GCP_17 | resource | google_dns_managed_zone | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1624 | CKV_GCP_18 | resource | google_container_cluster | Ensure GKE Control Plane is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1625 | CKV_GCP_19 | resource | google_container_cluster | Ensure GKE basic auth is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1626 | CKV_GCP_20 | resource | google_container_cluster | Ensure master authorized networks is set to enabled in GKE clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1627 | CKV_GCP_21 | resource | google_container_cluster | Ensure Kubernetes Clusters are configured with Labels | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1628 | CKV_GCP_22 | resource | google_container_node_pool | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1629 | CKV_GCP_23 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1630 | CKV_GCP_24 | resource | google_container_cluster | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1631 | CKV_GCP_25 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Private cluster enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1632 | CKV_GCP_26 | resource | google_compute_subnetwork | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1633 | CKV_GCP_27 | resource | google_project | Ensure that the default network does not exist in a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1634 | CKV_GCP_28 | resource | google_storage_bucket_iam_binding | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1635 | CKV_GCP_28 | resource | google_storage_bucket_iam_member | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1636 | CKV_GCP_29 | resource | google_storage_bucket | Ensure that Cloud Storage buckets have uniform bucket-level access enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1637 | CKV_GCP_30 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1638 | CKV_GCP_30 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1639 | CKV_GCP_30 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1640 | CKV_GCP_31 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1641 | CKV_GCP_31 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1642 | CKV_GCP_31 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1643 | CKV_GCP_32 | resource | google_compute_instance | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1644 | CKV_GCP_32 | resource | google_compute_instance_from_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1645 | CKV_GCP_32 | resource | google_compute_instance_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1646 | CKV_GCP_33 | resource | google_compute_project_metadata | Ensure oslogin is enabled for a Project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1647 | CKV_GCP_34 | resource | google_compute_instance | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1648 | CKV_GCP_34 | resource | google_compute_instance_from_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1649 | CKV_GCP_34 | resource | google_compute_instance_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1650 | CKV_GCP_35 | resource | google_compute_instance | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1651 | CKV_GCP_35 | resource | google_compute_instance_from_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1652 | CKV_GCP_35 | resource | google_compute_instance_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1653 | CKV_GCP_36 | resource | google_compute_instance | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1654 | CKV_GCP_36 | resource | google_compute_instance_from_template | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1655 | CKV_GCP_36 | resource | google_compute_instance_template | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1656 | CKV_GCP_37 | resource | google_compute_disk | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1657 | CKV_GCP_38 | resource | google_compute_instance | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1658 | CKV_GCP_39 | resource | google_compute_instance | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1659 | CKV_GCP_39 | resource | google_compute_instance_from_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1660 | CKV_GCP_39 | resource | google_compute_instance_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1661 | CKV_GCP_40 | resource | google_compute_instance | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1662 | CKV_GCP_40 | resource | google_compute_instance_from_template | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1663 | CKV_GCP_40 | resource | google_compute_instance_template | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1664 | CKV_GCP_41 | resource | google_project_iam_binding | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1665 | CKV_GCP_41 | resource | google_project_iam_member | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1666 | CKV_GCP_42 | resource | google_project_iam_member | Ensure that Service Account has no Admin privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1667 | CKV_GCP_43 | resource | google_kms_crypto_key | Ensure KMS encryption keys are rotated within a period of 90 days | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1668 | CKV_GCP_44 | resource | google_folder_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1669 | CKV_GCP_44 | resource | google_folder_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1670 | CKV_GCP_45 | resource | google_organization_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1671 | CKV_GCP_45 | resource | google_organization_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1672 | CKV_GCP_46 | resource | google_project_iam_binding | Ensure Default Service account is not used at a project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1673 | CKV_GCP_46 | resource | google_project_iam_member | Ensure Default Service account is not used at a project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1674 | CKV_GCP_47 | resource | google_organization_iam_binding | Ensure default service account is not used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1675 | CKV_GCP_47 | resource | google_organization_iam_member | Ensure default service account is not used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1676 | CKV_GCP_48 | resource | google_folder_iam_binding | Ensure Default Service account is not used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1677 | CKV_GCP_48 | resource | google_folder_iam_member | Ensure Default Service account is not used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1678 | CKV_GCP_49 | resource | google_project_iam_binding | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1679 | CKV_GCP_49 | resource | google_project_iam_member | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1680 | CKV_GCP_50 | resource | google_sql_database_instance | Ensure MySQL database 'local_infile' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1681 | CKV_GCP_51 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1682 | CKV_GCP_52 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_connections' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1683 | CKV_GCP_53 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_disconnections' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1684 | CKV_GCP_54 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1685 | CKV_GCP_55 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1686 | CKV_GCP_56 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_temp_files flag is set to '0' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1687 | CKV_GCP_57 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1688 | CKV_GCP_58 | resource | google_sql_database_instance | Ensure SQL database 'cross db ownership chaining' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1689 | CKV_GCP_59 | resource | google_sql_database_instance | Ensure SQL database 'contained database authentication' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1690 | CKV_GCP_60 | resource | google_sql_database_instance | Ensure Cloud SQL database does not have public IP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1691 | CKV_GCP_61 | resource | google_container_cluster | Enable VPC Flow Logs and Intranode Visibility | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1692 | CKV_GCP_62 | resource | google_storage_bucket | Bucket should log access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1693 | CKV_GCP_63 | resource | google_storage_bucket | Bucket should not log to itself | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1694 | CKV_GCP_64 | resource | google_container_cluster | Ensure clusters are created with Private Nodes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1695 | CKV_GCP_65 | resource | google_container_cluster | Manage Kubernetes RBAC users with Google Groups for GKE | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1696 | CKV_GCP_66 | resource | google_container_cluster | Ensure use of Binary Authorization | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1697 | CKV_GCP_67 | resource | google_container_cluster | Ensure legacy Compute Engine instance metadata APIs are Disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1698 | CKV_GCP_68 | resource | google_container_cluster | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1699 | CKV_GCP_68 | resource | google_container_node_pool | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1700 | CKV_GCP_69 | resource | google_container_cluster | Ensure the GKE Metadata Server is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1701 | CKV_GCP_69 | resource | google_container_node_pool | Ensure the GKE Metadata Server is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1702 | CKV_GCP_70 | resource | google_container_cluster | Ensure the GKE Release Channel is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1703 | CKV_GCP_71 | resource | google_container_cluster | Ensure Shielded GKE Nodes are Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1704 | CKV_GCP_72 | resource | google_container_cluster | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1705 | CKV_GCP_72 | resource | google_container_node_pool | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1706 | CKV_GCP_73 | resource | google_compute_security_policy | Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1707 | CKV_GCP_74 | resource | google_compute_subnetwork | Ensure that private_ip_google_access is enabled for Subnet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1708 | CKV_GCP_75 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted FTP access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1709 | CKV_GCP_76 | resource | google_compute_subnetwork | Ensure that Private google access is enabled for IPV6 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1710 | CKV_GCP_77 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow on ftp port | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1711 | CKV_GCP_78 | resource | google_storage_bucket | Ensure Cloud storage has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1712 | CKV_GCP_79 | resource | google_sql_database_instance | Ensure SQL database is using latest Major version | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1713 | CKV_GCP_80 | resource | google_bigquery_table | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1714 | CKV_GCP_81 | resource | google_bigquery_dataset | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1715 | CKV_GCP_82 | resource | google_kms_crypto_key | Ensure KMS keys are protected from deletion | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1716 | CKV_GCP_83 | resource | google_pubsub_topic | Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1717 | CKV_GCP_84 | resource | google_artifact_registry_repository | Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1718 | CKV_GCP_85 | resource | google_bigtable_instance | Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1719 | CKV_GCP_86 | resource | google_cloudbuild_worker_pool | Ensure Cloud build workers are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1720 | CKV_GCP_87 | resource | google_data_fusion_instance | Ensure Data fusion instances are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1721 | CKV_GCP_88 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted mysql access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1722 | CKV_GCP_89 | resource | google_notebooks_instance | Ensure Vertex AI instances are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1723 | CKV_GCP_90 | resource | google_dataflow_job | Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1724 | CKV_GCP_91 | resource | google_dataproc_cluster | Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1725 | CKV_GCP_92 | resource | google_vertex_ai_dataset | Ensure Vertex AI datasets uses a CMK (Customer Manager Key) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1726 | CKV_GCP_93 | resource | google_spanner_database | Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1727 | CKV_GCP_94 | resource | google_dataflow_job | Ensure Dataflow jobs are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1728 | CKV_GCP_95 | resource | google_redis_instance | Ensure Memorystore for Redis has AUTH enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1729 | CKV_GCP_96 | resource | google_vertex_ai_metadata_store | Ensure Vertex AI Metadata Store uses a CMK (Customer Manager Key) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1730 | CKV_GCP_97 | resource | google_redis_instance | Ensure Memorystore for Redis uses intransit encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1731 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_binding | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1732 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_member | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1733 | CKV_GCP_99 | resource | google_pubsub_topic_iam_binding | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1734 | CKV_GCP_99 | resource | google_pubsub_topic_iam_member | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1735 | CKV_GCP_100 | resource | google_bigquery_table_iam_binding | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1736 | CKV_GCP_100 | resource | google_bigquery_table_iam_member | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1737 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_binding | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1738 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_member | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1739 | CKV_GCP_102 | resource | google_cloud_run_service_iam_binding | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1740 | CKV_GCP_102 | resource | google_cloud_run_service_iam_member | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1741 | CKV_GCP_103 | resource | google_dataproc_cluster | Ensure Dataproc Clusters do not have public IPs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1742 | CKV_GCP_104 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1743 | CKV_GCP_105 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver monitoring enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1744 | CKV_GCP_106 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1745 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_binding | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1746 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_member | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1747 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_binding | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1748 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_member | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1749 | CKV_GCP_108 | resource | google_sql_database_instance | Ensure hostnames are logged for GCP PostgreSQL databases | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1750 | CKV_GCP_109 | resource | google_sql_database_instance | Ensure the GCP PostgreSQL database log levels are set to ERROR or lower | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1751 | CKV_GCP_110 | resource | google_sql_database_instance | Ensure pgAudit is enabled for your GCP PostgreSQL database | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1752 | CKV_GCP_111 | resource | google_sql_database_instance | Ensure GCP PostgreSQL logs SQL statements | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1753 | CKV2_GCP_1 | resource | google_project_default_service_accounts | Ensure GKE clusters are not running using the Compute Engine default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1754 | CKV2_GCP_2 | resource | google_compute_network | Ensure legacy networks do not exist for a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1755 | CKV2_GCP_3 | resource | google_service_account_key | Ensure that there are only GCP-managed service account keys for each service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1756 | CKV2_GCP_4 | resource | google_logging_folder_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1757 | CKV2_GCP_4 | resource | google_logging_organization_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1758 | CKV2_GCP_4 | resource | google_logging_project_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1759 | CKV2_GCP_4 | resource | google_storage_bucket | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1760 | CKV2_GCP_5 | resource | google_project | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1761 | CKV2_GCP_5 | resource | google_project_iam_audit_config | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1762 | CKV2_GCP_6 | resource | google_kms_crypto_key | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1763 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_binding | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1764 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_member | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1765 | CKV2_GCP_7 | resource | google_sql_database_instance | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1766 | CKV2_GCP_7 | resource | google_sql_user | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1767 | CKV2_GCP_8 | resource | google_kms_key_ring | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1768 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_binding | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1769 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_member | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1770 | CKV2_GCP_9 | resource | google_container_registry | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1771 | CKV2_GCP_9 | resource | google_storage_bucket_iam_binding | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1772 | CKV2_GCP_9 | resource | google_storage_bucket_iam_member | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1773 | CKV2_GCP_10 | resource | google_cloudfunctions_function | Ensure GCP Cloud Function HTTP trigger is secured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1774 | CKV2_GCP_11 | resource | google_project_services | Ensure GCP GCR Container Vulnerability Scanning is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1775 | CKV2_GCP_12 | resource | google_compute_firewall | Ensure GCP compute firewall ingress does not allow unrestricted access to all ports | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1776 | CKV_GHA_1 | jobs | jobs | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1777 | CKV_GHA_1 | jobs | jobs.*.steps[] | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1778 | CKV_GHA_2 | jobs | jobs | Ensure run commands are not vulnerable to shell injection | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1779 | CKV_GHA_2 | jobs | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1780 | CKV_GHA_3 | jobs | jobs | Suspicious use of curl with secrets | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1781 | CKV_GHA_3 | jobs | jobs.*.steps[] | Suspicious use of curl with secrets | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1782 | CKV_GHA_4 | jobs | jobs | Suspicious use of netcat with IP address | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1783 | CKV_GHA_4 | jobs | jobs.*.steps[] | Suspicious use of netcat with IP address | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1784 | CKV_GHA_5 | jobs | jobs | Found artifact build without evidence of cosign sign execution in pipeline | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1785 | CKV_GHA_6 | jobs | jobs | Found artifact build without evidence of cosign sbom attestation in pipeline | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1786 | CKV_GHA_7 | jobs | on | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1787 | CKV2_GHA_1 | resource | permissions | Ensure top-level permissions are not set to write-all | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1788 | CKV_GIT_1 | resource | github_repository | Ensure GitHub repository is Private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1789 | CKV_GIT_2 | resource | github_repository_webhook | Ensure GitHub repository webhooks are using HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1790 | CKV_GIT_3 | resource | github_repository | Ensure GitHub repository has vulnerability alerts enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1791 | CKV_GIT_4 | resource | github_actions_environment_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1792 | CKV_GIT_4 | resource | github_actions_organization_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1793 | CKV_GIT_4 | resource | github_actions_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1794 | CKV_GIT_5 | resource | github_branch_protection | GitHub pull requests should require at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1795 | CKV_GIT_5 | resource | github_branch_protection_v3 | GitHub pull requests should require at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1796 | CKV_GIT_6 | resource | github_branch_protection | Ensure GitHub branch protection rules requires signed commits | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1797 | CKV_GIT_6 | resource | github_branch_protection_v3 | Ensure GitHub branch protection rules requires signed commits | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1798 | CKV2_GIT_1 | resource | github_repository | Ensure each Repository has branch protection associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1799 | CKV_GITHUB_1 | github_configuration | * | Ensure GitHub organization security settings require 2FA | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1800 | CKV_GITHUB_2 | github_configuration | * | Ensure GitHub organization security settings require SSO | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1801 | CKV_GITHUB_3 | github_configuration | * | Ensure GitHub organization security settings has IP allow list enabled | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1802 | CKV_GITHUB_4 | github_configuration | * | Ensure GitHub branch protection rules requires signed commits | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1803 | CKV_GITHUB_5 | github_configuration | * | Ensure GitHub branch protection rules does not allow force pushes | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1804 | CKV_GITHUB_6 | github_configuration | * | Ensure GitHub organization webhooks are using HTTPS | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1805 | CKV_GITHUB_7 | github_configuration | * | Ensure GitHub repository webhooks are using HTTPS | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1806 | CKV_GITHUB_8 | github_configuration | * | Ensure GitHub branch protection rules requires linear history | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1807 | CKV_GITHUB_9 | github_configuration | * | Ensure 2 admins are set for each repository | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1808 | CKV_GITHUB_10 | github_configuration | * | Ensure branch protection rules are enforced on administrators | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1809 | CKV_GITHUB_11 | github_configuration | * | Ensure GitHub branch protection dismisses stale review on new commit - CIS 1.1.4 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1810 | CKV_GITHUB_12 | github_configuration | * | Ensure GitHub branch protection restricts who can dismiss PR reviews - CIS 1.1.5 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1811 | CKV_GITHUB_13 | github_configuration | * | Ensure GitHub branch protection requires CODEOWNER reviews - CIS 1.1.6 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1812 | CKV_GITHUB_14 | github_configuration | * | Ensure GitHub branch protection requires status checks - CIS 1.1.9 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1813 | CKV_GITHUB_16 | github_configuration | * | Ensure GitHub branch protection requires conversation resolution - CIS 1.1.11 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1814 | CKV_GITHUB_17 | github_configuration | * | Ensure GitHub branch protection requires push restrictions - CIS 1.1.15 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1815 | CKV_GITHUB_18 | github_configuration | * | Ensure GitHub branch protection rules does not allow deletions - CIS 1.1.17 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1816 | CKV_GITLAB_1 | gitlab_configuration | * | Merge requests should require at least 2 approvals | gitlab_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1817 | CKV_GITLAB_2 | gitlab_configuration | * | Ensure all Gitlab groups require two factor authentication | gitlab_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1818 | CKV_GITLABCI_1 | jobs | *.script[] | Suspicious use of curl with CI environment variables in script | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1819 | CKV_GITLABCI_2 | jobs | *.rules | Avoid creating rules that generate double pipelines | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1820 | CKV_GITLABCI_3 | jobs | *.image[] | Detecting image usages in gitlab workflows | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1821 | CKV_GITLABCI_3 | jobs | *.services[] | Detecting image usages in gitlab workflows | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1822 | CKV_GLB_1 | resource | gitlab_project | Ensure at least two approving reviews are required to merge a GitLab MR | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1823 | CKV_GLB_2 | resource | gitlab_branch_protection | Ensure GitLab branch protection rules does not allow force pushes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1824 | CKV_GLB_3 | resource | gitlab_project | Ensure GitLab prevent secrets is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1825 | CKV_GLB_4 | resource | gitlab_project | Ensure GitLab commits are signed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1826 | CKV_K8S_1 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1827 | CKV_K8S_1 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1828 | CKV_K8S_2 | resource | PodSecurityPolicy | Do not admit privileged containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1829 | CKV_K8S_2 | resource | kubernetes_pod_security_policy | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1830 | CKV_K8S_3 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1831 | CKV_K8S_3 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1832 | CKV_K8S_4 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1833 | CKV_K8S_4 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1834 | CKV_K8S_5 | resource | PodSecurityPolicy | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1835 | CKV_K8S_5 | resource | kubernetes_pod_security_policy | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1836 | CKV_K8S_6 | resource | PodSecurityPolicy | Do not admit root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1837 | CKV_K8S_6 | resource | kubernetes_pod_security_policy | Do not admit root containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1838 | CKV_K8S_7 | resource | PodSecurityPolicy | Do not admit containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1839 | CKV_K8S_7 | resource | kubernetes_pod_security_policy | Do not admit containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1840 | CKV_K8S_8 | resource | DaemonSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1841 | CKV_K8S_8 | resource | Deployment | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1842 | CKV_K8S_8 | resource | DeploymentConfig | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1843 | CKV_K8S_8 | resource | Pod | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1844 | CKV_K8S_8 | resource | PodTemplate | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1845 | CKV_K8S_8 | resource | ReplicaSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1846 | CKV_K8S_8 | resource | ReplicationController | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1847 | CKV_K8S_8 | resource | StatefulSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1848 | CKV_K8S_8 | resource | kubernetes_deployment | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1849 | CKV_K8S_8 | resource | kubernetes_deployment_v1 | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1850 | CKV_K8S_8 | resource | kubernetes_pod | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1851 | CKV_K8S_8 | resource | kubernetes_pod_v1 | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1852 | CKV_K8S_9 | resource | DaemonSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1853 | CKV_K8S_9 | resource | Deployment | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1854 | CKV_K8S_9 | resource | DeploymentConfig | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1855 | CKV_K8S_9 | resource | Pod | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1856 | CKV_K8S_9 | resource | PodTemplate | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1857 | CKV_K8S_9 | resource | ReplicaSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1858 | CKV_K8S_9 | resource | ReplicationController | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1859 | CKV_K8S_9 | resource | StatefulSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1860 | CKV_K8S_9 | resource | kubernetes_deployment | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1861 | CKV_K8S_9 | resource | kubernetes_deployment_v1 | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1862 | CKV_K8S_9 | resource | kubernetes_pod | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1863 | CKV_K8S_9 | resource | kubernetes_pod_v1 | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1864 | CKV_K8S_10 | resource | CronJob | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1865 | CKV_K8S_10 | resource | DaemonSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1866 | CKV_K8S_10 | resource | Deployment | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1867 | CKV_K8S_10 | resource | DeploymentConfig | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1868 | CKV_K8S_10 | resource | Job | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1869 | CKV_K8S_10 | resource | Pod | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1870 | CKV_K8S_10 | resource | PodTemplate | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1871 | CKV_K8S_10 | resource | ReplicaSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1872 | CKV_K8S_10 | resource | ReplicationController | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1873 | CKV_K8S_10 | resource | StatefulSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1874 | CKV_K8S_10 | resource | kubernetes_deployment | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1875 | CKV_K8S_10 | resource | kubernetes_deployment_v1 | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1876 | CKV_K8S_10 | resource | kubernetes_pod | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1877 | CKV_K8S_10 | resource | kubernetes_pod_v1 | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1878 | CKV_K8S_11 | resource | CronJob | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1879 | CKV_K8S_11 | resource | DaemonSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1880 | CKV_K8S_11 | resource | Deployment | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1881 | CKV_K8S_11 | resource | DeploymentConfig | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1882 | CKV_K8S_11 | resource | Job | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1883 | CKV_K8S_11 | resource | Pod | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1884 | CKV_K8S_11 | resource | PodTemplate | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1885 | CKV_K8S_11 | resource | ReplicaSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1886 | CKV_K8S_11 | resource | ReplicationController | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1887 | CKV_K8S_11 | resource | StatefulSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1888 | CKV_K8S_11 | resource | kubernetes_deployment | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1889 | CKV_K8S_11 | resource | kubernetes_deployment_v1 | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1890 | CKV_K8S_11 | resource | kubernetes_pod | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1891 | CKV_K8S_11 | resource | kubernetes_pod_v1 | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1892 | CKV_K8S_12 | resource | CronJob | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1893 | CKV_K8S_12 | resource | DaemonSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1894 | CKV_K8S_12 | resource | Deployment | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1895 | CKV_K8S_12 | resource | DeploymentConfig | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1896 | CKV_K8S_12 | resource | Job | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1897 | CKV_K8S_12 | resource | Pod | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1898 | CKV_K8S_12 | resource | PodTemplate | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1899 | CKV_K8S_12 | resource | ReplicaSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1900 | CKV_K8S_12 | resource | ReplicationController | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1901 | CKV_K8S_12 | resource | StatefulSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1902 | CKV_K8S_12 | resource | kubernetes_deployment | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1903 | CKV_K8S_12 | resource | kubernetes_deployment_v1 | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1904 | CKV_K8S_12 | resource | kubernetes_pod | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1905 | CKV_K8S_12 | resource | kubernetes_pod_v1 | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1906 | CKV_K8S_13 | resource | CronJob | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1907 | CKV_K8S_13 | resource | DaemonSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1908 | CKV_K8S_13 | resource | Deployment | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1909 | CKV_K8S_13 | resource | DeploymentConfig | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1910 | CKV_K8S_13 | resource | Job | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1911 | CKV_K8S_13 | resource | Pod | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1912 | CKV_K8S_13 | resource | PodTemplate | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1913 | CKV_K8S_13 | resource | ReplicaSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1914 | CKV_K8S_13 | resource | ReplicationController | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1915 | CKV_K8S_13 | resource | StatefulSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1916 | CKV_K8S_13 | resource | kubernetes_deployment | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1917 | CKV_K8S_13 | resource | kubernetes_deployment_v1 | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1918 | CKV_K8S_13 | resource | kubernetes_pod | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1919 | CKV_K8S_13 | resource | kubernetes_pod_v1 | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1920 | CKV_K8S_14 | resource | CronJob | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1921 | CKV_K8S_14 | resource | DaemonSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1922 | CKV_K8S_14 | resource | Deployment | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1923 | CKV_K8S_14 | resource | DeploymentConfig | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1924 | CKV_K8S_14 | resource | Job | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1925 | CKV_K8S_14 | resource | Pod | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1926 | CKV_K8S_14 | resource | PodTemplate | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1927 | CKV_K8S_14 | resource | ReplicaSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1928 | CKV_K8S_14 | resource | ReplicationController | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1929 | CKV_K8S_14 | resource | StatefulSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1930 | CKV_K8S_14 | resource | kubernetes_deployment | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1931 | CKV_K8S_14 | resource | kubernetes_deployment_v1 | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1932 | CKV_K8S_14 | resource | kubernetes_pod | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1933 | CKV_K8S_14 | resource | kubernetes_pod_v1 | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1934 | CKV_K8S_15 | resource | CronJob | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1935 | CKV_K8S_15 | resource | DaemonSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1936 | CKV_K8S_15 | resource | Deployment | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1937 | CKV_K8S_15 | resource | DeploymentConfig | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1938 | CKV_K8S_15 | resource | Job | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1939 | CKV_K8S_15 | resource | Pod | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1940 | CKV_K8S_15 | resource | PodTemplate | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1941 | CKV_K8S_15 | resource | ReplicaSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1942 | CKV_K8S_15 | resource | ReplicationController | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1943 | CKV_K8S_15 | resource | StatefulSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1944 | CKV_K8S_15 | resource | kubernetes_deployment | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1945 | CKV_K8S_15 | resource | kubernetes_deployment_v1 | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1946 | CKV_K8S_15 | resource | kubernetes_pod | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1947 | CKV_K8S_15 | resource | kubernetes_pod_v1 | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1948 | CKV_K8S_16 | resource | CronJob | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1949 | CKV_K8S_16 | resource | DaemonSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1950 | CKV_K8S_16 | resource | Deployment | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1951 | CKV_K8S_16 | resource | DeploymentConfig | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1952 | CKV_K8S_16 | resource | Job | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1953 | CKV_K8S_16 | resource | Pod | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1954 | CKV_K8S_16 | resource | PodTemplate | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1955 | CKV_K8S_16 | resource | ReplicaSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1956 | CKV_K8S_16 | resource | ReplicationController | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1957 | CKV_K8S_16 | resource | StatefulSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1958 | CKV_K8S_16 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1959 | CKV_K8S_16 | resource | kubernetes_deployment_v1 | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1960 | CKV_K8S_16 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1961 | CKV_K8S_16 | resource | kubernetes_pod_v1 | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1962 | CKV_K8S_17 | resource | CronJob | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1963 | CKV_K8S_17 | resource | DaemonSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1964 | CKV_K8S_17 | resource | Deployment | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1965 | CKV_K8S_17 | resource | Job | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1966 | CKV_K8S_17 | resource | Pod | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1967 | CKV_K8S_17 | resource | ReplicaSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1968 | CKV_K8S_17 | resource | ReplicationController | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1969 | CKV_K8S_17 | resource | StatefulSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1970 | CKV_K8S_17 | resource | kubernetes_deployment | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1971 | CKV_K8S_17 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1972 | CKV_K8S_17 | resource | kubernetes_pod | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1973 | CKV_K8S_17 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1974 | CKV_K8S_18 | resource | CronJob | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1975 | CKV_K8S_18 | resource | DaemonSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1976 | CKV_K8S_18 | resource | Deployment | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1977 | CKV_K8S_18 | resource | Job | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1978 | CKV_K8S_18 | resource | Pod | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1979 | CKV_K8S_18 | resource | ReplicaSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1980 | CKV_K8S_18 | resource | ReplicationController | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1981 | CKV_K8S_18 | resource | StatefulSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1982 | CKV_K8S_18 | resource | kubernetes_deployment | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1983 | CKV_K8S_18 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1984 | CKV_K8S_18 | resource | kubernetes_pod | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1985 | CKV_K8S_18 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1986 | CKV_K8S_19 | resource | CronJob | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1987 | CKV_K8S_19 | resource | DaemonSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1988 | CKV_K8S_19 | resource | Deployment | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1989 | CKV_K8S_19 | resource | Job | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1990 | CKV_K8S_19 | resource | Pod | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1991 | CKV_K8S_19 | resource | ReplicaSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1992 | CKV_K8S_19 | resource | ReplicationController | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1993 | CKV_K8S_19 | resource | StatefulSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1994 | CKV_K8S_19 | resource | kubernetes_deployment | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1995 | CKV_K8S_19 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1996 | CKV_K8S_19 | resource | kubernetes_pod | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1997 | CKV_K8S_19 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1998 | CKV_K8S_20 | resource | CronJob | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1999 | CKV_K8S_20 | resource | DaemonSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2000 | CKV_K8S_20 | resource | Deployment | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2001 | CKV_K8S_20 | resource | DeploymentConfig | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2002 | CKV_K8S_20 | resource | Job | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2003 | CKV_K8S_20 | resource | Pod | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2004 | CKV_K8S_20 | resource | PodTemplate | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2005 | CKV_K8S_20 | resource | ReplicaSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2006 | CKV_K8S_20 | resource | ReplicationController | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2007 | CKV_K8S_20 | resource | StatefulSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2008 | CKV_K8S_20 | resource | kubernetes_deployment | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2009 | CKV_K8S_20 | resource | kubernetes_deployment_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2010 | CKV_K8S_20 | resource | kubernetes_pod | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2011 | CKV_K8S_20 | resource | kubernetes_pod_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2012 | CKV_K8S_21 | resource | ConfigMap | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2013 | CKV_K8S_21 | resource | CronJob | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2014 | CKV_K8S_21 | resource | DaemonSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2015 | CKV_K8S_21 | resource | Deployment | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2016 | CKV_K8S_21 | resource | Ingress | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2017 | CKV_K8S_21 | resource | Job | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2018 | CKV_K8S_21 | resource | Pod | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2019 | CKV_K8S_21 | resource | ReplicaSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2020 | CKV_K8S_21 | resource | ReplicationController | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2021 | CKV_K8S_21 | resource | Role | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2022 | CKV_K8S_21 | resource | RoleBinding | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2023 | CKV_K8S_21 | resource | Secret | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2024 | CKV_K8S_21 | resource | Service | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2025 | CKV_K8S_21 | resource | ServiceAccount | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2026 | CKV_K8S_21 | resource | StatefulSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2027 | CKV_K8S_21 | resource | kubernetes_config_map | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2028 | CKV_K8S_21 | resource | kubernetes_config_map_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2029 | CKV_K8S_21 | resource | kubernetes_cron_job | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2030 | CKV_K8S_21 | resource | kubernetes_cron_job_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2031 | CKV_K8S_21 | resource | kubernetes_daemon_set_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2032 | CKV_K8S_21 | resource | kubernetes_daemonset | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2033 | CKV_K8S_21 | resource | kubernetes_deployment | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2034 | CKV_K8S_21 | resource | kubernetes_deployment_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2035 | CKV_K8S_21 | resource | kubernetes_ingress | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2036 | CKV_K8S_21 | resource | kubernetes_ingress_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2037 | CKV_K8S_21 | resource | kubernetes_job | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2038 | CKV_K8S_21 | resource | kubernetes_job_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2039 | CKV_K8S_21 | resource | kubernetes_pod | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2040 | CKV_K8S_21 | resource | kubernetes_pod_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2041 | CKV_K8S_21 | resource | kubernetes_replication_controller | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2042 | CKV_K8S_21 | resource | kubernetes_replication_controller_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2043 | CKV_K8S_21 | resource | kubernetes_role_binding | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2044 | CKV_K8S_21 | resource | kubernetes_role_binding_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2045 | CKV_K8S_21 | resource | kubernetes_secret | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2046 | CKV_K8S_21 | resource | kubernetes_secret_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2047 | CKV_K8S_21 | resource | kubernetes_service | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2048 | CKV_K8S_21 | resource | kubernetes_service_account | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2049 | CKV_K8S_21 | resource | kubernetes_service_account_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2050 | CKV_K8S_21 | resource | kubernetes_service_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2051 | CKV_K8S_21 | resource | kubernetes_stateful_set | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2052 | CKV_K8S_21 | resource | kubernetes_stateful_set_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2053 | CKV_K8S_22 | resource | CronJob | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2054 | CKV_K8S_22 | resource | DaemonSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2055 | CKV_K8S_22 | resource | Deployment | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2056 | CKV_K8S_22 | resource | DeploymentConfig | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2057 | CKV_K8S_22 | resource | Job | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2058 | CKV_K8S_22 | resource | Pod | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2059 | CKV_K8S_22 | resource | PodTemplate | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2060 | CKV_K8S_22 | resource | ReplicaSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2061 | CKV_K8S_22 | resource | ReplicationController | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2062 | CKV_K8S_22 | resource | StatefulSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2063 | CKV_K8S_22 | resource | kubernetes_deployment | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2064 | CKV_K8S_22 | resource | kubernetes_deployment_v1 | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2065 | CKV_K8S_22 | resource | kubernetes_pod | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2066 | CKV_K8S_22 | resource | kubernetes_pod_v1 | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2067 | CKV_K8S_23 | resource | CronJob | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2068 | CKV_K8S_23 | resource | DaemonSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2069 | CKV_K8S_23 | resource | Deployment | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2070 | CKV_K8S_23 | resource | Job | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2071 | CKV_K8S_23 | resource | Pod | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2072 | CKV_K8S_23 | resource | ReplicaSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2073 | CKV_K8S_23 | resource | ReplicationController | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2074 | CKV_K8S_23 | resource | StatefulSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2075 | CKV_K8S_24 | resource | PodSecurityPolicy | Do not allow containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2076 | CKV_K8S_24 | resource | kubernetes_pod_security_policy | Do not allow containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2077 | CKV_K8S_25 | resource | CronJob | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2078 | CKV_K8S_25 | resource | DaemonSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2079 | CKV_K8S_25 | resource | Deployment | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2080 | CKV_K8S_25 | resource | DeploymentConfig | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2081 | CKV_K8S_25 | resource | Job | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2082 | CKV_K8S_25 | resource | Pod | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2083 | CKV_K8S_25 | resource | PodTemplate | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2084 | CKV_K8S_25 | resource | ReplicaSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2085 | CKV_K8S_25 | resource | ReplicationController | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2086 | CKV_K8S_25 | resource | StatefulSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2087 | CKV_K8S_25 | resource | kubernetes_deployment | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2088 | CKV_K8S_25 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2089 | CKV_K8S_25 | resource | kubernetes_pod | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2090 | CKV_K8S_25 | resource | kubernetes_pod_v1 | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2091 | CKV_K8S_26 | resource | CronJob | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2092 | CKV_K8S_26 | resource | DaemonSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2093 | CKV_K8S_26 | resource | Deployment | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2094 | CKV_K8S_26 | resource | DeploymentConfig | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2095 | CKV_K8S_26 | resource | Job | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2096 | CKV_K8S_26 | resource | Pod | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2097 | CKV_K8S_26 | resource | PodTemplate | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2098 | CKV_K8S_26 | resource | ReplicaSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2099 | CKV_K8S_26 | resource | ReplicationController | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2100 | CKV_K8S_26 | resource | StatefulSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2101 | CKV_K8S_26 | resource | kubernetes_deployment | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2102 | CKV_K8S_26 | resource | kubernetes_deployment_v1 | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2103 | CKV_K8S_26 | resource | kubernetes_pod | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2104 | CKV_K8S_26 | resource | kubernetes_pod_v1 | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2105 | CKV_K8S_27 | resource | CronJob | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2106 | CKV_K8S_27 | resource | DaemonSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2107 | CKV_K8S_27 | resource | Deployment | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2108 | CKV_K8S_27 | resource | Job | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2109 | CKV_K8S_27 | resource | Pod | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2110 | CKV_K8S_27 | resource | ReplicaSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2111 | CKV_K8S_27 | resource | ReplicationController | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2112 | CKV_K8S_27 | resource | StatefulSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2113 | CKV_K8S_27 | resource | kubernetes_daemon_set_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2114 | CKV_K8S_27 | resource | kubernetes_daemonset | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2115 | CKV_K8S_27 | resource | kubernetes_deployment | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2116 | CKV_K8S_27 | resource | kubernetes_deployment_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2117 | CKV_K8S_27 | resource | kubernetes_pod | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2118 | CKV_K8S_27 | resource | kubernetes_pod_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2119 | CKV_K8S_28 | resource | CronJob | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2120 | CKV_K8S_28 | resource | DaemonSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2121 | CKV_K8S_28 | resource | Deployment | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2122 | CKV_K8S_28 | resource | DeploymentConfig | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2123 | CKV_K8S_28 | resource | Job | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2124 | CKV_K8S_28 | resource | Pod | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2125 | CKV_K8S_28 | resource | PodTemplate | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2126 | CKV_K8S_28 | resource | ReplicaSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2127 | CKV_K8S_28 | resource | ReplicationController | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2128 | CKV_K8S_28 | resource | StatefulSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2129 | CKV_K8S_28 | resource | kubernetes_deployment | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2130 | CKV_K8S_28 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2131 | CKV_K8S_28 | resource | kubernetes_pod | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2132 | CKV_K8S_28 | resource | kubernetes_pod_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2133 | CKV_K8S_29 | resource | CronJob | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2134 | CKV_K8S_29 | resource | DaemonSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2135 | CKV_K8S_29 | resource | Deployment | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2136 | CKV_K8S_29 | resource | Job | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2137 | CKV_K8S_29 | resource | Pod | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2138 | CKV_K8S_29 | resource | ReplicaSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2139 | CKV_K8S_29 | resource | ReplicationController | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2140 | CKV_K8S_29 | resource | StatefulSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2141 | CKV_K8S_29 | resource | kubernetes_daemon_set_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2142 | CKV_K8S_29 | resource | kubernetes_daemonset | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2143 | CKV_K8S_29 | resource | kubernetes_deployment | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2144 | CKV_K8S_29 | resource | kubernetes_deployment_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2145 | CKV_K8S_29 | resource | kubernetes_pod | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2146 | CKV_K8S_29 | resource | kubernetes_pod_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2147 | CKV_K8S_30 | resource | CronJob | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2148 | CKV_K8S_30 | resource | DaemonSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2149 | CKV_K8S_30 | resource | Deployment | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2150 | CKV_K8S_30 | resource | DeploymentConfig | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2151 | CKV_K8S_30 | resource | Job | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2152 | CKV_K8S_30 | resource | Pod | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2153 | CKV_K8S_30 | resource | PodTemplate | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2154 | CKV_K8S_30 | resource | ReplicaSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2155 | CKV_K8S_30 | resource | ReplicationController | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2156 | CKV_K8S_30 | resource | StatefulSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2157 | CKV_K8S_30 | resource | kubernetes_deployment | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2158 | CKV_K8S_30 | resource | kubernetes_deployment_v1 | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2159 | CKV_K8S_30 | resource | kubernetes_pod | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2160 | CKV_K8S_30 | resource | kubernetes_pod_v1 | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2161 | CKV_K8S_31 | resource | CronJob | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2162 | CKV_K8S_31 | resource | DaemonSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2163 | CKV_K8S_31 | resource | Deployment | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2164 | CKV_K8S_31 | resource | Job | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2165 | CKV_K8S_31 | resource | Pod | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2166 | CKV_K8S_31 | resource | ReplicaSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2167 | CKV_K8S_31 | resource | ReplicationController | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2168 | CKV_K8S_31 | resource | StatefulSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2169 | CKV_K8S_32 | resource | PodSecurityPolicy | Ensure default seccomp profile set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2170 | CKV_K8S_32 | resource | kubernetes_pod_security_policy | Ensure default seccomp profile set to docker/default or runtime/default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2171 | CKV_K8S_33 | resource | CronJob | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2172 | CKV_K8S_33 | resource | DaemonSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2173 | CKV_K8S_33 | resource | Deployment | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2174 | CKV_K8S_33 | resource | DeploymentConfig | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2175 | CKV_K8S_33 | resource | Job | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2176 | CKV_K8S_33 | resource | Pod | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2177 | CKV_K8S_33 | resource | PodTemplate | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2178 | CKV_K8S_33 | resource | ReplicaSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2179 | CKV_K8S_33 | resource | ReplicationController | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2180 | CKV_K8S_33 | resource | StatefulSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2181 | CKV_K8S_34 | resource | CronJob | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2182 | CKV_K8S_34 | resource | DaemonSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2183 | CKV_K8S_34 | resource | Deployment | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2184 | CKV_K8S_34 | resource | DeploymentConfig | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2185 | CKV_K8S_34 | resource | Job | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2186 | CKV_K8S_34 | resource | Pod | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2187 | CKV_K8S_34 | resource | PodTemplate | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2188 | CKV_K8S_34 | resource | ReplicaSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2189 | CKV_K8S_34 | resource | ReplicationController | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2190 | CKV_K8S_34 | resource | StatefulSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2191 | CKV_K8S_34 | resource | kubernetes_deployment | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2192 | CKV_K8S_34 | resource | kubernetes_deployment_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2193 | CKV_K8S_34 | resource | kubernetes_pod | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2194 | CKV_K8S_34 | resource | kubernetes_pod_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2195 | CKV_K8S_35 | resource | CronJob | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2196 | CKV_K8S_35 | resource | DaemonSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2197 | CKV_K8S_35 | resource | Deployment | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2198 | CKV_K8S_35 | resource | DeploymentConfig | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2199 | CKV_K8S_35 | resource | Job | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2200 | CKV_K8S_35 | resource | Pod | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2201 | CKV_K8S_35 | resource | PodTemplate | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2202 | CKV_K8S_35 | resource | ReplicaSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2203 | CKV_K8S_35 | resource | ReplicationController | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2204 | CKV_K8S_35 | resource | StatefulSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2205 | CKV_K8S_35 | resource | kubernetes_deployment | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2206 | CKV_K8S_35 | resource | kubernetes_deployment_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2207 | CKV_K8S_35 | resource | kubernetes_pod | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2208 | CKV_K8S_35 | resource | kubernetes_pod_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2209 | CKV_K8S_36 | resource | PodSecurityPolicy | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2210 | CKV_K8S_36 | resource | kubernetes_pod_security_policy | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2211 | CKV_K8S_37 | resource | CronJob | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2212 | CKV_K8S_37 | resource | DaemonSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2213 | CKV_K8S_37 | resource | Deployment | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2214 | CKV_K8S_37 | resource | DeploymentConfig | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2215 | CKV_K8S_37 | resource | Job | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2216 | CKV_K8S_37 | resource | Pod | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2217 | CKV_K8S_37 | resource | PodTemplate | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2218 | CKV_K8S_37 | resource | ReplicaSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2219 | CKV_K8S_37 | resource | ReplicationController | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2220 | CKV_K8S_37 | resource | StatefulSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2221 | CKV_K8S_37 | resource | kubernetes_deployment | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2222 | CKV_K8S_37 | resource | kubernetes_deployment_v1 | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2223 | CKV_K8S_37 | resource | kubernetes_pod | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2224 | CKV_K8S_37 | resource | kubernetes_pod_v1 | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2225 | CKV_K8S_38 | resource | CronJob | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2226 | CKV_K8S_38 | resource | DaemonSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2227 | CKV_K8S_38 | resource | Deployment | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2228 | CKV_K8S_38 | resource | Job | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2229 | CKV_K8S_38 | resource | Pod | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2230 | CKV_K8S_38 | resource | ReplicaSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2231 | CKV_K8S_38 | resource | ReplicationController | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2232 | CKV_K8S_38 | resource | StatefulSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2233 | CKV_K8S_39 | resource | CronJob | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2234 | CKV_K8S_39 | resource | DaemonSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2235 | CKV_K8S_39 | resource | Deployment | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2236 | CKV_K8S_39 | resource | DeploymentConfig | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2237 | CKV_K8S_39 | resource | Job | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2238 | CKV_K8S_39 | resource | Pod | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2239 | CKV_K8S_39 | resource | PodTemplate | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2240 | CKV_K8S_39 | resource | ReplicaSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2241 | CKV_K8S_39 | resource | ReplicationController | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2242 | CKV_K8S_39 | resource | StatefulSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2243 | CKV_K8S_39 | resource | kubernetes_deployment | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2244 | CKV_K8S_39 | resource | kubernetes_deployment_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2245 | CKV_K8S_39 | resource | kubernetes_pod | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2246 | CKV_K8S_39 | resource | kubernetes_pod_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2247 | CKV_K8S_40 | resource | CronJob | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2248 | CKV_K8S_40 | resource | DaemonSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2249 | CKV_K8S_40 | resource | Deployment | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2250 | CKV_K8S_40 | resource | Job | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2251 | CKV_K8S_40 | resource | Pod | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2252 | CKV_K8S_40 | resource | ReplicaSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2253 | CKV_K8S_40 | resource | ReplicationController | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2254 | CKV_K8S_40 | resource | StatefulSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2255 | CKV_K8S_41 | resource | ServiceAccount | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2256 | CKV_K8S_41 | resource | kubernetes_service_account | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2257 | CKV_K8S_41 | resource | kubernetes_service_account_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2258 | CKV_K8S_42 | resource | ClusterRoleBinding | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2259 | CKV_K8S_42 | resource | RoleBinding | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2260 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2261 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2262 | CKV_K8S_42 | resource | kubernetes_role_binding | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2263 | CKV_K8S_42 | resource | kubernetes_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2264 | CKV_K8S_43 | resource | CronJob | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2265 | CKV_K8S_43 | resource | DaemonSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2266 | CKV_K8S_43 | resource | Deployment | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2267 | CKV_K8S_43 | resource | DeploymentConfig | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2268 | CKV_K8S_43 | resource | Job | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2269 | CKV_K8S_43 | resource | Pod | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2270 | CKV_K8S_43 | resource | PodTemplate | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2271 | CKV_K8S_43 | resource | ReplicaSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2272 | CKV_K8S_43 | resource | ReplicationController | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2273 | CKV_K8S_43 | resource | StatefulSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2274 | CKV_K8S_43 | resource | kubernetes_deployment | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2275 | CKV_K8S_43 | resource | kubernetes_deployment_v1 | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2276 | CKV_K8S_43 | resource | kubernetes_pod | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2277 | CKV_K8S_43 | resource | kubernetes_pod_v1 | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2278 | CKV_K8S_44 | resource | Service | Ensure that the Tiller Service (Helm v2) is deleted | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2279 | CKV_K8S_44 | resource | kubernetes_service | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2280 | CKV_K8S_44 | resource | kubernetes_service_v1 | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2281 | CKV_K8S_45 | resource | CronJob | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2282 | CKV_K8S_45 | resource | DaemonSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2283 | CKV_K8S_45 | resource | Deployment | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2284 | CKV_K8S_45 | resource | DeploymentConfig | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2285 | CKV_K8S_45 | resource | Job | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2286 | CKV_K8S_45 | resource | Pod | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2287 | CKV_K8S_45 | resource | PodTemplate | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2288 | CKV_K8S_45 | resource | ReplicaSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2289 | CKV_K8S_45 | resource | ReplicationController | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2290 | CKV_K8S_45 | resource | StatefulSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2291 | CKV_K8S_49 | resource | ClusterRole | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2292 | CKV_K8S_49 | resource | Role | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2293 | CKV_K8S_49 | resource | kubernetes_cluster_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2294 | CKV_K8S_49 | resource | kubernetes_cluster_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2295 | CKV_K8S_49 | resource | kubernetes_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2296 | CKV_K8S_49 | resource | kubernetes_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2297 | CKV_K8S_68 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2298 | CKV_K8S_68 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2299 | CKV_K8S_68 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2300 | CKV_K8S_68 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2301 | CKV_K8S_68 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2302 | CKV_K8S_68 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2303 | CKV_K8S_68 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2304 | CKV_K8S_68 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2305 | CKV_K8S_68 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2306 | CKV_K8S_68 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2307 | CKV_K8S_69 | resource | CronJob | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2308 | CKV_K8S_69 | resource | DaemonSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2309 | CKV_K8S_69 | resource | Deployment | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2310 | CKV_K8S_69 | resource | DeploymentConfig | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2311 | CKV_K8S_69 | resource | Job | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2312 | CKV_K8S_69 | resource | Pod | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2313 | CKV_K8S_69 | resource | PodTemplate | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2314 | CKV_K8S_69 | resource | ReplicaSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2315 | CKV_K8S_69 | resource | ReplicationController | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2316 | CKV_K8S_69 | resource | StatefulSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2317 | CKV_K8S_70 | resource | CronJob | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2318 | CKV_K8S_70 | resource | DaemonSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2319 | CKV_K8S_70 | resource | Deployment | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2320 | CKV_K8S_70 | resource | DeploymentConfig | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2321 | CKV_K8S_70 | resource | Job | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2322 | CKV_K8S_70 | resource | Pod | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2323 | CKV_K8S_70 | resource | PodTemplate | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2324 | CKV_K8S_70 | resource | ReplicaSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2325 | CKV_K8S_70 | resource | ReplicationController | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2326 | CKV_K8S_70 | resource | StatefulSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2327 | CKV_K8S_71 | resource | CronJob | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2328 | CKV_K8S_71 | resource | DaemonSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2329 | CKV_K8S_71 | resource | Deployment | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2330 | CKV_K8S_71 | resource | DeploymentConfig | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2331 | CKV_K8S_71 | resource | Job | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2332 | CKV_K8S_71 | resource | Pod | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2333 | CKV_K8S_71 | resource | PodTemplate | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2334 | CKV_K8S_71 | resource | ReplicaSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2335 | CKV_K8S_71 | resource | ReplicationController | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2336 | CKV_K8S_71 | resource | StatefulSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2337 | CKV_K8S_72 | resource | CronJob | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2338 | CKV_K8S_72 | resource | DaemonSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2339 | CKV_K8S_72 | resource | Deployment | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2340 | CKV_K8S_72 | resource | DeploymentConfig | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2341 | CKV_K8S_72 | resource | Job | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2342 | CKV_K8S_72 | resource | Pod | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2343 | CKV_K8S_72 | resource | PodTemplate | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2344 | CKV_K8S_72 | resource | ReplicaSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2345 | CKV_K8S_72 | resource | ReplicationController | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2346 | CKV_K8S_72 | resource | StatefulSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2347 | CKV_K8S_73 | resource | CronJob | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2348 | CKV_K8S_73 | resource | DaemonSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2349 | CKV_K8S_73 | resource | Deployment | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2350 | CKV_K8S_73 | resource | DeploymentConfig | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2351 | CKV_K8S_73 | resource | Job | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2352 | CKV_K8S_73 | resource | Pod | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2353 | CKV_K8S_73 | resource | PodTemplate | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2354 | CKV_K8S_73 | resource | ReplicaSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2355 | CKV_K8S_73 | resource | ReplicationController | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2356 | CKV_K8S_73 | resource | StatefulSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2357 | CKV_K8S_74 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2358 | CKV_K8S_74 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2359 | CKV_K8S_74 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2360 | CKV_K8S_74 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2361 | CKV_K8S_74 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2362 | CKV_K8S_74 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2363 | CKV_K8S_74 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2364 | CKV_K8S_74 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2365 | CKV_K8S_74 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2366 | CKV_K8S_74 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2367 | CKV_K8S_75 | resource | CronJob | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2368 | CKV_K8S_75 | resource | DaemonSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2369 | CKV_K8S_75 | resource | Deployment | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2370 | CKV_K8S_75 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2371 | CKV_K8S_75 | resource | Job | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2372 | CKV_K8S_75 | resource | Pod | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2373 | CKV_K8S_75 | resource | PodTemplate | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2374 | CKV_K8S_75 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2375 | CKV_K8S_75 | resource | ReplicationController | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2376 | CKV_K8S_75 | resource | StatefulSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2377 | CKV_K8S_77 | resource | CronJob | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2378 | CKV_K8S_77 | resource | DaemonSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2379 | CKV_K8S_77 | resource | Deployment | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2380 | CKV_K8S_77 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2381 | CKV_K8S_77 | resource | Job | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2382 | CKV_K8S_77 | resource | Pod | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2383 | CKV_K8S_77 | resource | PodTemplate | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2384 | CKV_K8S_77 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2385 | CKV_K8S_77 | resource | ReplicationController | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2386 | CKV_K8S_77 | resource | StatefulSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2387 | CKV_K8S_78 | resource | AdmissionConfiguration | Ensure that the admission control plugin EventRateLimit is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2388 | CKV_K8S_79 | resource | CronJob | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2389 | CKV_K8S_79 | resource | DaemonSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2390 | CKV_K8S_79 | resource | Deployment | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2391 | CKV_K8S_79 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2392 | CKV_K8S_79 | resource | Job | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2393 | CKV_K8S_79 | resource | Pod | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2394 | CKV_K8S_79 | resource | PodTemplate | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2395 | CKV_K8S_79 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2396 | CKV_K8S_79 | resource | ReplicationController | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2397 | CKV_K8S_79 | resource | StatefulSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2398 | CKV_K8S_80 | resource | CronJob | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2399 | CKV_K8S_80 | resource | DaemonSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2400 | CKV_K8S_80 | resource | Deployment | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2401 | CKV_K8S_80 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2402 | CKV_K8S_80 | resource | Job | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2403 | CKV_K8S_80 | resource | Pod | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2404 | CKV_K8S_80 | resource | PodTemplate | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2405 | CKV_K8S_80 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2406 | CKV_K8S_80 | resource | ReplicationController | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2407 | CKV_K8S_80 | resource | StatefulSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2408 | CKV_K8S_81 | resource | CronJob | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2409 | CKV_K8S_81 | resource | DaemonSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2410 | CKV_K8S_81 | resource | Deployment | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2411 | CKV_K8S_81 | resource | DeploymentConfig | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2412 | CKV_K8S_81 | resource | Job | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2413 | CKV_K8S_81 | resource | Pod | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2414 | CKV_K8S_81 | resource | PodTemplate | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2415 | CKV_K8S_81 | resource | ReplicaSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2416 | CKV_K8S_81 | resource | ReplicationController | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2417 | CKV_K8S_81 | resource | StatefulSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2418 | CKV_K8S_82 | resource | CronJob | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2419 | CKV_K8S_82 | resource | DaemonSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2420 | CKV_K8S_82 | resource | Deployment | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2421 | CKV_K8S_82 | resource | DeploymentConfig | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2422 | CKV_K8S_82 | resource | Job | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2423 | CKV_K8S_82 | resource | Pod | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2424 | CKV_K8S_82 | resource | PodTemplate | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2425 | CKV_K8S_82 | resource | ReplicaSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2426 | CKV_K8S_82 | resource | ReplicationController | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2427 | CKV_K8S_82 | resource | StatefulSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2428 | CKV_K8S_83 | resource | CronJob | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2429 | CKV_K8S_83 | resource | DaemonSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2430 | CKV_K8S_83 | resource | Deployment | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2431 | CKV_K8S_83 | resource | DeploymentConfig | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2432 | CKV_K8S_83 | resource | Job | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2433 | CKV_K8S_83 | resource | Pod | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2434 | CKV_K8S_83 | resource | PodTemplate | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2435 | CKV_K8S_83 | resource | ReplicaSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2436 | CKV_K8S_83 | resource | ReplicationController | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2437 | CKV_K8S_83 | resource | StatefulSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2438 | CKV_K8S_84 | resource | CronJob | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2439 | CKV_K8S_84 | resource | DaemonSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2440 | CKV_K8S_84 | resource | Deployment | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2441 | CKV_K8S_84 | resource | DeploymentConfig | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2442 | CKV_K8S_84 | resource | Job | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2443 | CKV_K8S_84 | resource | Pod | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2444 | CKV_K8S_84 | resource | PodTemplate | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2445 | CKV_K8S_84 | resource | ReplicaSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2446 | CKV_K8S_84 | resource | ReplicationController | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2447 | CKV_K8S_84 | resource | StatefulSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2448 | CKV_K8S_85 | resource | CronJob | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2449 | CKV_K8S_85 | resource | DaemonSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2450 | CKV_K8S_85 | resource | Deployment | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2451 | CKV_K8S_85 | resource | DeploymentConfig | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2452 | CKV_K8S_85 | resource | Job | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2453 | CKV_K8S_85 | resource | Pod | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2454 | CKV_K8S_85 | resource | PodTemplate | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2455 | CKV_K8S_85 | resource | ReplicaSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2456 | CKV_K8S_85 | resource | ReplicationController | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2457 | CKV_K8S_85 | resource | StatefulSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2458 | CKV_K8S_86 | resource | CronJob | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2459 | CKV_K8S_86 | resource | DaemonSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2460 | CKV_K8S_86 | resource | Deployment | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2461 | CKV_K8S_86 | resource | DeploymentConfig | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2462 | CKV_K8S_86 | resource | Job | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2463 | CKV_K8S_86 | resource | Pod | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2464 | CKV_K8S_86 | resource | PodTemplate | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2465 | CKV_K8S_86 | resource | ReplicaSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2466 | CKV_K8S_86 | resource | ReplicationController | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2467 | CKV_K8S_86 | resource | StatefulSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2468 | CKV_K8S_88 | resource | CronJob | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2469 | CKV_K8S_88 | resource | DaemonSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2470 | CKV_K8S_88 | resource | Deployment | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2471 | CKV_K8S_88 | resource | DeploymentConfig | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2472 | CKV_K8S_88 | resource | Job | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2473 | CKV_K8S_88 | resource | Pod | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2474 | CKV_K8S_88 | resource | PodTemplate | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2475 | CKV_K8S_88 | resource | ReplicaSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2476 | CKV_K8S_88 | resource | ReplicationController | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2477 | CKV_K8S_88 | resource | StatefulSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2478 | CKV_K8S_89 | resource | CronJob | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2479 | CKV_K8S_89 | resource | DaemonSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2480 | CKV_K8S_89 | resource | Deployment | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2481 | CKV_K8S_89 | resource | DeploymentConfig | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2482 | CKV_K8S_89 | resource | Job | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2483 | CKV_K8S_89 | resource | Pod | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2484 | CKV_K8S_89 | resource | PodTemplate | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2485 | CKV_K8S_89 | resource | ReplicaSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2486 | CKV_K8S_89 | resource | ReplicationController | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2487 | CKV_K8S_89 | resource | StatefulSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2488 | CKV_K8S_90 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2489 | CKV_K8S_90 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2490 | CKV_K8S_90 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2491 | CKV_K8S_90 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2492 | CKV_K8S_90 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2493 | CKV_K8S_90 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2494 | CKV_K8S_90 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2495 | CKV_K8S_90 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2496 | CKV_K8S_90 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2497 | CKV_K8S_90 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2498 | CKV_K8S_91 | resource | CronJob | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2499 | CKV_K8S_91 | resource | DaemonSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2500 | CKV_K8S_91 | resource | Deployment | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2501 | CKV_K8S_91 | resource | DeploymentConfig | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2502 | CKV_K8S_91 | resource | Job | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2503 | CKV_K8S_91 | resource | Pod | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2504 | CKV_K8S_91 | resource | PodTemplate | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2505 | CKV_K8S_91 | resource | ReplicaSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2506 | CKV_K8S_91 | resource | ReplicationController | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2507 | CKV_K8S_91 | resource | StatefulSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2508 | CKV_K8S_92 | resource | CronJob | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2509 | CKV_K8S_92 | resource | DaemonSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2510 | CKV_K8S_92 | resource | Deployment | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2511 | CKV_K8S_92 | resource | DeploymentConfig | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2512 | CKV_K8S_92 | resource | Job | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2513 | CKV_K8S_92 | resource | Pod | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2514 | CKV_K8S_92 | resource | PodTemplate | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2515 | CKV_K8S_92 | resource | ReplicaSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2516 | CKV_K8S_92 | resource | ReplicationController | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2517 | CKV_K8S_92 | resource | StatefulSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2518 | CKV_K8S_93 | resource | CronJob | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2519 | CKV_K8S_93 | resource | DaemonSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2520 | CKV_K8S_93 | resource | Deployment | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2521 | CKV_K8S_93 | resource | DeploymentConfig | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2522 | CKV_K8S_93 | resource | Job | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2523 | CKV_K8S_93 | resource | Pod | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2524 | CKV_K8S_93 | resource | PodTemplate | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2525 | CKV_K8S_93 | resource | ReplicaSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2526 | CKV_K8S_93 | resource | ReplicationController | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2527 | CKV_K8S_93 | resource | StatefulSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2528 | CKV_K8S_94 | resource | CronJob | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2529 | CKV_K8S_94 | resource | DaemonSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2530 | CKV_K8S_94 | resource | Deployment | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2531 | CKV_K8S_94 | resource | DeploymentConfig | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2532 | CKV_K8S_94 | resource | Job | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2533 | CKV_K8S_94 | resource | Pod | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2534 | CKV_K8S_94 | resource | PodTemplate | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2535 | CKV_K8S_94 | resource | ReplicaSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2536 | CKV_K8S_94 | resource | ReplicationController | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2537 | CKV_K8S_94 | resource | StatefulSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2538 | CKV_K8S_95 | resource | CronJob | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2539 | CKV_K8S_95 | resource | DaemonSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2540 | CKV_K8S_95 | resource | Deployment | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2541 | CKV_K8S_95 | resource | DeploymentConfig | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2542 | CKV_K8S_95 | resource | Job | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2543 | CKV_K8S_95 | resource | Pod | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2544 | CKV_K8S_95 | resource | PodTemplate | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2545 | CKV_K8S_95 | resource | ReplicaSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2546 | CKV_K8S_95 | resource | ReplicationController | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2547 | CKV_K8S_95 | resource | StatefulSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2548 | CKV_K8S_96 | resource | CronJob | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2549 | CKV_K8S_96 | resource | DaemonSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2550 | CKV_K8S_96 | resource | Deployment | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2551 | CKV_K8S_96 | resource | DeploymentConfig | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2552 | CKV_K8S_96 | resource | Job | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2553 | CKV_K8S_96 | resource | Pod | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2554 | CKV_K8S_96 | resource | PodTemplate | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2555 | CKV_K8S_96 | resource | ReplicaSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2556 | CKV_K8S_96 | resource | ReplicationController | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2557 | CKV_K8S_96 | resource | StatefulSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2558 | CKV_K8S_97 | resource | CronJob | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2559 | CKV_K8S_97 | resource | DaemonSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2560 | CKV_K8S_97 | resource | Deployment | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2561 | CKV_K8S_97 | resource | DeploymentConfig | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2562 | CKV_K8S_97 | resource | Job | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2563 | CKV_K8S_97 | resource | Pod | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2564 | CKV_K8S_97 | resource | PodTemplate | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2565 | CKV_K8S_97 | resource | ReplicaSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2566 | CKV_K8S_97 | resource | ReplicationController | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2567 | CKV_K8S_97 | resource | StatefulSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2568 | CKV_K8S_99 | resource | CronJob | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2569 | CKV_K8S_99 | resource | DaemonSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2570 | CKV_K8S_99 | resource | Deployment | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2571 | CKV_K8S_99 | resource | DeploymentConfig | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2572 | CKV_K8S_99 | resource | Job | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2573 | CKV_K8S_99 | resource | Pod | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2574 | CKV_K8S_99 | resource | PodTemplate | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2575 | CKV_K8S_99 | resource | ReplicaSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2576 | CKV_K8S_99 | resource | ReplicationController | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2577 | CKV_K8S_99 | resource | StatefulSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2578 | CKV_K8S_100 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2579 | CKV_K8S_100 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2580 | CKV_K8S_100 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2581 | CKV_K8S_100 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2582 | CKV_K8S_100 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2583 | CKV_K8S_100 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2584 | CKV_K8S_100 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2585 | CKV_K8S_100 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2586 | CKV_K8S_100 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2587 | CKV_K8S_100 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2588 | CKV_K8S_102 | resource | CronJob | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2589 | CKV_K8S_102 | resource | DaemonSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2590 | CKV_K8S_102 | resource | Deployment | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2591 | CKV_K8S_102 | resource | DeploymentConfig | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2592 | CKV_K8S_102 | resource | Job | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2593 | CKV_K8S_102 | resource | Pod | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2594 | CKV_K8S_102 | resource | PodTemplate | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2595 | CKV_K8S_102 | resource | ReplicaSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2596 | CKV_K8S_102 | resource | ReplicationController | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2597 | CKV_K8S_102 | resource | StatefulSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2598 | CKV_K8S_104 | resource | CronJob | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2599 | CKV_K8S_104 | resource | DaemonSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2600 | CKV_K8S_104 | resource | Deployment | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2601 | CKV_K8S_104 | resource | DeploymentConfig | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2602 | CKV_K8S_104 | resource | Job | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2603 | CKV_K8S_104 | resource | Pod | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2604 | CKV_K8S_104 | resource | PodTemplate | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2605 | CKV_K8S_104 | resource | ReplicaSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2606 | CKV_K8S_104 | resource | ReplicationController | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2607 | CKV_K8S_104 | resource | StatefulSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2608 | CKV_K8S_105 | resource | CronJob | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2609 | CKV_K8S_105 | resource | DaemonSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2610 | CKV_K8S_105 | resource | Deployment | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2611 | CKV_K8S_105 | resource | DeploymentConfig | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2612 | CKV_K8S_105 | resource | Job | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2613 | CKV_K8S_105 | resource | Pod | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2614 | CKV_K8S_105 | resource | PodTemplate | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2615 | CKV_K8S_105 | resource | ReplicaSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2616 | CKV_K8S_105 | resource | ReplicationController | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2617 | CKV_K8S_105 | resource | StatefulSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2618 | CKV_K8S_106 | resource | CronJob | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2619 | CKV_K8S_106 | resource | DaemonSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2620 | CKV_K8S_106 | resource | Deployment | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2621 | CKV_K8S_106 | resource | DeploymentConfig | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2622 | CKV_K8S_106 | resource | Job | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2623 | CKV_K8S_106 | resource | Pod | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2624 | CKV_K8S_106 | resource | PodTemplate | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2625 | CKV_K8S_106 | resource | ReplicaSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2626 | CKV_K8S_106 | resource | ReplicationController | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2627 | CKV_K8S_106 | resource | StatefulSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2628 | CKV_K8S_107 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2629 | CKV_K8S_107 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2630 | CKV_K8S_107 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2631 | CKV_K8S_107 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2632 | CKV_K8S_107 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2633 | CKV_K8S_107 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2634 | CKV_K8S_107 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2635 | CKV_K8S_107 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2636 | CKV_K8S_107 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2637 | CKV_K8S_107 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2638 | CKV_K8S_108 | resource | CronJob | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2639 | CKV_K8S_108 | resource | DaemonSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2640 | CKV_K8S_108 | resource | Deployment | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2641 | CKV_K8S_108 | resource | DeploymentConfig | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2642 | CKV_K8S_108 | resource | Job | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2643 | CKV_K8S_108 | resource | Pod | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2644 | CKV_K8S_108 | resource | PodTemplate | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2645 | CKV_K8S_108 | resource | ReplicaSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2646 | CKV_K8S_108 | resource | ReplicationController | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2647 | CKV_K8S_108 | resource | StatefulSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2648 | CKV_K8S_110 | resource | CronJob | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2649 | CKV_K8S_110 | resource | DaemonSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2650 | CKV_K8S_110 | resource | Deployment | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2651 | CKV_K8S_110 | resource | DeploymentConfig | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2652 | CKV_K8S_110 | resource | Job | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2653 | CKV_K8S_110 | resource | Pod | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2654 | CKV_K8S_110 | resource | PodTemplate | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2655 | CKV_K8S_110 | resource | ReplicaSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2656 | CKV_K8S_110 | resource | ReplicationController | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2657 | CKV_K8S_110 | resource | StatefulSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2658 | CKV_K8S_111 | resource | CronJob | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2659 | CKV_K8S_111 | resource | DaemonSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2660 | CKV_K8S_111 | resource | Deployment | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2661 | CKV_K8S_111 | resource | DeploymentConfig | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2662 | CKV_K8S_111 | resource | Job | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2663 | CKV_K8S_111 | resource | Pod | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2664 | CKV_K8S_111 | resource | PodTemplate | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2665 | CKV_K8S_111 | resource | ReplicaSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2666 | CKV_K8S_111 | resource | ReplicationController | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2667 | CKV_K8S_111 | resource | StatefulSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2668 | CKV_K8S_112 | resource | CronJob | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2669 | CKV_K8S_112 | resource | DaemonSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2670 | CKV_K8S_112 | resource | Deployment | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2671 | CKV_K8S_112 | resource | DeploymentConfig | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2672 | CKV_K8S_112 | resource | Job | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2673 | CKV_K8S_112 | resource | Pod | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2674 | CKV_K8S_112 | resource | PodTemplate | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2675 | CKV_K8S_112 | resource | ReplicaSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2676 | CKV_K8S_112 | resource | ReplicationController | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2677 | CKV_K8S_112 | resource | StatefulSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2678 | CKV_K8S_113 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2679 | CKV_K8S_113 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2680 | CKV_K8S_113 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2681 | CKV_K8S_113 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2682 | CKV_K8S_113 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2683 | CKV_K8S_113 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2684 | CKV_K8S_113 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2685 | CKV_K8S_113 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2686 | CKV_K8S_113 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2687 | CKV_K8S_113 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2688 | CKV_K8S_114 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2689 | CKV_K8S_114 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2690 | CKV_K8S_114 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2691 | CKV_K8S_114 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2692 | CKV_K8S_114 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2693 | CKV_K8S_114 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2694 | CKV_K8S_114 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2695 | CKV_K8S_114 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2696 | CKV_K8S_114 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2697 | CKV_K8S_114 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2698 | CKV_K8S_115 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2699 | CKV_K8S_115 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2700 | CKV_K8S_115 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2701 | CKV_K8S_115 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2702 | CKV_K8S_115 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2703 | CKV_K8S_115 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2704 | CKV_K8S_115 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2705 | CKV_K8S_115 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2706 | CKV_K8S_115 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2707 | CKV_K8S_115 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2708 | CKV_K8S_116 | resource | CronJob | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2709 | CKV_K8S_116 | resource | DaemonSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2710 | CKV_K8S_116 | resource | Deployment | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2711 | CKV_K8S_116 | resource | DeploymentConfig | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2712 | CKV_K8S_116 | resource | Job | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2713 | CKV_K8S_116 | resource | Pod | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2714 | CKV_K8S_116 | resource | PodTemplate | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2715 | CKV_K8S_116 | resource | ReplicaSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2716 | CKV_K8S_116 | resource | ReplicationController | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2717 | CKV_K8S_116 | resource | StatefulSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2718 | CKV_K8S_117 | resource | CronJob | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2719 | CKV_K8S_117 | resource | DaemonSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2720 | CKV_K8S_117 | resource | Deployment | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2721 | CKV_K8S_117 | resource | DeploymentConfig | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2722 | CKV_K8S_117 | resource | Job | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2723 | CKV_K8S_117 | resource | Pod | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2724 | CKV_K8S_117 | resource | PodTemplate | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2725 | CKV_K8S_117 | resource | ReplicaSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2726 | CKV_K8S_117 | resource | ReplicationController | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2727 | CKV_K8S_117 | resource | StatefulSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2728 | CKV_K8S_118 | resource | CronJob | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2729 | CKV_K8S_118 | resource | DaemonSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2730 | CKV_K8S_118 | resource | Deployment | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2731 | CKV_K8S_118 | resource | DeploymentConfig | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2732 | CKV_K8S_118 | resource | Job | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2733 | CKV_K8S_118 | resource | Pod | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2734 | CKV_K8S_118 | resource | PodTemplate | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2735 | CKV_K8S_118 | resource | ReplicaSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2736 | CKV_K8S_118 | resource | ReplicationController | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2737 | CKV_K8S_118 | resource | StatefulSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2738 | CKV_K8S_119 | resource | CronJob | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2739 | CKV_K8S_119 | resource | DaemonSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2740 | CKV_K8S_119 | resource | Deployment | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2741 | CKV_K8S_119 | resource | DeploymentConfig | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2742 | CKV_K8S_119 | resource | Job | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2743 | CKV_K8S_119 | resource | Pod | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2744 | CKV_K8S_119 | resource | PodTemplate | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2745 | CKV_K8S_119 | resource | ReplicaSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2746 | CKV_K8S_119 | resource | ReplicationController | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2747 | CKV_K8S_119 | resource | StatefulSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2748 | CKV_K8S_121 | resource | Pod | Ensure that the --peer-client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2749 | CKV_K8S_138 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2750 | CKV_K8S_138 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2751 | CKV_K8S_138 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2752 | CKV_K8S_138 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2753 | CKV_K8S_138 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2754 | CKV_K8S_138 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2755 | CKV_K8S_138 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2756 | CKV_K8S_138 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2757 | CKV_K8S_138 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2758 | CKV_K8S_138 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2759 | CKV_K8S_139 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2760 | CKV_K8S_139 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2761 | CKV_K8S_139 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2762 | CKV_K8S_139 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2763 | CKV_K8S_139 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2764 | CKV_K8S_139 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2765 | CKV_K8S_139 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2766 | CKV_K8S_139 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2767 | CKV_K8S_139 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2768 | CKV_K8S_139 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2769 | CKV_K8S_140 | resource | CronJob | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2770 | CKV_K8S_140 | resource | DaemonSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2771 | CKV_K8S_140 | resource | Deployment | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2772 | CKV_K8S_140 | resource | DeploymentConfig | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2773 | CKV_K8S_140 | resource | Job | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2774 | CKV_K8S_140 | resource | Pod | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2775 | CKV_K8S_140 | resource | PodTemplate | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2776 | CKV_K8S_140 | resource | ReplicaSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2777 | CKV_K8S_140 | resource | ReplicationController | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2778 | CKV_K8S_140 | resource | StatefulSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2779 | CKV_K8S_141 | resource | CronJob | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2780 | CKV_K8S_141 | resource | DaemonSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2781 | CKV_K8S_141 | resource | Deployment | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2782 | CKV_K8S_141 | resource | DeploymentConfig | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2783 | CKV_K8S_141 | resource | Job | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2784 | CKV_K8S_141 | resource | Pod | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2785 | CKV_K8S_141 | resource | PodTemplate | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2786 | CKV_K8S_141 | resource | ReplicaSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2787 | CKV_K8S_141 | resource | ReplicationController | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2788 | CKV_K8S_141 | resource | StatefulSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2789 | CKV_K8S_143 | resource | CronJob | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2790 | CKV_K8S_143 | resource | DaemonSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2791 | CKV_K8S_143 | resource | Deployment | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2792 | CKV_K8S_143 | resource | DeploymentConfig | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2793 | CKV_K8S_143 | resource | Job | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2794 | CKV_K8S_143 | resource | Pod | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2795 | CKV_K8S_143 | resource | PodTemplate | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2796 | CKV_K8S_143 | resource | ReplicaSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2797 | CKV_K8S_143 | resource | ReplicationController | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2798 | CKV_K8S_143 | resource | StatefulSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2799 | CKV_K8S_144 | resource | CronJob | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2800 | CKV_K8S_144 | resource | DaemonSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2801 | CKV_K8S_144 | resource | Deployment | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2802 | CKV_K8S_144 | resource | DeploymentConfig | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2803 | CKV_K8S_144 | resource | Job | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2804 | CKV_K8S_144 | resource | Pod | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2805 | CKV_K8S_144 | resource | PodTemplate | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2806 | CKV_K8S_144 | resource | ReplicaSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2807 | CKV_K8S_144 | resource | ReplicationController | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2808 | CKV_K8S_144 | resource | StatefulSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2809 | CKV_K8S_145 | resource | CronJob | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2810 | CKV_K8S_145 | resource | DaemonSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2811 | CKV_K8S_145 | resource | Deployment | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2812 | CKV_K8S_145 | resource | DeploymentConfig | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2813 | CKV_K8S_145 | resource | Job | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2814 | CKV_K8S_145 | resource | Pod | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2815 | CKV_K8S_145 | resource | PodTemplate | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2816 | CKV_K8S_145 | resource | ReplicaSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2817 | CKV_K8S_145 | resource | ReplicationController | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2818 | CKV_K8S_145 | resource | StatefulSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2819 | CKV_K8S_146 | resource | CronJob | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2820 | CKV_K8S_146 | resource | DaemonSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2821 | CKV_K8S_146 | resource | Deployment | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2822 | CKV_K8S_146 | resource | DeploymentConfig | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2823 | CKV_K8S_146 | resource | Job | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2824 | CKV_K8S_146 | resource | Pod | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2825 | CKV_K8S_146 | resource | PodTemplate | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2826 | CKV_K8S_146 | resource | ReplicaSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2827 | CKV_K8S_146 | resource | ReplicationController | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2828 | CKV_K8S_146 | resource | StatefulSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2829 | CKV_K8S_147 | resource | CronJob | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2830 | CKV_K8S_147 | resource | DaemonSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2831 | CKV_K8S_147 | resource | Deployment | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2832 | CKV_K8S_147 | resource | DeploymentConfig | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2833 | CKV_K8S_147 | resource | Job | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2834 | CKV_K8S_147 | resource | Pod | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2835 | CKV_K8S_147 | resource | PodTemplate | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2836 | CKV_K8S_147 | resource | ReplicaSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2837 | CKV_K8S_147 | resource | ReplicationController | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2838 | CKV_K8S_147 | resource | StatefulSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2839 | CKV_K8S_148 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2840 | CKV_K8S_148 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2841 | CKV_K8S_148 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2842 | CKV_K8S_148 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2843 | CKV_K8S_148 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2844 | CKV_K8S_148 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2845 | CKV_K8S_148 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2846 | CKV_K8S_148 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2847 | CKV_K8S_148 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2848 | CKV_K8S_148 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2849 | CKV_K8S_149 | resource | CronJob | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2850 | CKV_K8S_149 | resource | DaemonSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2851 | CKV_K8S_149 | resource | Deployment | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2852 | CKV_K8S_149 | resource | DeploymentConfig | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2853 | CKV_K8S_149 | resource | Job | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2854 | CKV_K8S_149 | resource | Pod | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2855 | CKV_K8S_149 | resource | PodTemplate | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2856 | CKV_K8S_149 | resource | ReplicaSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2857 | CKV_K8S_149 | resource | ReplicationController | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2858 | CKV_K8S_149 | resource | StatefulSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2859 | CKV_K8S_151 | resource | CronJob | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2860 | CKV_K8S_151 | resource | DaemonSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2861 | CKV_K8S_151 | resource | Deployment | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2862 | CKV_K8S_151 | resource | DeploymentConfig | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2863 | CKV_K8S_151 | resource | Job | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2864 | CKV_K8S_151 | resource | Pod | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2865 | CKV_K8S_151 | resource | PodTemplate | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2866 | CKV_K8S_151 | resource | ReplicaSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2867 | CKV_K8S_151 | resource | ReplicationController | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2868 | CKV_K8S_151 | resource | StatefulSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2869 | CKV_K8S_152 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2870 | CKV_K8S_153 | resource | Ingress | Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2871 | CKV_K8S_154 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2872 | CKV_K8S_155 | resource | ClusterRole | Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2873 | CKV_K8S_156 | resource | ClusterRole | Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2874 | CKV_K8S_157 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2875 | CKV_K8S_157 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2876 | CKV_K8S_158 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2877 | CKV_K8S_158 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2878 | CKV_LIN_1 | provider | linode | Ensure no hard coded Linode tokens exist in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2879 | CKV_LIN_2 | resource | linode_instance | Ensure SSH key set in authorized_keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2880 | CKV_LIN_3 | resource | linode_user | Ensure email is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2881 | CKV_LIN_4 | resource | linode_user | Ensure username is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2882 | CKV_LIN_5 | resource | linode_firewall | Ensure Inbound Firewall Policy is not set to ACCEPT | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2883 | CKV_LIN_6 | resource | linode_firewall | Ensure Outbound Firewall Policy is not set to ACCEPT | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2884 | CKV_NCP_1 | resource | ncloud_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2885 | CKV_NCP_2 | resource | ncloud_access_control_group | Ensure every access control groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2886 | CKV_NCP_2 | resource | ncloud_access_control_group_rule | Ensure every access control groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2887 | CKV_NCP_3 | resource | ncloud_access_control_group_rule | Ensure no security group rules allow outbound traffic to 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2888 | CKV_NCP_4 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2889 | CKV_NCP_5 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2890 | CKV_NCP_6 | resource | ncloud_server | Ensure Server instance is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2891 | CKV_NCP_7 | resource | ncloud_launch_configuration | Ensure Basic Block storage is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2892 | CKV_NCP_8 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2893 | CKV_NCP_9 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2894 | CKV_NCP_10 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2895 | CKV_NCP_11 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2896 | CKV_NCP_12 | resource | ncloud_network_acl_rule | An inbound Network ACL rule should not allow ALL ports. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2897 | CKV_NCP_13 | resource | ncloud_lb_listener | Ensure LB Listener uses only secure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2898 | CKV_NCP_14 | resource | ncloud_nas_volume | Ensure NAS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2899 | CKV_NCP_15 | resource | ncloud_lb_target_group | Ensure Load Balancer Target Group is not using HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2900 | CKV_NCP_16 | resource | ncloud_lb | Ensure Load Balancer isn't exposed to the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2901 | CKV_NCP_19 | resource | ncloud_nks_cluster | Ensure Naver Kubernetes Service public endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2902 | CKV_NCP_22 | resource | ncloud_nks_cluster | Ensure NKS control plane logging enabled for all log types | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2903 | CKV_NCP_23 | resource | ncloud_public_ip | Ensure Server instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2904 | CKV_NCP_24 | resource | ncloud_lb_listener | Ensure Load Balancer Listener Using HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2905 | CKV_NCP_25 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2906 | CKV_OCI_1 | provider | oci | Ensure no hard coded OCI private key in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2907 | CKV_OCI_2 | resource | oci_core_volume | Ensure OCI Block Storage Block Volume has backup enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2908 | CKV_OCI_3 | resource | oci_core_volume | OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2909 | CKV_OCI_4 | resource | oci_core_instance | Ensure OCI Compute Instance boot volume has in-transit data encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2910 | CKV_OCI_5 | resource | oci_core_instance | Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2911 | CKV_OCI_6 | resource | oci_core_instance | Ensure OCI Compute Instance has monitoring enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2912 | CKV_OCI_7 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage bucket can emit object events | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2913 | CKV_OCI_8 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2914 | CKV_OCI_9 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2915 | CKV_OCI_10 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is not Public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2916 | CKV_OCI_11 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain lower case | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2917 | CKV_OCI_12 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Numeric characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2918 | CKV_OCI_13 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Special characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2919 | CKV_OCI_14 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Uppercase characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2920 | CKV_OCI_15 | resource | oci_file_storage_file_system | Ensure OCI File System is Encrypted with a customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2921 | CKV_OCI_16 | resource | oci_core_security_list | Ensure VCN has an inbound security list | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2922 | CKV_OCI_17 | resource | oci_core_security_list | Ensure VCN inbound security lists are stateless | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2923 | CKV_OCI_18 | resource | oci_identity_authentication_policy | OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2924 | CKV_OCI_19 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 22. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2925 | CKV_OCI_20 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 3389. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2926 | CKV_OCI_21 | resource | oci_core_network_security_group_security_rule | Ensure security group has stateless ingress security rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2927 | CKV_OCI_22 | resource | oci_core_network_security_group_security_rule | Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2928 | CKV2_OCI_1 | resource | oci_identity_group | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2929 | CKV2_OCI_1 | resource | oci_identity_user | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2930 | CKV2_OCI_1 | resource | oci_identity_user_group_membership | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2931 | CKV_OPENAPI_1 | resource | securityDefinitions | Ensure that securityDefinitions is defined and not empty - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2932 | CKV_OPENAPI_2 | resource | security | Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2933 | CKV_OPENAPI_3 | resource | components | Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2934 | CKV_OPENAPI_4 | resource | security | Ensure that the global security field has rules defined | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2935 | CKV_OPENAPI_5 | resource | security | Ensure that security operations is not empty. | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2936 | CKV_OPENAPI_6 | resource | security | Ensure that security requirement defined in securityDefinitions - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2937 | CKV_OPENAPI_7 | resource | security | Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2938 | CKV_OPENSTACK_1 | provider | openstack | Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2939 | CKV_OPENSTACK_2 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2940 | CKV_OPENSTACK_2 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2941 | CKV_OPENSTACK_3 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2942 | CKV_OPENSTACK_3 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2943 | CKV_OPENSTACK_4 | resource | openstack_compute_instance_v2 | Ensure that instance does not use basic credentials | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2944 | CKV_OPENSTACK_5 | resource | openstack_fw_rule_v1 | Ensure firewall rule set a destination IP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2945 | CKV_PAN_1 | provider | panos | Ensure no hard coded PAN-OS credentials exist in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2946 | CKV_PAN_2 | resource | panos_management_profile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2947 | CKV_PAN_3 | resource | panos_management_profile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2948 | CKV_PAN_4 | resource | panos_security_policy | Ensure DSRI is not enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2949 | CKV_PAN_4 | resource | panos_security_rule_group | Ensure DSRI is not enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2950 | CKV_PAN_5 | resource | panos_security_policy | Ensure security rules do not have 'applications' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2951 | CKV_PAN_5 | resource | panos_security_rule_group | Ensure security rules do not have 'applications' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2952 | CKV_PAN_6 | resource | panos_security_policy | Ensure security rules do not have 'services' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2953 | CKV_PAN_6 | resource | panos_security_rule_group | Ensure security rules do not have 'services' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2954 | CKV_PAN_7 | resource | panos_security_policy | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2955 | CKV_PAN_7 | resource | panos_security_rule_group | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2956 | CKV_PAN_8 | resource | panos_security_policy | Ensure description is populated within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2957 | CKV_PAN_8 | resource | panos_security_rule_group | Ensure description is populated within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2958 | CKV_PAN_9 | resource | panos_security_policy | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2959 | CKV_PAN_9 | resource | panos_security_rule_group | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2960 | CKV_PAN_10 | resource | panos_security_policy | Ensure logging at session end is enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2961 | CKV_PAN_10 | resource | panos_security_rule_group | Ensure logging at session end is enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2962 | CKV_PAN_11 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2963 | CKV_PAN_11 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2964 | CKV_PAN_12 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2965 | CKV_PAN_12 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2966 | CKV_PAN_13 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2967 | CKV_PAN_13 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2968 | CKV_PAN_14 | resource | panos_panorama_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2969 | CKV_PAN_14 | resource | panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2970 | CKV_PAN_14 | resource | panos_zone_entry | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2971 | CKV_PAN_15 | resource | panos_panorama_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2972 | CKV_PAN_15 | resource | panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2973 | CKV_SECRET_1 | Artifactory Credentials | secrets | Artifactory Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2974 | CKV_SECRET_2 | AWS Access Key | secrets | AWS Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2975 | CKV_SECRET_3 | Azure Storage Account access key | secrets | Azure Storage Account access key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2976 | CKV_SECRET_4 | Basic Auth Credentials | secrets | Basic Auth Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2977 | CKV_SECRET_5 | Cloudant Credentials | secrets | Cloudant Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2978 | CKV_SECRET_6 | Base64 High Entropy String | secrets | Base64 High Entropy String | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2979 | CKV_SECRET_7 | IBM Cloud IAM Key | secrets | IBM Cloud IAM Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2980 | CKV_SECRET_8 | IBM COS HMAC Credentials | secrets | IBM COS HMAC Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2981 | CKV_SECRET_9 | JSON Web Token | secrets | JSON Web Token | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2982 | CKV_SECRET_10 | Secret Keyword | secrets | Secret Keyword | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2983 | CKV_SECRET_11 | Mailchimp Access Key | secrets | Mailchimp Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2984 | CKV_SECRET_12 | NPM tokens | secrets | NPM tokens | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2985 | CKV_SECRET_13 | Private Key | secrets | Private Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2986 | CKV_SECRET_14 | Slack Token | secrets | Slack Token | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2987 | CKV_SECRET_15 | SoftLayer Credentials | secrets | SoftLayer Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2988 | CKV_SECRET_16 | Square OAuth Secret | secrets | Square OAuth Secret | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2989 | CKV_SECRET_17 | Stripe Access Key | secrets | Stripe Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2990 | CKV_SECRET_18 | Twilio API Key | secrets | Twilio API Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2991 | CKV_SECRET_19 | Hex High Entropy String | secrets | Hex High Entropy String | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2992 | CKV_YC_1 | resource | yandex_mdb_clickhouse_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2993 | CKV_YC_1 | resource | yandex_mdb_elasticsearch_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2994 | CKV_YC_1 | resource | yandex_mdb_greenplum_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2995 | CKV_YC_1 | resource | yandex_mdb_kafka_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2996 | CKV_YC_1 | resource | yandex_mdb_mongodb_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2997 | CKV_YC_1 | resource | yandex_mdb_mysql_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2998 | CKV_YC_1 | resource | yandex_mdb_postgresql_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2999 | CKV_YC_1 | resource | yandex_mdb_redis_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3000 | CKV_YC_1 | resource | yandex_mdb_sqlserver_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3001 | CKV_YC_2 | resource | yandex_compute_instance | Ensure compute instance does not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3002 | CKV_YC_3 | resource | yandex_storage_bucket | Ensure storage bucket is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3003 | CKV_YC_4 | resource | yandex_compute_instance | Ensure compute instance does not have serial console enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3004 | CKV_YC_5 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster does not have public IP address. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3005 | CKV_YC_6 | resource | yandex_kubernetes_node_group | Ensure Kubernetes cluster node group does not have public IP addresses. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3006 | CKV_YC_7 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster auto-upgrade is enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3007 | CKV_YC_8 | resource | yandex_kubernetes_node_group | Ensure Kubernetes node group auto-upgrade is enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3008 | CKV_YC_9 | resource | yandex_kms_symmetric_key | Ensure KMS symmetric key is rotated. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3009 | CKV_YC_10 | resource | yandex_kubernetes_cluster | Ensure etcd database is encrypted with KMS key. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3010 | CKV_YC_11 | resource | yandex_compute_instance | Ensure security group is assigned to network interface. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3011 | CKV_YC_12 | resource | yandex_mdb_clickhouse_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3012 | CKV_YC_12 | resource | yandex_mdb_elasticsearch_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3013 | CKV_YC_12 | resource | yandex_mdb_greenplum_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3014 | CKV_YC_12 | resource | yandex_mdb_kafka_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3015 | CKV_YC_12 | resource | yandex_mdb_mongodb_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3016 | CKV_YC_12 | resource | yandex_mdb_mysql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3017 | CKV_YC_12 | resource | yandex_mdb_postgresql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3018 | CKV_YC_12 | resource | yandex_mdb_sqlserver_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3019 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure cloud member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3020 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_member | Ensure cloud member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3021 | CKV_YC_14 | resource | yandex_kubernetes_cluster | Ensure security group is assigned to Kubernetes cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3022 | CKV_YC_15 | resource | yandex_kubernetes_node_group | Ensure security group is assigned to Kubernetes node group. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3023 | CKV_YC_16 | resource | yandex_kubernetes_cluster | Ensure network policy is assigned to Kubernetes cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3024 | CKV_YC_17 | resource | yandex_storage_bucket | Ensure storage bucket does not have public access permissions. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3025 | CKV_YC_18 | resource | yandex_compute_instance_group | Ensure compute instance group does not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3026 | CKV_YC_19 | resource | yandex_vpc_security_group | Ensure security group does not contain allow-all rules. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3027 | CKV_YC_20 | resource | yandex_vpc_security_group_rule | Ensure security group rule is not allow-all. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3028 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_binding | Ensure organization member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3029 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_member | Ensure organization member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3030 | CKV_YC_22 | resource | yandex_compute_instance_group | Ensure compute instance group has security group assigned. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3031 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_binding | Ensure folder member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3032 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_member | Ensure folder member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3033 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3034 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3035 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3036 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3037 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3038 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|------|--------------------------|----------------------------------|--------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV2_ADO_1 | resource | azuredevops_branch_policy_min_reviewers | Ensure at least two approving reviews for PRs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1 | CKV2_ADO_1 | resource | azuredevops_git_repository | Ensure at least two approving reviews for PRs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 2 | CKV_ALI_1 | resource | alicloud_oss_bucket | Alibaba Cloud OSS bucket accessible to public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketPublic.py | +| 3 | CKV_ALI_2 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress22.py | +| 4 | CKV_ALI_3 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress3389.py | +| 5 | CKV_ALI_4 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/ActionTrailLogAllRegions.py | +| 6 | CKV_ALI_5 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all events | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/ActionTrailLogAllEvents.py | +| 7 | CKV_ALI_6 | resource | alicloud_oss_bucket | Ensure OSS bucket is encrypted with Customer Master Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketEncryptedWithCMK.py | +| 8 | CKV_ALI_7 | resource | alicloud_disk | Ensure disk is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/DiskIsEncrypted.py | +| 9 | CKV_ALI_8 | resource | alicloud_disk | Ensure Disk is encrypted with Customer Master Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/DiskEncryptedWithCMK.py | +| 10 | CKV_ALI_9 | resource | alicloud_db_instance | Ensure database instance is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSIsPublic.py | +| 11 | CKV_ALI_10 | resource | alicloud_oss_bucket | Ensure OSS bucket has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketVersioning.py | +| 12 | CKV_ALI_11 | resource | alicloud_oss_bucket | Ensure OSS bucket has transfer Acceleration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketTransferAcceleration.py | +| 13 | CKV_ALI_12 | resource | alicloud_oss_bucket | Ensure the OSS bucket has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketAccessLogs.py | +| 14 | CKV_ALI_13 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires minimum length of 14 or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLength.py | +| 15 | CKV_ALI_14 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one number | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyNumber.py | +| 16 | CKV_ALI_15 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one symbol | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicySymbol.py | +| 17 | CKV_ALI_16 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy expires passwords within 90 days or less | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyExpiration.py | +| 18 | CKV_ALI_17 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one lowercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLowercaseLetter.py | +| 19 | CKV_ALI_18 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy prevents password reuse | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyReuse.py | +| 20 | CKV_ALI_19 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one uppercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyUppcaseLetter.py | +| 21 | CKV_ALI_20 | resource | alicloud_db_instance | Ensure RDS instance uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceSSL.py | +| 22 | CKV_ALI_21 | resource | alicloud_api_gateway_api | Ensure API Gateway API Protocol HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/APIGatewayProtocolHTTPS.py | +| 23 | CKV_ALI_22 | resource | alicloud_db_instance | Ensure Transparent Data Encryption is Enabled on instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSTransparentDataEncryptionEnabled.py | +| 24 | CKV_ALI_23 | resource | alicloud_ram_account_password_policy | Ensure Ram Account Password Policy Max Login Attempts not > 5 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyMaxLogin.py | +| 25 | CKV_ALI_24 | resource | alicloud_ram_security_preference | Ensure RAM enforces MFA | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMSecurityEnforceMFA.py | +| 26 | CKV_ALI_25 | resource | alicloud_db_instance | Ensure RDS Instance SQL Collector Retention Period should be greater than 180 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSRetention.py | +| 27 | CKV_ALI_26 | resource | alicloud_cs_kubernetes | Ensure Kubernetes installs plugin Terway or Flannel to support standard policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/K8sEnableNetworkPolicies.py | +| 28 | CKV_ALI_27 | resource | alicloud_kms_key | Ensure KMS Key Rotation is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/KMSKeyRotationIsEnabled.py | +| 29 | CKV_ALI_28 | resource | alicloud_kms_key | Ensure KMS Keys are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/KMSKeyIsEnabled.py | +| 30 | CKV_ALI_29 | resource | alicloud_alb_acl_entry_attachment | Alibaba ALB ACL does not restrict Access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/ALBACLIsUnrestricted.py | +| 31 | CKV_ALI_30 | resource | alicloud_db_instance | Ensure RDS instance auto upgrades for minor versions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceAutoUpgrade.py | +| 32 | CKV_ALI_31 | resource | alicloud_cs_kubernetes_node_pool | Ensure K8s nodepools are set to auto repair | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/K8sNodePoolAutoRepair.py | +| 33 | CKV_ALI_32 | resource | alicloud_ecs_launch_template | Ensure launch template data disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/LaunchTemplateDisksAreEncrypted.py | +| 34 | CKV_ALI_33 | resource | alicloud_slb_tls_cipher_policy | Alibaba Cloud Cypher Policy are secure | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/TLSPoliciesAreSecure.py | +| 35 | CKV_ALI_35 | resource | alicloud_db_instance | Ensure RDS instance has log_duration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceLogsEnabled.py | +| 36 | CKV_ALI_36 | resource | alicloud_db_instance | Ensure RDS instance has log_disconnections enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceLogDisconnections.py | +| 37 | CKV_ALI_37 | resource | alicloud_db_instance | Ensure RDS instance has log_connections enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceLogConnections.py | +| 38 | CKV_ALI_38 | resource | alicloud_log_audit | Ensure log audit is enabled for RDS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/LogAuditRDSEnabled.py | +| 39 | CKV_ALI_41 | resource | alicloud_mongodb_instance | Ensure MongoDB is deployed inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/MongoDBInsideVPC.py | +| 40 | CKV_ALI_42 | resource | alicloud_mongodb_instance | Ensure Mongodb instance uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/MongoDBInstanceSSL.py | +| 41 | CKV_ALI_43 | resource | alicloud_mongodb_instance | Ensure MongoDB instance is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/MongoDBIsPublic.py | +| 42 | CKV_ALI_44 | resource | alicloud_mongodb_instance | Ensure MongoDB has Transparent Data Encryption Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/MongoDBTransparentDataEncryptionEnabled.py | +| 43 | CKV_ARGO_1 | argo_workflows | spec | Ensure Workflow pods are not using the default ServiceAccount | Argo Workflows | https://github.com/bridgecrewio/checkov/tree/master/checkov/argo_workflows/checks/template/DefaultServiceAccount.py | +| 44 | CKV_ARGO_2 | argo_workflows | spec | Ensure Workflow pods are running as non-root user | Argo Workflows | https://github.com/bridgecrewio/checkov/tree/master/checkov/argo_workflows/checks/template/RunAsNonRoot.py | +| 45 | CKV_AWS_1 | data | aws_iam_policy_document | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py | +| 46 | CKV_AWS_1 | resource | serverless_aws | Ensure IAM policies that allow full "*-*" administrative privileges are not created | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov/serverless/checks/function/aws/AdminPolicyDocument.py | +| 47 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBListenerHTTPS.py | +| 48 | CKV_AWS_2 | resource | aws_alb_listener | Ensure ALB protocol is HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py | +| 49 | CKV_AWS_2 | resource | aws_lb_listener | Ensure ALB protocol is HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py | +| 50 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EBSEncryption.py | +| 51 | CKV_AWS_3 | resource | aws_ebs_volume | Ensure all data stored in the EBS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EBSEncryption.py | +| 52 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchEncryption.py | +| 53 | CKV_AWS_5 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py | +| 54 | CKV_AWS_5 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py | +| 55 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py | +| 56 | CKV_AWS_6 | resource | aws_elasticsearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py | +| 57 | CKV_AWS_6 | resource | aws_opensearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py | +| 58 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KMSRotation.py | +| 59 | CKV_AWS_7 | resource | aws_kms_key | Ensure rotation for customer created CMKs is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KMSRotation.py | +| 60 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LaunchConfigurationEBSEncryption.py | +| 61 | CKV_AWS_8 | resource | aws_instance | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py | +| 62 | CKV_AWS_8 | resource | aws_launch_configuration | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py | +| 63 | CKV_AWS_9 | resource | aws_iam_account_password_policy | Ensure IAM password policy expires passwords within 90 days or less | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyExpiration.py | +| 64 | CKV_AWS_10 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires minimum length of 14 or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyLength.py | +| 65 | CKV_AWS_11 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one lowercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyLowercaseLetter.py | +| 66 | CKV_AWS_12 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one number | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyNumber.py | +| 67 | CKV_AWS_13 | resource | aws_iam_account_password_policy | Ensure IAM password policy prevents password reuse | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyReuse.py | +| 68 | CKV_AWS_14 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one symbol | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicySymbol.py | +| 69 | CKV_AWS_15 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one uppercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyUppercaseLetter.py | +| 70 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSEncryption.py | +| 71 | CKV_AWS_16 | resource | aws_db_instance | Ensure all data stored in the RDS is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSEncryption.py | +| 72 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py | +| 73 | CKV_AWS_17 | resource | aws_db_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py | +| 74 | CKV_AWS_17 | resource | aws_rds_cluster_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py | +| 75 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3AccessLogs.py | +| 76 | CKV_AWS_18 | resource | aws_s3_bucket | Ensure the S3 bucket has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 77 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3Encryption.py | +| 78 | CKV_AWS_19 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 79 | CKV_AWS_19 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 80 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3PublicACLRead.py | +| 81 | CKV_AWS_20 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public READ access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 82 | CKV_AWS_20 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public READ access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 83 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3Versioning.py | +| 84 | CKV_AWS_21 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 85 | CKV_AWS_21 | resource | aws_s3_bucket_versioning | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 86 | CKV_AWS_22 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker Notebook is encrypted at rest using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SagemakerNotebookEncryption.py | +| 87 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 88 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 89 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 90 | CKV_AWS_23 | resource | aws_db_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 91 | CKV_AWS_23 | resource | aws_elasticache_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 92 | CKV_AWS_23 | resource | aws_redshift_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 93 | CKV_AWS_23 | resource | aws_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 94 | CKV_AWS_23 | resource | aws_security_group_rule | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 95 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 96 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 97 | CKV_AWS_24 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 98 | CKV_AWS_24 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 99 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 100 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 101 | CKV_AWS_25 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 102 | CKV_AWS_25 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 103 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SNSTopicEncryption.py | +| 104 | CKV_AWS_26 | resource | aws_sns_topic | Ensure all data stored in the SNS topic is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SNSTopicEncryption.py | +| 105 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SQSQueueEncryption.py | +| 106 | CKV_AWS_27 | resource | aws_sqs_queue | Ensure all data stored in the SQS queue is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SQSQueueEncryption.py | +| 107 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure Dynamodb point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamodbRecovery.py | +| 108 | CKV_AWS_28 | resource | aws_dynamodb_table | Ensure Dynamodb point in time recovery (backup) is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DynamodbRecovery.py | +| 109 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py | +| 110 | CKV_AWS_29 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py | +| 111 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py | +| 112 | CKV_AWS_30 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py | +| 113 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py | +| 114 | CKV_AWS_31 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py | +| 115 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRPolicy.py | +| 116 | CKV_AWS_32 | resource | aws_ecr_repository_policy | Ensure ECR policy is not set to public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECRPolicy.py | +| 117 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KMSKeyWildCardPrincipal.py | +| 118 | CKV_AWS_33 | resource | aws_kms_key | Ensure KMS key policy does not contain wildcard (*) principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KMSKeyWildcardPrincipal.py | +| 119 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionEncryption.py | +| 120 | CKV_AWS_34 | resource | aws_cloudfront_distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudfrontDistributionEncryption.py | +| 121 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailEncryption.py | +| 122 | CKV_AWS_35 | resource | aws_cloudtrail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailEncryptionWithCMK.py | +| 123 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailLogValidation.py | +| 124 | CKV_AWS_36 | resource | aws_cloudtrail | Ensure CloudTrail log file validation is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailLogValidation.py | +| 125 | CKV_AWS_37 | resource | aws_eks_cluster | Ensure Amazon EKS control plane logging enabled for all log types | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSControlPlaneLogging.py | +| 126 | CKV_AWS_38 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSPublicAccessCIDR.py | +| 127 | CKV_AWS_39 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSPublicAccess.py | +| 128 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 129 | CKV_AWS_40 | resource | aws_iam_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 130 | CKV_AWS_40 | resource | aws_iam_user_policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 131 | CKV_AWS_40 | resource | aws_iam_user_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 132 | CKV_AWS_41 | provider | aws | Ensure no hard coded AWS access key and secret key exists in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/aws/credentials.py | +| 133 | CKV_AWS_41 | resource | serverless_aws | Ensure no hard coded AWS access key and secret key exists in provider | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov/serverless/checks/function/aws/AWSCredentials.py | +| 134 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EFSEncryptionEnabled.py | +| 135 | CKV_AWS_42 | resource | aws_efs_file_system | Ensure EFS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EFSEncryptionEnabled.py | +| 136 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KinesisStreamEncryptionType.py | +| 137 | CKV_AWS_43 | resource | aws_kinesis_stream | Ensure Kinesis Stream is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisStreamEncryptionType.py | +| 138 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/NeptuneClusterStorageEncrypted.py | +| 139 | CKV_AWS_44 | resource | aws_neptune_cluster | Ensure Neptune storage is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterStorageEncrypted.py | +| 140 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py | +| 141 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py | +| 142 | CKV_AWS_45 | resource | aws_lambda_function | Ensure no hard-coded secrets exist in lambda environment | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaEnvironmentCredentials.py | +| 143 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2Credentials.py | +| 144 | CKV_AWS_46 | resource | aws_instance | Ensure no hard-coded secrets exist in EC2 user data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2Credentials.py | +| 145 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DAXEncryption.py | +| 146 | CKV_AWS_47 | resource | aws_dax_cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DAXEncryption.py | +| 147 | CKV_AWS_48 | resource | aws_mq_broker | Ensure MQ Broker logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerLogging.py | +| 148 | CKV_AWS_49 | data | aws_iam_policy_document | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py | +| 149 | CKV_AWS_49 | resource | serverless_aws | Ensure no IAM policies documents allow "*" as a statement's actions | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov/serverless/checks/function/aws/StarActionPolicyDocument.py | +| 150 | CKV_AWS_50 | resource | aws_lambda_function | X-ray tracing is enabled for Lambda | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py | +| 151 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRImmutableTags.py | +| 152 | CKV_AWS_51 | resource | aws_ecr_repository | Ensure ECR Image Tags are immutable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECRImmutableTags.py | +| 153 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLS enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3BlockPublicACLs.py | +| 154 | CKV_AWS_53 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public ACLS enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3BlockPublicACLs.py | +| 155 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3BlockPublicPolicy.py | +| 156 | CKV_AWS_54 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public policy enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3BlockPublicPolicy.py | +| 157 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3IgnorePublicACLs.py | +| 158 | CKV_AWS_55 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has ignore public ACLs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3IgnorePublicACLs.py | +| 159 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has 'restrict_public_bucket' enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3RestrictPublicBuckets.py | +| 160 | CKV_AWS_56 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has 'restrict_public_bucket' enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3RestrictPublicBuckets.py | +| 161 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3PublicACLWrite.py | +| 162 | CKV_AWS_57 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 163 | CKV_AWS_57 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 164 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EKSSecretsEncryption.py | +| 165 | CKV_AWS_58 | resource | aws_eks_cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSSecretsEncryption.py | +| 166 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py | +| 167 | CKV_AWS_59 | resource | aws_api_gateway_method | Ensure there is no open access to back-end resources through API | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py | +| 168 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMRoleAllowsPublicAssume.py | +| 169 | CKV_AWS_60 | resource | aws_iam_role | Ensure IAM role allows only specific services or principals to assume it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py | +| 170 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py | +| 171 | CKV_AWS_61 | resource | aws_iam_role | Ensure AWS IAM policy does not allow assume role permission across all services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py | +| 172 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 173 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 174 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 175 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 176 | CKV_AWS_62 | resource | aws_iam_group_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 177 | CKV_AWS_62 | resource | aws_iam_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 178 | CKV_AWS_62 | resource | aws_iam_role_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 179 | CKV_AWS_62 | resource | aws_iam_user_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 180 | CKV_AWS_62 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 181 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 182 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 183 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 184 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 185 | CKV_AWS_63 | resource | aws_iam_group_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 186 | CKV_AWS_63 | resource | aws_iam_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 187 | CKV_AWS_63 | resource | aws_iam_role_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 188 | CKV_AWS_63 | resource | aws_iam_user_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 189 | CKV_AWS_63 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 190 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py | +| 191 | CKV_AWS_64 | resource | aws_redshift_cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterEncryption.py | +| 192 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py | +| 193 | CKV_AWS_65 | resource | aws_ecs_cluster | Ensure container insights are enabled on ECS cluster | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py | +| 194 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupRetention.py | +| 195 | CKV_AWS_66 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group specifies retention days | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetention.py | +| 196 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailMultiRegion.py | +| 197 | CKV_AWS_67 | resource | aws_cloudtrail | Ensure CloudTrail is enabled in all Regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailMultiRegion.py | +| 198 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WAFEnabled.py | +| 199 | CKV_AWS_68 | resource | aws_cloudfront_distribution | CloudFront Distribution should have WAF enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFEnabled.py | +| 200 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AmazonMQBrokerPublicAccess.py | +| 201 | CKV_AWS_69 | resource | aws_mq_broker | Ensure MQ Broker is not publicly exposed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerNotPubliclyExposed.py | +| 202 | CKV_AWS_70 | resource | aws_s3_bucket | Ensure S3 bucket does not allow an action with any Principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py | +| 203 | CKV_AWS_70 | resource | aws_s3_bucket_policy | Ensure S3 bucket does not allow an action with any Principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py | +| 204 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterLogging.py | +| 205 | CKV_AWS_71 | resource | aws_redshift_cluster | Ensure Redshift Cluster logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterLogging.py | +| 206 | CKV_AWS_72 | resource | aws_sqs_queue_policy | Ensure SQS policy does not allow ALL (*) actions. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SQSPolicy.py | +| 207 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py | +| 208 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py | +| 209 | CKV_AWS_73 | resource | aws_api_gateway_stage | Ensure API Gateway has X-Ray Tracing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayXray.py | +| 210 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBEncryption.py | +| 211 | CKV_AWS_74 | resource | aws_docdb_cluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBEncryption.py | +| 212 | CKV_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure Global Accelerator accelerator has flow logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlobalAcceleratorAcceleratorFlowLogs.py | +| 213 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py | +| 214 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py | +| 215 | CKV_AWS_76 | resource | aws_api_gateway_stage | Ensure API Gateway has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py | +| 216 | CKV_AWS_76 | resource | aws_apigatewayv2_stage | Ensure API Gateway has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py | +| 217 | CKV_AWS_77 | resource | aws_athena_database | Ensure Athena Database is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AthenaDatabaseEncryption.py | +| 218 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CodeBuildProjectEncryption.py | +| 219 | CKV_AWS_78 | resource | aws_codebuild_project | Ensure that CodeBuild Project encryption is not disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py | +| 220 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IMDSv1Disabled.py | +| 221 | CKV_AWS_79 | resource | aws_instance | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py | +| 222 | CKV_AWS_79 | resource | aws_launch_configuration | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py | +| 223 | CKV_AWS_79 | resource | aws_launch_template | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py | +| 224 | CKV_AWS_80 | resource | aws_msk_cluster | Ensure MSK Cluster logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MSKClusterLogging.py | +| 225 | CKV_AWS_81 | resource | aws_msk_cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py | +| 226 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AthenaWorkgroupConfiguration.py | +| 227 | CKV_AWS_82 | resource | aws_athena_workgroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AthenaWorkgroupConfiguration.py | +| 228 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py | +| 229 | CKV_AWS_83 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py | +| 230 | CKV_AWS_83 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py | +| 231 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py | +| 232 | CKV_AWS_84 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py | +| 233 | CKV_AWS_84 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py | +| 234 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocDB Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBLogging.py | +| 235 | CKV_AWS_85 | resource | aws_docdb_cluster | Ensure DocDB Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBLogging.py | +| 236 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure Cloudfront distribution has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionLogging.py | +| 237 | CKV_AWS_86 | resource | aws_cloudfront_distribution | Ensure Cloudfront distribution has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudfrontDistributionLogging.py | +| 238 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterPubliclyAccessible.py | +| 239 | CKV_AWS_87 | resource | aws_redshift_cluster | Redshift cluster should not be publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshitClusterPubliclyAvailable.py | +| 240 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py | +| 241 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py | +| 242 | CKV_AWS_88 | resource | aws_instance | EC2 instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2PublicIP.py | +| 243 | CKV_AWS_88 | resource | aws_launch_template | EC2 instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2PublicIP.py | +| 244 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py | +| 245 | CKV_AWS_89 | resource | aws_dms_replication_instance | DMS replication instance should not be publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py | +| 246 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB TLS is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBTLS.py | +| 247 | CKV_AWS_90 | resource | aws_docdb_cluster_parameter_group | Ensure DocDB TLS is not disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBTLS.py | +| 248 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ELBv2AccessLogs.py | +| 249 | CKV_AWS_91 | resource | aws_alb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py | +| 250 | CKV_AWS_91 | resource | aws_lb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py | +| 251 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ELBAccessLogs.py | +| 252 | CKV_AWS_92 | resource | aws_elb | Ensure the ELB has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBAccessLogs.py | +| 253 | CKV_AWS_93 | resource | aws_s3_bucket | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py | +| 254 | CKV_AWS_93 | resource | aws_s3_bucket_policy | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py | +| 255 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueDataCatalogEncryption.py | +| 256 | CKV_AWS_94 | resource | aws_glue_data_catalog_encryption_settings | Ensure Glue Data Catalog Encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueDataCatalogEncryption.py | +| 257 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py | +| 258 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py | +| 259 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AuroraEncryption.py | +| 260 | CKV_AWS_96 | resource | aws_rds_cluster | Ensure all data stored in Aurora is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AuroraEncryption.py | +| 261 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py | +| 262 | CKV_AWS_97 | resource | aws_ecs_task_definition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py | +| 263 | CKV_AWS_98 | resource | aws_sagemaker_endpoint_configuration | Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SagemakerEndpointConfigurationEncryption.py | +| 264 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfiguration.py | +| 265 | CKV_AWS_99 | resource | aws_glue_security_configuration | Ensure Glue Security Configuration Encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueSecurityConfiguration.py | +| 266 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EKSNodeGroupRemoteAccess.py | +| 267 | CKV_AWS_100 | resource | aws_eks_node_group | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSNodeGroupRemoteAccess.py | +| 268 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/NeptuneClusterLogging.py | +| 269 | CKV_AWS_101 | resource | aws_neptune_cluster | Ensure Neptune logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterLogging.py | +| 270 | CKV_AWS_102 | resource | aws_neptune_cluster_instance | Ensure Neptune Cluster instance is not publicly available | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterInstancePublic.py | +| 271 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBListenerTLS12.py | +| 272 | CKV_AWS_103 | resource | aws_alb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 273 | CKV_AWS_103 | resource | aws_lb | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 274 | CKV_AWS_103 | resource | aws_lb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 275 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB has audit logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBAuditLogs.py | +| 276 | CKV_AWS_104 | resource | aws_docdb_cluster_parameter_group | Ensure DocDB has audit logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBAuditLogs.py | +| 277 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedShiftSSL.py | +| 278 | CKV_AWS_105 | resource | aws_redshift_parameter_group | Ensure Redshift uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedShiftSSL.py | +| 279 | CKV_AWS_106 | resource | aws_ebs_encryption_by_default | Ensure EBS default encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EBSDefaultEncryption.py | +| 280 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 281 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 282 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 283 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 284 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 285 | CKV_AWS_107 | data | aws_iam_policy_document | Ensure IAM policies does not allow credentials exposure | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py | +| 286 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 287 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 288 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 289 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 290 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 291 | CKV_AWS_108 | data | aws_iam_policy_document | Ensure IAM policies does not allow data exfiltration | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMDataExfiltration.py | +| 292 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 293 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 294 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 295 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 296 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 297 | CKV_AWS_109 | data | aws_iam_policy_document | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py | +| 298 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 299 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 300 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 301 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 302 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 303 | CKV_AWS_110 | data | aws_iam_policy_document | Ensure IAM policies does not allow privilege escalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py | +| 304 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 305 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 306 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 307 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 308 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 309 | CKV_AWS_111 | data | aws_iam_policy_document | Ensure IAM policies does not allow write access without constraints | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMWriteAccess.py | +| 310 | CKV_AWS_112 | resource | aws_ssm_document | Ensure Session Manager data is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentEncryption.py | +| 311 | CKV_AWS_113 | resource | aws_ssm_document | Ensure Session Manager logs are enabled and encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentLogging.py | +| 312 | CKV_AWS_114 | resource | aws_emr_cluster | Ensure that EMR clusters with Kerberos have Kerberos Realm set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py | +| 313 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py | +| 314 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py | +| 315 | CKV_AWS_115 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py | +| 316 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py | +| 317 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py | +| 318 | CKV_AWS_116 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaDLQConfigured.py | +| 319 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py | +| 320 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py | +| 321 | CKV_AWS_117 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaInVPC.py | +| 322 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSEnhancedMonitorEnabled.py | +| 323 | CKV_AWS_118 | resource | aws_db_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py | +| 324 | CKV_AWS_118 | resource | aws_rds_cluster_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py | +| 325 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamoDBTablesEncrypted.py | +| 326 | CKV_AWS_119 | resource | aws_dynamodb_table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py | +| 327 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py | +| 328 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py | +| 329 | CKV_AWS_120 | resource | aws_api_gateway_stage | Ensure API Gateway caching is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayCacheEnable.py | +| 330 | CKV_AWS_121 | resource | aws_config_configuration_aggregator | Ensure AWS Config is enabled in all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ConfigConfgurationAggregatorAllRegions.py | +| 331 | CKV_AWS_122 | resource | aws_sagemaker_notebook_instance | Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SageMakerInternetAccessDisabled.py | +| 332 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/VPCEndpointAcceptanceConfigured.py | +| 333 | CKV_AWS_123 | resource | aws_vpc_endpoint_service | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/VPCEndpointAcceptanceConfigured.py | +| 334 | CKV_AWS_124 | resource | aws_cloudformation_stack | Ensure that CloudFormation stacks are sending event notifications to an SNS topic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudformationStackNotificationArns.py | +| 335 | CKV_AWS_126 | resource | aws_instance | Ensure that detailed monitoring is enabled for EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2DetailedMonitoringEnabled.py | +| 336 | CKV_AWS_127 | resource | aws_elb | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBUsesSSL.py | +| 337 | CKV_AWS_128 | resource | aws_rds_cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSEnableIAMAuthentication.py | +| 338 | CKV_AWS_129 | resource | aws_db_instance | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceLogging.py | +| 339 | CKV_AWS_130 | resource | aws_subnet | Ensure VPC subnets do not assign public IP by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SubnetPublicIP.py | +| 340 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBDropHttpHeaders.py | +| 341 | CKV_AWS_131 | resource | aws_alb | Ensure that ALB drops HTTP headers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py | +| 342 | CKV_AWS_131 | resource | aws_lb | Ensure that ALB drops HTTP headers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py | +| 343 | CKV_AWS_133 | resource | aws_db_instance | Ensure that RDS instances has backup policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py | +| 344 | CKV_AWS_133 | resource | aws_rds_cluster | Ensure that RDS instances has backup policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py | +| 345 | CKV_AWS_134 | resource | aws_elasticache_cluster | Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticCacheAutomaticBackup.py | +| 346 | CKV_AWS_135 | resource | aws_instance | Ensure that EC2 is EBS optimized | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2EBSOptimized.py | +| 347 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRRepositoryEncrypted.py | +| 348 | CKV_AWS_136 | resource | aws_ecr_repository | Ensure that ECR repositories are encrypted using KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECRRepositoryEncrypted.py | +| 349 | CKV_AWS_137 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py | +| 350 | CKV_AWS_137 | resource | aws_opensearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py | +| 351 | CKV_AWS_138 | resource | aws_elb | Ensure that ELB is cross-zone-load-balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBCrossZoneEnable.py | +| 352 | CKV_AWS_139 | resource | aws_rds_cluster | Ensure that RDS clusters have deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSDeletionProtection.py | +| 353 | CKV_AWS_140 | resource | aws_rds_global_cluster | Ensure that RDS global clusters are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSClusterEncrypted.py | +| 354 | CKV_AWS_141 | resource | aws_redshift_cluster | Ensured that redshift cluster allowing version upgrade by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterAllowVersionUpgrade.py | +| 355 | CKV_AWS_142 | resource | aws_redshift_cluster | Ensure that Redshift cluster is encrypted by KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterKMSKey.py | +| 356 | CKV_AWS_143 | resource | aws_s3_bucket | Ensure that S3 bucket has lock configuration enabled by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3BucketObjectLock.py | +| 357 | CKV_AWS_144 | resource | aws_s3_bucket | Ensure that S3 bucket has cross-region replication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 358 | CKV_AWS_144 | resource | aws_s3_bucket_replication_configuration | Ensure that S3 bucket has cross-region replication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 359 | CKV_AWS_145 | resource | aws_s3_bucket | Ensure that S3 buckets are encrypted with KMS by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 360 | CKV_AWS_145 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure that S3 buckets are encrypted with KMS by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 361 | CKV_AWS_146 | resource | aws_db_cluster_snapshot | Ensure that RDS database cluster snapshot is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSClusterSnapshotEncrypted.py | +| 362 | CKV_AWS_147 | resource | aws_codebuild_project | Ensure that CodeBuild projects are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodeBuildEncrypted.py | +| 363 | CKV_AWS_148 | resource | aws_default_vpc | Ensure no default VPC is planned to be provisioned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/VPCDefaultNetwork.py | +| 364 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecretManagerSecretEncrypted.py | +| 365 | CKV_AWS_149 | resource | aws_secretsmanager_secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecretManagerSecretEncrypted.py | +| 366 | CKV_AWS_150 | resource | aws_alb | Ensure that Load Balancer has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBDeletionProtection.py | +| 367 | CKV_AWS_150 | resource | aws_lb | Ensure that Load Balancer has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBDeletionProtection.py | +| 368 | CKV_AWS_152 | resource | aws_alb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBCrossZone.py | +| 369 | CKV_AWS_152 | resource | aws_lb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBCrossZone.py | +| 370 | CKV_AWS_153 | resource | aws_autoscaling_group | Autoscaling groups should supply tags to launch configurations | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AutoScalingTagging.py | +| 371 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftInEc2ClassicMode.py | +| 372 | CKV_AWS_154 | resource | aws_redshift_cluster | Ensure Redshift is not deployed outside of a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftInEc2ClassicMode.py | +| 373 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WorkspaceUserVolumeEncrypted.py | +| 374 | CKV_AWS_155 | resource | aws_workspaces_workspace | Ensure that Workspace user volumes are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WorkspaceUserVolumeEncrypted.py | +| 375 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WorkspaceRootVolumeEncrypted.py | +| 376 | CKV_AWS_156 | resource | aws_workspaces_workspace | Ensure that Workspace root volumes are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WorkspaceRootVolumeEncrypted.py | +| 377 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py | +| 378 | CKV_AWS_157 | resource | aws_db_instance | Ensure that RDS instances have Multi-AZ enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSMultiAZEnabled.py | +| 379 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupKMSKey.py | +| 380 | CKV_AWS_158 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group is encrypted by KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudWatchLogGroupKMSKey.py | +| 381 | CKV_AWS_159 | resource | aws_athena_workgroup | Ensure that Athena Workgroup is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AthenaWorkgroupEncryption.py | +| 382 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/TimestreamDatabaseKMSKey.py | +| 383 | CKV_AWS_160 | resource | aws_timestreamwrite_database | Ensure that Timestream database is encrypted with KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/TimestreamDatabaseKMSKey.py | +| 384 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSIAMAuthentication.py | +| 385 | CKV_AWS_161 | resource | aws_db_instance | Ensure RDS database has IAM authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSIAMAuthentication.py | +| 386 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSClusterIAMAuthentication.py | +| 387 | CKV_AWS_162 | resource | aws_rds_cluster | Ensure RDS cluster has IAM authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSClusterIAMAuthentication.py | +| 388 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRImageScanning.py | +| 389 | CKV_AWS_163 | resource | aws_ecr_repository | Ensure ECR image scanning on push is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECRImageScanning.py | +| 390 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/TransferServerIsPublic.py | +| 391 | CKV_AWS_164 | resource | aws_transfer_server | Ensure Transfer Server is not exposed publicly. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/TransferServerIsPublic.py | +| 392 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure Dynamodb global table point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamodbGlobalTableRecovery.py | +| 393 | CKV_AWS_165 | resource | aws_dynamodb_global_table | Ensure Dynamodb point in time recovery (backup) is enabled for global tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DynamoDBGlobalTableRecovery.py | +| 394 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/BackupVaultEncrypted.py | +| 395 | CKV_AWS_166 | resource | aws_backup_vault | Ensure Backup Vault is encrypted at rest using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/BackupVaultEncrypted.py | +| 396 | CKV_AWS_167 | resource | aws_glacier_vault | Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlacierVaultAnyPrincipal.py | +| 397 | CKV_AWS_168 | resource | aws_sqs_queue | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py | +| 398 | CKV_AWS_168 | resource | aws_sqs_queue_policy | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py | +| 399 | CKV_AWS_169 | resource | aws_sns_topic_policy | Ensure SNS topic policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SNSTopicPolicyAnyPrincipal.py | +| 400 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/QLDBLedgerPermissionsMode.py | +| 401 | CKV_AWS_170 | resource | aws_qldb_ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/QLDBLedgerPermissionsMode.py | +| 402 | CKV_AWS_171 | resource | aws_emr_security_configuration | Ensure Cluster security configuration encryption is using SSE-KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EMRClusterIsEncryptedKMS.py | +| 403 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/QLDBLedgerDeletionProtection.py | +| 404 | CKV_AWS_172 | resource | aws_qldb_ledger | Ensure QLDB ledger has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/QLDBLedgerDeletionProtection.py | +| 405 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py | +| 406 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py | +| 407 | CKV_AWS_173 | resource | aws_lambda_function | Check encryption settings for Lambda environmental variable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py | +| 408 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudFrontTLS12.py | +| 409 | CKV_AWS_174 | resource | aws_cloudfront_distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py | +| 410 | CKV_AWS_175 | resource | aws_waf_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py | +| 411 | CKV_AWS_175 | resource | aws_wafregional_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py | +| 412 | CKV_AWS_175 | resource | aws_wafv2_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py | +| 413 | CKV_AWS_176 | resource | aws_waf_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasLogs.py | +| 414 | CKV_AWS_176 | resource | aws_wafregional_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasLogs.py | +| 415 | CKV_AWS_177 | resource | aws_kinesis_video_stream | Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisVideoEncryptedWithCMK.py | +| 416 | CKV_AWS_178 | resource | aws_fsx_ontap_file_system | Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/FSXOntapFSEncryptedWithCMK.py | +| 417 | CKV_AWS_179 | resource | aws_fsx_windows_file_system | Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/FSXWindowsFSEncryptedWithCMK.py | +| 418 | CKV_AWS_180 | resource | aws_imagebuilder_component | Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ImagebuilderComponentEncryptedWithCMK.py | +| 419 | CKV_AWS_181 | resource | aws_s3_object_copy | Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3ObjectCopyEncryptedWithCMK.py | +| 420 | CKV_AWS_182 | resource | aws_docdb_cluster | Ensure Doc DB is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBEncryptedWithCMK.py | +| 421 | CKV_AWS_183 | resource | aws_ebs_snapshot_copy | Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EBSSnapshotCopyEncryptedWithCMK.py | +| 422 | CKV_AWS_184 | resource | aws_efs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EFSFileSystemEncryptedWithCMK.py | +| 423 | CKV_AWS_185 | resource | aws_kinesis_stream | Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisStreamEncryptedWithCMK.py | +| 424 | CKV_AWS_186 | resource | aws_s3_bucket_object | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3BucketObjectEncryptedWithCMK.py | +| 425 | CKV_AWS_187 | resource | aws_sagemaker_domain | Ensure Sagemaker domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SagemakerDomainEncryptedWithCMK.py | +| 426 | CKV_AWS_188 | resource | aws_redshift_cluster | Ensure RedShift Cluster is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterEncryptedWithCMK.py | +| 427 | CKV_AWS_189 | resource | aws_ebs_volume | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EBSVolumeEncryptedWithCMK.py | +| 428 | CKV_AWS_190 | resource | aws_fsx_lustre_file_system | Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LustreFSEncryptedWithCMK.py | +| 429 | CKV_AWS_191 | resource | aws_elasticache_replication_group | Ensure Elasticache replication group is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptedWithCMK.py | +| 430 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WAFACLCVE202144228.py | +| 431 | CKV_AWS_192 | resource | aws_wafv2_web_acl | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py | +| 432 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AppSyncLogging.py | +| 433 | CKV_AWS_193 | resource | aws_appsync_graphql_api | Ensure AppSync has Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppSyncLogging.py | +| 434 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AppSyncFieldLevelLogs.py | +| 435 | CKV_AWS_194 | resource | aws_appsync_graphql_api | Ensure AppSync has Field-Level logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppSyncFieldLevelLogs.py | +| 436 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 437 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 438 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 439 | CKV_AWS_195 | resource | aws_glue_crawler | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 440 | CKV_AWS_195 | resource | aws_glue_dev_endpoint | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 441 | CKV_AWS_195 | resource | aws_glue_job | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 442 | CKV_AWS_196 | resource | aws_elasticache_security_group | Ensure no aws_elasticache_security_group resources exist | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheHasSecurityGroup.py | +| 443 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/MQBrokerAuditLogging.py | +| 444 | CKV_AWS_197 | resource | aws_mq_broker | Ensure MQ Broker Audit logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerAuditLogging.py | +| 445 | CKV_AWS_198 | resource | aws_db_security_group | Ensure no aws_db_security_group resources exist | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSHasSecurityGroup.py | +| 446 | CKV_AWS_199 | resource | aws_imagebuilder_distribution_configuration | Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ImagebuilderDistributionConfigurationEncryptedWithCMK.py | +| 447 | CKV_AWS_200 | resource | aws_imagebuilder_image_recipe | Ensure that Image Recipe EBS Disk are encrypted with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ImagebuilderImageRecipeEBSEncrypted.py | +| 448 | CKV_AWS_201 | resource | aws_memorydb_cluster | Ensure MemoryDB is encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MemoryDBEncryptionWithCMK.py | +| 449 | CKV_AWS_202 | resource | aws_memorydb_cluster | Ensure MemoryDB data is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MemoryDBClusterIntransitEncryption.py | +| 450 | CKV_AWS_203 | resource | aws_fsx_openzfs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/FSXOpenZFSFileSystemEncryptedWithCMK.py | +| 451 | CKV_AWS_204 | resource | aws_ami | Ensure AMIs are encrypted using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AMIEncryption.py | +| 452 | CKV_AWS_205 | resource | aws_ami_launch_permission | Ensure to Limit AMI launch Permissions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AMILaunchIsShared.py | +| 453 | CKV_AWS_206 | resource | aws_api_gateway_domain_name | Ensure API Gateway Domain uses a modern security Policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayDomainNameTLS.py | +| 454 | CKV_AWS_207 | resource | aws_mq_broker | Ensure MQ Broker minor version updates are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerMinorAutoUpgrade.py | +| 455 | CKV_AWS_208 | resource | aws_mq_broker | Ensure MQBroker version is current | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerVersion.py | +| 456 | CKV_AWS_208 | resource | aws_mq_configuration | Ensure MQBroker version is current | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerVersion.py | +| 457 | CKV_AWS_209 | resource | aws_mq_broker | Ensure MQ broker encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerEncryptedWithCMK.py | +| 458 | CKV_AWS_210 | resource | aws_batch_job_definition | Batch job does not define a privileged container | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/BatchJobIsNotPrivileged.py | +| 459 | CKV_AWS_211 | resource | aws_db_instance | Ensure RDS uses a modern CaCert | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py | +| 460 | CKV_AWS_212 | resource | aws_dms_replication_instance | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DMSReplicationInstanceEncryptedWithCMK.py | +| 461 | CKV_AWS_213 | resource | aws_load_balancer_policy | Ensure ELB Policy uses only secure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBPolicyUsesSecureProtocols.py | +| 462 | CKV_AWS_214 | resource | aws_appsync_api_cache | Ensure Appsync API Cache is encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionAtRest.py | +| 463 | CKV_AWS_215 | resource | aws_appsync_api_cache | Ensure Appsync API Cache is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionInTransit.py | +| 464 | CKV_AWS_216 | resource | aws_cloudfront_distribution | Ensure Cloudfront distribution is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudfrontDistributionEnabled.py | +| 465 | CKV_AWS_217 | resource | aws_api_gateway_deployment | Ensure Create before destroy for API deployments | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayDeploymentCreateBeforeDestroy.py | +| 466 | CKV_AWS_218 | resource | aws_cloudsearch_domain | Ensure that Cloudsearch is using latest TLS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudsearchDomainTLS.py | +| 467 | CKV_AWS_219 | resource | aws_codepipeline | Ensure Code Pipeline Artifact store is using a KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodePipelineArtifactsEncrypted.py | +| 468 | CKV_AWS_220 | resource | aws_cloudsearch_domain | Ensure that Cloudsearch is using https | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudsearchDomainEnforceHttps.py | +| 469 | CKV_AWS_221 | resource | aws_codeartifact_domain | Ensure Code artifact Domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodeArtifactDomainEncryptedWithCMK.py | +| 470 | CKV_AWS_222 | resource | aws_dms_replication_instance | Ensure DMS instance gets all minor upgrade automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DMSReplicationInstanceMinorUpgrade.py | +| 471 | CKV_AWS_223 | resource | aws_ecs_cluster | Ensure ECS Cluster enables logging of ECS Exec | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSClusterLoggingEnabled.py | +| 472 | CKV_AWS_224 | resource | aws_ecs_cluster | Ensure Cluster logging with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py | +| 473 | CKV_AWS_225 | resource | aws_api_gateway_method_settings | Ensure API Gateway method setting caching is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsCacheEnabled.py | +| 474 | CKV_AWS_226 | resource | aws_db_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py | +| 475 | CKV_AWS_226 | resource | aws_rds_cluster_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py | +| 476 | CKV_AWS_227 | resource | aws_kms_key | Ensure KMS key is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KMSKeyIsEnabled.py | +| 477 | CKV_AWS_228 | resource | aws_elasticsearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py | +| 478 | CKV_AWS_228 | resource | aws_opensearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py | +| 479 | CKV_AWS_229 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py | +| 480 | CKV_AWS_229 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py | +| 481 | CKV_AWS_230 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py | +| 482 | CKV_AWS_230 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py | +| 483 | CKV_AWS_231 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py | +| 484 | CKV_AWS_231 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py | +| 485 | CKV_AWS_232 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py | +| 486 | CKV_AWS_232 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py | +| 487 | CKV_AWS_233 | resource | aws_acm_certificate | Ensure Create before destroy for ACM certificates | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ACMCertCreateBeforeDestroy.py | +| 488 | CKV_AWS_234 | resource | aws_acm_certificate | Verify logging preference for ACM certificates | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ACMCertSetLoggingPreference.py | +| 489 | CKV_AWS_235 | resource | aws_ami_copy | Ensure that copied AMIs are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AMICopyIsEncrypted.py | +| 490 | CKV_AWS_236 | resource | aws_ami_copy | Ensure AMI copying uses a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AMICopyUsesCMK.py | +| 491 | CKV_AWS_237 | resource | aws_api_gateway_rest_api | Ensure Create before destroy for API GATEWAY | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayCreateBeforeDestroy.py | +| 492 | CKV_AWS_238 | resource | aws_guardduty_detector | Ensure that Guard Duty detector is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GuarddutyDetectorEnabled.py | +| 493 | CKV_AWS_239 | resource | aws_dax_cluster | Ensure DAX cluster endpoint is using TLS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DAXEndpointTLS.py | +| 494 | CKV_AWS_240 | resource | aws_kinesis_firehose_delivery_stream | Ensure Kinesis Firehose delivery stream is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamSSE.py | +| 495 | CKV_AWS_241 | resource | aws_kinesis_firehose_delivery_stream | Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamUsesCMK.py | +| 496 | CKV_AWS_242 | resource | aws_mwaa_environment | Ensure MWAA environment has scheduler logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MWAASchedulerLogsEnabled.py | +| 497 | CKV_AWS_243 | resource | aws_mwaa_environment | Ensure MWAA environment has worker logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MWAAWorkerLogsEnabled.py | +| 498 | CKV_AWS_244 | resource | aws_mwaa_environment | Ensure MWAA environment has webserver logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MWAAWebserverLogsEnabled.py | +| 499 | CKV_AWS_245 | resource | aws_db_instance_automated_backups_replication | Ensure replicated backups are encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSInstanceAutoBackupEncryptionWithCMK.py | +| 500 | CKV_AWS_246 | resource | aws_rds_cluster_activity_stream | Ensure RDS Cluster activity streams are encrypted using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSClusterActivityStreamEncryptedWithCMK.py | +| 501 | CKV_AWS_247 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py | +| 502 | CKV_AWS_247 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py | +| 503 | CKV_AWS_248 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py | +| 504 | CKV_AWS_248 | resource | aws_opensearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py | +| 505 | CKV_AWS_249 | resource | aws_ecs_task_definition | Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSTaskDefinitionRoleCheck.py | +| 506 | CKV_AWS_250 | resource | aws_db_instance | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py | +| 507 | CKV_AWS_250 | resource | aws_rds_cluster | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py | +| 508 | CKV_AWS_251 | resource | aws_cloudtrail | Ensure CloudTrail logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailEnableLogging.py | +| 509 | CKV_AWS_252 | resource | aws_cloudtrail | Ensure CloudTrail defines an SNS Topic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailDefinesSNSTopic.py | +| 510 | CKV_AWS_253 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryption.py | +| 511 | CKV_AWS_254 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryptionWithCMK.py | +| 512 | CKV_AWS_255 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryption.py | +| 513 | CKV_AWS_256 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted using a Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryptionWithCMK.py | +| 514 | CKV_AWS_257 | resource | aws_codecommit_approval_rule_template | Ensure codecommit branch changes have at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodecommitApprovalsRulesRequireMin2.py | +| 515 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionURLAuth.py | +| 516 | CKV_AWS_258 | resource | aws_lambda_function_url | Ensure that Lambda function URLs AuthType is not None | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaFunctionURLAuth.py | +| 517 | CKV_AWS_259 | resource | aws_cloudfront_response_headers_policy | Ensure CloudFront response header policy enforces Strict Transport Security | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudFrontResponseHeaderStrictTransportSecurity.py | +| 518 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 519 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 520 | CKV_AWS_260 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 521 | CKV_AWS_260 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 522 | CKV_AWS_261 | resource | aws_alb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py | +| 523 | CKV_AWS_261 | resource | aws_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py | +| 524 | CKV_AWS_262 | resource | aws_kendra_index | Ensure Kendra index Server side encryption uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KendraIndexSSEUsesCMK.py | +| 525 | CKV_AWS_263 | resource | aws_appflow_flow | Ensure App Flow flow uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppFlowUsesCMK.py | +| 526 | CKV_AWS_264 | resource | aws_appflow_connector_profile | Ensure App Flow connector profile uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppFlowConnectorProfileUsesCMK.py | +| 527 | CKV_AWS_265 | resource | aws_keyspaces_table | Ensure Keyspaces Table uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py | +| 528 | CKV_AWS_266 | resource | aws_db_snapshot_copy | Ensure App Flow connector profile uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBSnapshotCopyUsesCMK.py | +| 529 | CKV_AWS_267 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerModelUsesCMK.py | +| 530 | CKV_AWS_268 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerVolumeUsesCMK.py | +| 531 | CKV_AWS_269 | resource | aws_connect_instance_storage_config | Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py | +| 532 | CKV_AWS_270 | resource | aws_connect_instance_storage_config | Ensure Connect Instance S3 Storage Config uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ConnectInstanceS3StorageConfigUsesCMK.py | +| 533 | CKV_AWS_271 | resource | aws_dynamodb_table_replica | Ensure DynamoDB table replica KMS encryption uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DynamoDBTableReplicaKMSUsesCMK.py | +| 534 | CKV_AWS_272 | resource | aws_lambda_function | Ensure AWS Lambda function is configured to validate code-signing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaCodeSigningConfigured.py | +| 535 | CKV_AWS_273 | resource | aws_iam_user | Ensure access is controlled through SSO and not AWS IAM defined users | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMUserNotUsedForAccess.py | +| 536 | CKV_AWS_274 | resource | aws_iam_group_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 537 | CKV_AWS_274 | resource | aws_iam_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 538 | CKV_AWS_274 | resource | aws_iam_role | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 539 | CKV_AWS_274 | resource | aws_iam_role_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 540 | CKV_AWS_274 | resource | aws_iam_user_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 541 | CKV_AWS_275 | data | aws_iam_policy | Disallow policies from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMManagedAdminPolicy.py | +| 542 | CKV_AWS_276 | resource | aws_api_gateway_method_settings | Ensure Data Trace is not enabled in API Gateway Method Settings | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsDataTrace.py | +| 543 | CKV_AWS_277 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py | +| 544 | CKV_AWS_277 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py | +| 545 | CKV_AWS_278 | resource | aws_memorydb_snapshot | Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MemoryDBSnapshotEncryptionWithCMK.py | +| 546 | CKV_AWS_279 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncrypted.py | +| 547 | CKV_AWS_280 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncryptedWithCMK.py | +| 548 | CKV_AWS_281 | resource | aws_redshift_snapshot_copy_grant | Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterSnapshotCopyGrantEncryptedWithCMK.py | +| 549 | CKV_AWS_282 | resource | aws_redshiftserverless_namespace | Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftServerlessNamespaceKMSKey.py | +| 550 | CKV2_AWS_1 | resource | aws_network_acl | Ensure that all NACL are attached to subnets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 551 | CKV2_AWS_1 | resource | aws_subnet | Ensure that all NACL are attached to subnets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 552 | CKV2_AWS_2 | resource | aws_ebs_volume | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 553 | CKV2_AWS_2 | resource | aws_volume_attachment | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 554 | CKV2_AWS_3 | resource | aws_guardduty_detector | Ensure GuardDuty is enabled to specific org/region | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 555 | CKV2_AWS_3 | resource | aws_guardduty_organization_configuration | Ensure GuardDuty is enabled to specific org/region | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 556 | CKV2_AWS_4 | resource | aws_api_gateway_method_settings | Ensure API Gateway stage have logging level defined as appropriate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 557 | CKV2_AWS_4 | resource | aws_api_gateway_stage | Ensure API Gateway stage have logging level defined as appropriate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 558 | CKV2_AWS_5 | resource | aws_security_group | Ensure that Security Groups are attached to another resource | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 559 | CKV2_AWS_6 | resource | aws_s3_bucket | Ensure that S3 bucket has a Public Access block | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 560 | CKV2_AWS_6 | resource | aws_s3_bucket_public_access_block | Ensure that S3 bucket has a Public Access block | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 561 | CKV2_AWS_7 | resource | aws_emr_cluster | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 562 | CKV2_AWS_7 | resource | aws_security_group | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 563 | CKV2_AWS_8 | resource | aws_rds_cluster | Ensure that RDS clusters has backup plan of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 564 | CKV2_AWS_9 | resource | aws_backup_selection | Ensure that EBS are added in the backup plans of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 565 | CKV2_AWS_10 | resource | aws_cloudtrail | Ensure CloudTrail trails are integrated with CloudWatch Logs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 566 | CKV2_AWS_11 | resource | aws_vpc | Ensure VPC flow logging is enabled in all VPCs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 567 | CKV2_AWS_12 | resource | aws_default_security_group | Ensure the default security group of every VPC restricts all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 568 | CKV2_AWS_12 | resource | aws_vpc | Ensure the default security group of every VPC restricts all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 569 | CKV2_AWS_14 | resource | aws_iam_group | Ensure that IAM groups includes at least one IAM user | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 570 | CKV2_AWS_14 | resource | aws_iam_group_membership | Ensure that IAM groups includes at least one IAM user | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 571 | CKV2_AWS_15 | resource | aws_autoscaling_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 572 | CKV2_AWS_15 | resource | aws_elb | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 573 | CKV2_AWS_15 | resource | aws_lb_target_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 574 | CKV2_AWS_16 | resource | aws_appautoscaling_target | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 575 | CKV2_AWS_16 | resource | aws_dynamodb_table | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 576 | CKV2_AWS_18 | resource | aws_backup_selection | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 577 | CKV2_AWS_19 | resource | aws_eip | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 578 | CKV2_AWS_19 | resource | aws_eip_association | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 579 | CKV2_AWS_20 | resource | aws_alb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 580 | CKV2_AWS_20 | resource | aws_alb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 581 | CKV2_AWS_20 | resource | aws_lb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 582 | CKV2_AWS_20 | resource | aws_lb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 583 | CKV2_AWS_21 | resource | aws_iam_group_membership | Ensure that all IAM users are members of at least one IAM group. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 584 | CKV2_AWS_22 | resource | aws_iam_user | Ensure an IAM User does not have access to the console | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 585 | CKV2_AWS_23 | resource | aws_route53_record | Route53 A Record has Attached Resource | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 586 | CKV2_AWS_27 | resource | aws_rds_cluster | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 587 | CKV2_AWS_27 | resource | aws_rds_cluster_parameter_group | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 588 | CKV2_AWS_28 | resource | aws_alb | Ensure public facing ALB are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 589 | CKV2_AWS_28 | resource | aws_lb | Ensure public facing ALB are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 590 | CKV2_AWS_29 | resource | aws_api_gateway_rest_api | Ensure public API gateway are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 591 | CKV2_AWS_29 | resource | aws_api_gateway_stage | Ensure public API gateway are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 592 | CKV2_AWS_30 | resource | aws_db_instance | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 593 | CKV2_AWS_30 | resource | aws_db_parameter_group | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 594 | CKV2_AWS_31 | resource | aws_wafv2_web_acl | Ensure WAF2 has a Logging Configuration | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 595 | CKV2_AWS_32 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has a response headers policy attached | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 596 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 597 | CKV2_AWS_33 | resource | aws_appsync_graphql_api | Ensure AppSync is protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 598 | CKV2_AWS_34 | resource | aws_ssm_parameter | AWS SSM Parameter should be Encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 599 | CKV2_AWS_35 | resource | aws_route | AWS NAT Gateways should be utilized for the default route | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 600 | CKV2_AWS_35 | resource | aws_route_table | AWS NAT Gateways should be utilized for the default route | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 601 | CKV2_AWS_36 | resource | aws_ssm_parameter | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 602 | CKV2_AWS_36 | resource | data.http | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 603 | CKV2_AWS_37 | resource | aws | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 604 | CKV2_AWS_37 | resource | aws_accessanalyzer_analyzer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 605 | CKV2_AWS_37 | resource | aws_acm_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 606 | CKV2_AWS_37 | resource | aws_acm_certificate_validation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 607 | CKV2_AWS_37 | resource | aws_acmpca_certificate_authority | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 608 | CKV2_AWS_37 | resource | aws_ami | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 609 | CKV2_AWS_37 | resource | aws_ami_copy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 610 | CKV2_AWS_37 | resource | aws_ami_from_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 611 | CKV2_AWS_37 | resource | aws_ami_launch_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 612 | CKV2_AWS_37 | resource | aws_api_gateway_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 613 | CKV2_AWS_37 | resource | aws_api_gateway_api_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 614 | CKV2_AWS_37 | resource | aws_api_gateway_authorizer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 615 | CKV2_AWS_37 | resource | aws_api_gateway_base_path_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 616 | CKV2_AWS_37 | resource | aws_api_gateway_client_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 617 | CKV2_AWS_37 | resource | aws_api_gateway_deployment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 618 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_part | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 619 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 620 | CKV2_AWS_37 | resource | aws_api_gateway_domain_name | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 621 | CKV2_AWS_37 | resource | aws_api_gateway_gateway_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 622 | CKV2_AWS_37 | resource | aws_api_gateway_integration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 623 | CKV2_AWS_37 | resource | aws_api_gateway_integration_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 624 | CKV2_AWS_37 | resource | aws_api_gateway_method | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 625 | CKV2_AWS_37 | resource | aws_api_gateway_method_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 626 | CKV2_AWS_37 | resource | aws_api_gateway_method_settings | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 627 | CKV2_AWS_37 | resource | aws_api_gateway_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 628 | CKV2_AWS_37 | resource | aws_api_gateway_request_validator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 629 | CKV2_AWS_37 | resource | aws_api_gateway_resource | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 630 | CKV2_AWS_37 | resource | aws_api_gateway_rest_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 631 | CKV2_AWS_37 | resource | aws_api_gateway_stage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 632 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 633 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 634 | CKV2_AWS_37 | resource | aws_api_gateway_vpc_link | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 635 | CKV2_AWS_37 | resource | aws_apigatewayv2_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 636 | CKV2_AWS_37 | resource | aws_apigatewayv2_api_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 637 | CKV2_AWS_37 | resource | aws_apigatewayv2_authorizer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 638 | CKV2_AWS_37 | resource | aws_apigatewayv2_deployment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 639 | CKV2_AWS_37 | resource | aws_apigatewayv2_domain_name | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 640 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 641 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 642 | CKV2_AWS_37 | resource | aws_apigatewayv2_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 643 | CKV2_AWS_37 | resource | aws_apigatewayv2_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 644 | CKV2_AWS_37 | resource | aws_apigatewayv2_route_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 645 | CKV2_AWS_37 | resource | aws_apigatewayv2_stage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 646 | CKV2_AWS_37 | resource | aws_apigatewayv2_vpc_link | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 647 | CKV2_AWS_37 | resource | aws_app_cookie_stickiness_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 648 | CKV2_AWS_37 | resource | aws_appautoscaling_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 649 | CKV2_AWS_37 | resource | aws_appautoscaling_scheduled_action | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 650 | CKV2_AWS_37 | resource | aws_appautoscaling_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 651 | CKV2_AWS_37 | resource | aws_appmesh_mesh | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 652 | CKV2_AWS_37 | resource | aws_appmesh_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 653 | CKV2_AWS_37 | resource | aws_appmesh_virtual_node | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 654 | CKV2_AWS_37 | resource | aws_appmesh_virtual_router | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 655 | CKV2_AWS_37 | resource | aws_appmesh_virtual_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 656 | CKV2_AWS_37 | resource | aws_appsync_api_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 657 | CKV2_AWS_37 | resource | aws_appsync_datasource | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 658 | CKV2_AWS_37 | resource | aws_appsync_function | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 659 | CKV2_AWS_37 | resource | aws_appsync_graphql_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 660 | CKV2_AWS_37 | resource | aws_appsync_resolver | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 661 | CKV2_AWS_37 | resource | aws_athena_database | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 662 | CKV2_AWS_37 | resource | aws_athena_named_query | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 663 | CKV2_AWS_37 | resource | aws_athena_workgroup | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 664 | CKV2_AWS_37 | resource | aws_autoscaling_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 665 | CKV2_AWS_37 | resource | aws_autoscaling_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 666 | CKV2_AWS_37 | resource | aws_autoscaling_lifecycle_hook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 667 | CKV2_AWS_37 | resource | aws_autoscaling_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 668 | CKV2_AWS_37 | resource | aws_autoscaling_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 669 | CKV2_AWS_37 | resource | aws_autoscaling_schedule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 670 | CKV2_AWS_37 | resource | aws_backup_plan | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 671 | CKV2_AWS_37 | resource | aws_backup_selection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 672 | CKV2_AWS_37 | resource | aws_backup_vault | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 673 | CKV2_AWS_37 | resource | aws_batch_compute_environment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 674 | CKV2_AWS_37 | resource | aws_batch_job_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 675 | CKV2_AWS_37 | resource | aws_batch_job_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 676 | CKV2_AWS_37 | resource | aws_budgets_budget | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 677 | CKV2_AWS_37 | resource | aws_cloud9_environment_ec2 | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 678 | CKV2_AWS_37 | resource | aws_cloudformation_stack | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 679 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 680 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 681 | CKV2_AWS_37 | resource | aws_cloudfront_distribution | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 682 | CKV2_AWS_37 | resource | aws_cloudfront_origin_access_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 683 | CKV2_AWS_37 | resource | aws_cloudfront_public_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 684 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 685 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_hsm | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 686 | CKV2_AWS_37 | resource | aws_cloudtrail | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 687 | CKV2_AWS_37 | resource | aws_cloudwatch_dashboard | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 688 | CKV2_AWS_37 | resource | aws_cloudwatch_event_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 689 | CKV2_AWS_37 | resource | aws_cloudwatch_event_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 690 | CKV2_AWS_37 | resource | aws_cloudwatch_event_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 691 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 692 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 693 | CKV2_AWS_37 | resource | aws_cloudwatch_log_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 694 | CKV2_AWS_37 | resource | aws_cloudwatch_log_metric_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 695 | CKV2_AWS_37 | resource | aws_cloudwatch_log_resource_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 696 | CKV2_AWS_37 | resource | aws_cloudwatch_log_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 697 | CKV2_AWS_37 | resource | aws_cloudwatch_log_subscription_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 698 | CKV2_AWS_37 | resource | aws_cloudwatch_metric_alarm | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 699 | CKV2_AWS_37 | resource | aws_codebuild_project | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 700 | CKV2_AWS_37 | resource | aws_codebuild_source_credential | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 701 | CKV2_AWS_37 | resource | aws_codebuild_webhook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 702 | CKV2_AWS_37 | resource | aws_codecommit_repository | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 703 | CKV2_AWS_37 | resource | aws_codecommit_trigger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 704 | CKV2_AWS_37 | resource | aws_codedeploy_app | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 705 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 706 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 707 | CKV2_AWS_37 | resource | aws_codepipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 708 | CKV2_AWS_37 | resource | aws_codepipeline_webhook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 709 | CKV2_AWS_37 | resource | aws_codestarnotifications_notification_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 710 | CKV2_AWS_37 | resource | aws_cognito_identity_pool | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 711 | CKV2_AWS_37 | resource | aws_cognito_identity_pool_roles_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 712 | CKV2_AWS_37 | resource | aws_cognito_identity_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 713 | CKV2_AWS_37 | resource | aws_cognito_resource_server | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 714 | CKV2_AWS_37 | resource | aws_cognito_user_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 715 | CKV2_AWS_37 | resource | aws_cognito_user_pool | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 716 | CKV2_AWS_37 | resource | aws_cognito_user_pool_client | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 717 | CKV2_AWS_37 | resource | aws_cognito_user_pool_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 718 | CKV2_AWS_37 | resource | aws_config_aggregate_authorization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 719 | CKV2_AWS_37 | resource | aws_config_config_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 720 | CKV2_AWS_37 | resource | aws_config_configuration_aggregator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 721 | CKV2_AWS_37 | resource | aws_config_configuration_recorder | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 722 | CKV2_AWS_37 | resource | aws_config_configuration_recorder_status | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 723 | CKV2_AWS_37 | resource | aws_config_delivery_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 724 | CKV2_AWS_37 | resource | aws_config_organization_custom_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 725 | CKV2_AWS_37 | resource | aws_config_organization_managed_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 726 | CKV2_AWS_37 | resource | aws_cur_report_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 727 | CKV2_AWS_37 | resource | aws_customer_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 728 | CKV2_AWS_37 | resource | aws_datapipeline_pipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 729 | CKV2_AWS_37 | resource | aws_datasync_agent | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 730 | CKV2_AWS_37 | resource | aws_datasync_location_efs | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 731 | CKV2_AWS_37 | resource | aws_datasync_location_nfs | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 732 | CKV2_AWS_37 | resource | aws_datasync_location_s3 | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 733 | CKV2_AWS_37 | resource | aws_datasync_location_smb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 734 | CKV2_AWS_37 | resource | aws_datasync_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 735 | CKV2_AWS_37 | resource | aws_dax_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 736 | CKV2_AWS_37 | resource | aws_dax_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 737 | CKV2_AWS_37 | resource | aws_dax_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 738 | CKV2_AWS_37 | resource | aws_db_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 739 | CKV2_AWS_37 | resource | aws_db_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 740 | CKV2_AWS_37 | resource | aws_db_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 741 | CKV2_AWS_37 | resource | aws_db_instance_role_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 742 | CKV2_AWS_37 | resource | aws_db_option_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 743 | CKV2_AWS_37 | resource | aws_db_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 744 | CKV2_AWS_37 | resource | aws_db_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 745 | CKV2_AWS_37 | resource | aws_db_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 746 | CKV2_AWS_37 | resource | aws_db_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 747 | CKV2_AWS_37 | resource | aws_default_network_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 748 | CKV2_AWS_37 | resource | aws_default_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 749 | CKV2_AWS_37 | resource | aws_default_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 750 | CKV2_AWS_37 | resource | aws_default_subnet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 751 | CKV2_AWS_37 | resource | aws_default_vpc | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 752 | CKV2_AWS_37 | resource | aws_default_vpc_dhcp_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 753 | CKV2_AWS_37 | resource | aws_devicefarm_project | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 754 | CKV2_AWS_37 | resource | aws_directory_service_conditional_forwarder | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 755 | CKV2_AWS_37 | resource | aws_directory_service_directory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 756 | CKV2_AWS_37 | resource | aws_directory_service_log_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 757 | CKV2_AWS_37 | resource | aws_dlm_lifecycle_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 758 | CKV2_AWS_37 | resource | aws_dms_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 759 | CKV2_AWS_37 | resource | aws_dms_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 760 | CKV2_AWS_37 | resource | aws_dms_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 761 | CKV2_AWS_37 | resource | aws_dms_replication_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 762 | CKV2_AWS_37 | resource | aws_dms_replication_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 763 | CKV2_AWS_37 | resource | aws_dms_replication_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 764 | CKV2_AWS_37 | resource | aws_docdb_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 765 | CKV2_AWS_37 | resource | aws_docdb_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 766 | CKV2_AWS_37 | resource | aws_docdb_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 767 | CKV2_AWS_37 | resource | aws_docdb_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 768 | CKV2_AWS_37 | resource | aws_docdb_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 769 | CKV2_AWS_37 | resource | aws_dx_bgp_peer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 770 | CKV2_AWS_37 | resource | aws_dx_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 771 | CKV2_AWS_37 | resource | aws_dx_connection_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 772 | CKV2_AWS_37 | resource | aws_dx_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 773 | CKV2_AWS_37 | resource | aws_dx_gateway_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 774 | CKV2_AWS_37 | resource | aws_dx_gateway_association_proposal | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 775 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 776 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 777 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 778 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 779 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 780 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 781 | CKV2_AWS_37 | resource | aws_dx_lag | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 782 | CKV2_AWS_37 | resource | aws_dx_private_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 783 | CKV2_AWS_37 | resource | aws_dx_public_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 784 | CKV2_AWS_37 | resource | aws_dx_transit_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 785 | CKV2_AWS_37 | resource | aws_dynamodb_global_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 786 | CKV2_AWS_37 | resource | aws_dynamodb_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 787 | CKV2_AWS_37 | resource | aws_dynamodb_table_item | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 788 | CKV2_AWS_37 | resource | aws_ebs_default_kms_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 789 | CKV2_AWS_37 | resource | aws_ebs_encryption_by_default | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 790 | CKV2_AWS_37 | resource | aws_ebs_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 791 | CKV2_AWS_37 | resource | aws_ebs_snapshot_copy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 792 | CKV2_AWS_37 | resource | aws_ebs_volume | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 793 | CKV2_AWS_37 | resource | aws_ec2_availability_zone_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 794 | CKV2_AWS_37 | resource | aws_ec2_capacity_reservation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 795 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_authorization_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 796 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 797 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_network_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 798 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 799 | CKV2_AWS_37 | resource | aws_ec2_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 800 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 801 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 802 | CKV2_AWS_37 | resource | aws_ec2_tag | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 803 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 804 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 805 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_session | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 806 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 807 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 808 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 809 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 810 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 811 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 812 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 813 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 814 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 815 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 816 | CKV2_AWS_37 | resource | aws_ecr_lifecycle_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 817 | CKV2_AWS_37 | resource | aws_ecr_repository | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 818 | CKV2_AWS_37 | resource | aws_ecr_repository_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 819 | CKV2_AWS_37 | resource | aws_ecs_capacity_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 820 | CKV2_AWS_37 | resource | aws_ecs_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 821 | CKV2_AWS_37 | resource | aws_ecs_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 822 | CKV2_AWS_37 | resource | aws_ecs_task_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 823 | CKV2_AWS_37 | resource | aws_efs_access_point | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 824 | CKV2_AWS_37 | resource | aws_efs_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 825 | CKV2_AWS_37 | resource | aws_efs_file_system_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 826 | CKV2_AWS_37 | resource | aws_efs_mount_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 827 | CKV2_AWS_37 | resource | aws_egress_only_internet_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 828 | CKV2_AWS_37 | resource | aws_eip | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 829 | CKV2_AWS_37 | resource | aws_eip_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 830 | CKV2_AWS_37 | resource | aws_eks_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 831 | CKV2_AWS_37 | resource | aws_eks_fargate_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 832 | CKV2_AWS_37 | resource | aws_eks_node_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 833 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 834 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 835 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_configuration_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 836 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_environment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 837 | CKV2_AWS_37 | resource | aws_elasticache_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 838 | CKV2_AWS_37 | resource | aws_elasticache_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 839 | CKV2_AWS_37 | resource | aws_elasticache_replication_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 840 | CKV2_AWS_37 | resource | aws_elasticache_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 841 | CKV2_AWS_37 | resource | aws_elasticache_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 842 | CKV2_AWS_37 | resource | aws_elasticsearch_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 843 | CKV2_AWS_37 | resource | aws_elasticsearch_domain_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 844 | CKV2_AWS_37 | resource | aws_elastictranscoder_pipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 845 | CKV2_AWS_37 | resource | aws_elastictranscoder_preset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 846 | CKV2_AWS_37 | resource | aws_elb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 847 | CKV2_AWS_37 | resource | aws_elb_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 848 | CKV2_AWS_37 | resource | aws_emr_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 849 | CKV2_AWS_37 | resource | aws_emr_instance_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 850 | CKV2_AWS_37 | resource | aws_emr_security_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 851 | CKV2_AWS_37 | resource | aws_flow_log | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 852 | CKV2_AWS_37 | resource | aws_fms_admin_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 853 | CKV2_AWS_37 | resource | aws_fsx_lustre_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 854 | CKV2_AWS_37 | resource | aws_fsx_windows_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 855 | CKV2_AWS_37 | resource | aws_gamelift_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 856 | CKV2_AWS_37 | resource | aws_gamelift_build | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 857 | CKV2_AWS_37 | resource | aws_gamelift_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 858 | CKV2_AWS_37 | resource | aws_gamelift_game_session_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 859 | CKV2_AWS_37 | resource | aws_glacier_vault | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 860 | CKV2_AWS_37 | resource | aws_glacier_vault_lock | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 861 | CKV2_AWS_37 | resource | aws_globalaccelerator_accelerator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 862 | CKV2_AWS_37 | resource | aws_globalaccelerator_endpoint_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 863 | CKV2_AWS_37 | resource | aws_globalaccelerator_listener | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 864 | CKV2_AWS_37 | resource | aws_glue_catalog_database | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 865 | CKV2_AWS_37 | resource | aws_glue_catalog_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 866 | CKV2_AWS_37 | resource | aws_glue_classifier | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 867 | CKV2_AWS_37 | resource | aws_glue_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 868 | CKV2_AWS_37 | resource | aws_glue_crawler | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 869 | CKV2_AWS_37 | resource | aws_glue_job | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 870 | CKV2_AWS_37 | resource | aws_glue_security_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 871 | CKV2_AWS_37 | resource | aws_glue_trigger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 872 | CKV2_AWS_37 | resource | aws_glue_workflow | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 873 | CKV2_AWS_37 | resource | aws_guardduty_detector | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 874 | CKV2_AWS_37 | resource | aws_guardduty_invite_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 875 | CKV2_AWS_37 | resource | aws_guardduty_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 876 | CKV2_AWS_37 | resource | aws_guardduty_member | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 877 | CKV2_AWS_37 | resource | aws_guardduty_organization_admin_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 878 | CKV2_AWS_37 | resource | aws_guardduty_organization_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 879 | CKV2_AWS_37 | resource | aws_guardduty_threatintelset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 880 | CKV2_AWS_37 | resource | aws_iam_access_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 881 | CKV2_AWS_37 | resource | aws_iam_account_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 882 | CKV2_AWS_37 | resource | aws_iam_account_password_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 883 | CKV2_AWS_37 | resource | aws_iam_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 884 | CKV2_AWS_37 | resource | aws_iam_group_membership | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 885 | CKV2_AWS_37 | resource | aws_iam_group_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 886 | CKV2_AWS_37 | resource | aws_iam_group_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 887 | CKV2_AWS_37 | resource | aws_iam_instance_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 888 | CKV2_AWS_37 | resource | aws_iam_openid_connect_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 889 | CKV2_AWS_37 | resource | aws_iam_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 890 | CKV2_AWS_37 | resource | aws_iam_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 891 | CKV2_AWS_37 | resource | aws_iam_policy_document | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 892 | CKV2_AWS_37 | resource | aws_iam_role | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 893 | CKV2_AWS_37 | resource | aws_iam_role_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 894 | CKV2_AWS_37 | resource | aws_iam_role_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 895 | CKV2_AWS_37 | resource | aws_iam_saml_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 896 | CKV2_AWS_37 | resource | aws_iam_server_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 897 | CKV2_AWS_37 | resource | aws_iam_service_linked_role | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 898 | CKV2_AWS_37 | resource | aws_iam_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 899 | CKV2_AWS_37 | resource | aws_iam_user_group_membership | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 900 | CKV2_AWS_37 | resource | aws_iam_user_login_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 901 | CKV2_AWS_37 | resource | aws_iam_user_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 902 | CKV2_AWS_37 | resource | aws_iam_user_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 903 | CKV2_AWS_37 | resource | aws_iam_user_ssh_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 904 | CKV2_AWS_37 | resource | aws_inspector_assessment_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 905 | CKV2_AWS_37 | resource | aws_inspector_assessment_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 906 | CKV2_AWS_37 | resource | aws_inspector_resource_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 907 | CKV2_AWS_37 | resource | aws_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 908 | CKV2_AWS_37 | resource | aws_internet_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 909 | CKV2_AWS_37 | resource | aws_iot_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 910 | CKV2_AWS_37 | resource | aws_iot_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 911 | CKV2_AWS_37 | resource | aws_iot_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 912 | CKV2_AWS_37 | resource | aws_iot_role_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 913 | CKV2_AWS_37 | resource | aws_iot_thing | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 914 | CKV2_AWS_37 | resource | aws_iot_thing_principal_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 915 | CKV2_AWS_37 | resource | aws_iot_thing_type | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 916 | CKV2_AWS_37 | resource | aws_iot_topic_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 917 | CKV2_AWS_37 | resource | aws_key_pair | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 918 | CKV2_AWS_37 | resource | aws_kinesis_analytics_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 919 | CKV2_AWS_37 | resource | aws_kinesis_firehose_delivery_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 920 | CKV2_AWS_37 | resource | aws_kinesis_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 921 | CKV2_AWS_37 | resource | aws_kinesis_video_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 922 | CKV2_AWS_37 | resource | aws_kms_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 923 | CKV2_AWS_37 | resource | aws_kms_ciphertext | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 924 | CKV2_AWS_37 | resource | aws_kms_external_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 925 | CKV2_AWS_37 | resource | aws_kms_grant | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 926 | CKV2_AWS_37 | resource | aws_kms_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 927 | CKV2_AWS_37 | resource | aws_lambda_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 928 | CKV2_AWS_37 | resource | aws_lambda_event_source_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 929 | CKV2_AWS_37 | resource | aws_lambda_function | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 930 | CKV2_AWS_37 | resource | aws_lambda_function_event_invoke_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 931 | CKV2_AWS_37 | resource | aws_lambda_layer_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 932 | CKV2_AWS_37 | resource | aws_lambda_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 933 | CKV2_AWS_37 | resource | aws_lambda_provisioned_concurrency_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 934 | CKV2_AWS_37 | resource | aws_launch_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 935 | CKV2_AWS_37 | resource | aws_launch_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 936 | CKV2_AWS_37 | resource | aws_lb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 937 | CKV2_AWS_37 | resource | aws_lb_cookie_stickiness_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 938 | CKV2_AWS_37 | resource | aws_lb_listener | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 939 | CKV2_AWS_37 | resource | aws_lb_listener_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 940 | CKV2_AWS_37 | resource | aws_lb_listener_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 941 | CKV2_AWS_37 | resource | aws_lb_ssl_negotiation_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 942 | CKV2_AWS_37 | resource | aws_lb_target_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 943 | CKV2_AWS_37 | resource | aws_lb_target_group_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 944 | CKV2_AWS_37 | resource | aws_licensemanager_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 945 | CKV2_AWS_37 | resource | aws_licensemanager_license_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 946 | CKV2_AWS_37 | resource | aws_lightsail_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 947 | CKV2_AWS_37 | resource | aws_lightsail_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 948 | CKV2_AWS_37 | resource | aws_lightsail_key_pair | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 949 | CKV2_AWS_37 | resource | aws_lightsail_static_ip | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 950 | CKV2_AWS_37 | resource | aws_lightsail_static_ip_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 951 | CKV2_AWS_37 | resource | aws_load_balancer_backend_server_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 952 | CKV2_AWS_37 | resource | aws_load_balancer_listener_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 953 | CKV2_AWS_37 | resource | aws_load_balancer_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 954 | CKV2_AWS_37 | resource | aws_macie_member_account_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 955 | CKV2_AWS_37 | resource | aws_macie_s3_bucket_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 956 | CKV2_AWS_37 | resource | aws_main_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 957 | CKV2_AWS_37 | resource | aws_media_convert_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 958 | CKV2_AWS_37 | resource | aws_media_package_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 959 | CKV2_AWS_37 | resource | aws_media_store_container | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 960 | CKV2_AWS_37 | resource | aws_media_store_container_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 961 | CKV2_AWS_37 | resource | aws_mq_broker | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 962 | CKV2_AWS_37 | resource | aws_mq_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 963 | CKV2_AWS_37 | resource | aws_msk_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 964 | CKV2_AWS_37 | resource | aws_msk_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 965 | CKV2_AWS_37 | resource | aws_nat_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 966 | CKV2_AWS_37 | resource | aws_neptune_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 967 | CKV2_AWS_37 | resource | aws_neptune_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 968 | CKV2_AWS_37 | resource | aws_neptune_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 969 | CKV2_AWS_37 | resource | aws_neptune_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 970 | CKV2_AWS_37 | resource | aws_neptune_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 971 | CKV2_AWS_37 | resource | aws_neptune_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 972 | CKV2_AWS_37 | resource | aws_neptune_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 973 | CKV2_AWS_37 | resource | aws_network_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 974 | CKV2_AWS_37 | resource | aws_network_acl_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 975 | CKV2_AWS_37 | resource | aws_network_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 976 | CKV2_AWS_37 | resource | aws_network_interface_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 977 | CKV2_AWS_37 | resource | aws_network_interface_sg_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 978 | CKV2_AWS_37 | resource | aws_opsworks_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 979 | CKV2_AWS_37 | resource | aws_opsworks_custom_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 980 | CKV2_AWS_37 | resource | aws_opsworks_ganglia_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 981 | CKV2_AWS_37 | resource | aws_opsworks_haproxy_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 982 | CKV2_AWS_37 | resource | aws_opsworks_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 983 | CKV2_AWS_37 | resource | aws_opsworks_java_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 984 | CKV2_AWS_37 | resource | aws_opsworks_memcached_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 985 | CKV2_AWS_37 | resource | aws_opsworks_mysql_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 986 | CKV2_AWS_37 | resource | aws_opsworks_nodejs_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 987 | CKV2_AWS_37 | resource | aws_opsworks_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 988 | CKV2_AWS_37 | resource | aws_opsworks_php_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 989 | CKV2_AWS_37 | resource | aws_opsworks_rails_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 990 | CKV2_AWS_37 | resource | aws_opsworks_rds_db_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 991 | CKV2_AWS_37 | resource | aws_opsworks_stack | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 992 | CKV2_AWS_37 | resource | aws_opsworks_static_web_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 993 | CKV2_AWS_37 | resource | aws_opsworks_user_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 994 | CKV2_AWS_37 | resource | aws_organizations_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 995 | CKV2_AWS_37 | resource | aws_organizations_organization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 996 | CKV2_AWS_37 | resource | aws_organizations_organizational_unit | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 997 | CKV2_AWS_37 | resource | aws_organizations_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 998 | CKV2_AWS_37 | resource | aws_organizations_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 999 | CKV2_AWS_37 | resource | aws_pinpoint_adm_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1000 | CKV2_AWS_37 | resource | aws_pinpoint_apns_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1001 | CKV2_AWS_37 | resource | aws_pinpoint_apns_sandbox_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1002 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1003 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1004 | CKV2_AWS_37 | resource | aws_pinpoint_app | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1005 | CKV2_AWS_37 | resource | aws_pinpoint_baidu_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1006 | CKV2_AWS_37 | resource | aws_pinpoint_email_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1007 | CKV2_AWS_37 | resource | aws_pinpoint_event_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1008 | CKV2_AWS_37 | resource | aws_pinpoint_gcm_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1009 | CKV2_AWS_37 | resource | aws_pinpoint_sms_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1010 | CKV2_AWS_37 | resource | aws_placement_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1011 | CKV2_AWS_37 | resource | aws_proxy_protocol_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1012 | CKV2_AWS_37 | resource | aws_qldb_ledger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1013 | CKV2_AWS_37 | resource | aws_quicksight_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1014 | CKV2_AWS_37 | resource | aws_quicksight_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1015 | CKV2_AWS_37 | resource | aws_ram_principal_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1016 | CKV2_AWS_37 | resource | aws_ram_resource_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1017 | CKV2_AWS_37 | resource | aws_ram_resource_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1018 | CKV2_AWS_37 | resource | aws_ram_resource_share_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1019 | CKV2_AWS_37 | resource | aws_rds_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1020 | CKV2_AWS_37 | resource | aws_rds_cluster_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1021 | CKV2_AWS_37 | resource | aws_rds_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1022 | CKV2_AWS_37 | resource | aws_rds_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1023 | CKV2_AWS_37 | resource | aws_rds_global_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1024 | CKV2_AWS_37 | resource | aws_redshift_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1025 | CKV2_AWS_37 | resource | aws_redshift_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1026 | CKV2_AWS_37 | resource | aws_redshift_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1027 | CKV2_AWS_37 | resource | aws_redshift_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1028 | CKV2_AWS_37 | resource | aws_redshift_snapshot_copy_grant | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1029 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1030 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1031 | CKV2_AWS_37 | resource | aws_redshift_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1032 | CKV2_AWS_37 | resource | aws_resourcegroups_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1033 | CKV2_AWS_37 | resource | aws_root | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1034 | CKV2_AWS_37 | resource | aws_root_access_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1035 | CKV2_AWS_37 | resource | aws_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1036 | CKV2_AWS_37 | resource | aws_route53_delegation_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1037 | CKV2_AWS_37 | resource | aws_route53_health_check | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1038 | CKV2_AWS_37 | resource | aws_route53_query_log | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1039 | CKV2_AWS_37 | resource | aws_route53_record | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1040 | CKV2_AWS_37 | resource | aws_route53_resolver_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1041 | CKV2_AWS_37 | resource | aws_route53_resolver_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1042 | CKV2_AWS_37 | resource | aws_route53_resolver_rule_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1043 | CKV2_AWS_37 | resource | aws_route53_vpc_association_authorization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1044 | CKV2_AWS_37 | resource | aws_route53_zone | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1045 | CKV2_AWS_37 | resource | aws_route53_zone_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1046 | CKV2_AWS_37 | resource | aws_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1047 | CKV2_AWS_37 | resource | aws_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1048 | CKV2_AWS_37 | resource | aws_s3_access_point | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1049 | CKV2_AWS_37 | resource | aws_s3_account_public_access_block | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1050 | CKV2_AWS_37 | resource | aws_s3_bucket | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1051 | CKV2_AWS_37 | resource | aws_s3_bucket_analytics_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1052 | CKV2_AWS_37 | resource | aws_s3_bucket_inventory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1053 | CKV2_AWS_37 | resource | aws_s3_bucket_metric | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1054 | CKV2_AWS_37 | resource | aws_s3_bucket_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1055 | CKV2_AWS_37 | resource | aws_s3_bucket_object | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1056 | CKV2_AWS_37 | resource | aws_s3_bucket_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1057 | CKV2_AWS_37 | resource | aws_s3_bucket_public_access_block | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1058 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1059 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1060 | CKV2_AWS_37 | resource | aws_sagemaker_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1061 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1062 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1063 | CKV2_AWS_37 | resource | aws_secretsmanager_secret | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1064 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_rotation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1065 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1066 | CKV2_AWS_37 | resource | aws_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1067 | CKV2_AWS_37 | resource | aws_security_group_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1068 | CKV2_AWS_37 | resource | aws_securityhub_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1069 | CKV2_AWS_37 | resource | aws_securityhub_member | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1070 | CKV2_AWS_37 | resource | aws_securityhub_product_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1071 | CKV2_AWS_37 | resource | aws_securityhub_standards_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1072 | CKV2_AWS_37 | resource | aws_service_discovery_http_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1073 | CKV2_AWS_37 | resource | aws_service_discovery_private_dns_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1074 | CKV2_AWS_37 | resource | aws_service_discovery_public_dns_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1075 | CKV2_AWS_37 | resource | aws_service_discovery_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1076 | CKV2_AWS_37 | resource | aws_servicecatalog_portfolio | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1077 | CKV2_AWS_37 | resource | aws_servicequotas_service_quota | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1078 | CKV2_AWS_37 | resource | aws_ses_active_receipt_rule_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1079 | CKV2_AWS_37 | resource | aws_ses_configuration_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1080 | CKV2_AWS_37 | resource | aws_ses_domain_dkim | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1081 | CKV2_AWS_37 | resource | aws_ses_domain_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1082 | CKV2_AWS_37 | resource | aws_ses_domain_identity_verification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1083 | CKV2_AWS_37 | resource | aws_ses_domain_mail_from | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1084 | CKV2_AWS_37 | resource | aws_ses_email_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1085 | CKV2_AWS_37 | resource | aws_ses_event_destination | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1086 | CKV2_AWS_37 | resource | aws_ses_identity_notification_topic | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1087 | CKV2_AWS_37 | resource | aws_ses_identity_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1088 | CKV2_AWS_37 | resource | aws_ses_receipt_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1089 | CKV2_AWS_37 | resource | aws_ses_receipt_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1090 | CKV2_AWS_37 | resource | aws_ses_receipt_rule_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1091 | CKV2_AWS_37 | resource | aws_ses_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1092 | CKV2_AWS_37 | resource | aws_sfn_activity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1093 | CKV2_AWS_37 | resource | aws_sfn_state_machine | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1094 | CKV2_AWS_37 | resource | aws_shield_protection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1095 | CKV2_AWS_37 | resource | aws_simpledb_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1096 | CKV2_AWS_37 | resource | aws_snapshot_create_volume_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1097 | CKV2_AWS_37 | resource | aws_sns_platform_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1098 | CKV2_AWS_37 | resource | aws_sns_sms_preferences | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1099 | CKV2_AWS_37 | resource | aws_sns_topic | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1100 | CKV2_AWS_37 | resource | aws_sns_topic_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1101 | CKV2_AWS_37 | resource | aws_sns_topic_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1102 | CKV2_AWS_37 | resource | aws_spot_datafeed_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1103 | CKV2_AWS_37 | resource | aws_spot_fleet_request | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1104 | CKV2_AWS_37 | resource | aws_spot_instance_request | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1105 | CKV2_AWS_37 | resource | aws_sqs_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1106 | CKV2_AWS_37 | resource | aws_sqs_queue_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1107 | CKV2_AWS_37 | resource | aws_ssm_activation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1108 | CKV2_AWS_37 | resource | aws_ssm_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1109 | CKV2_AWS_37 | resource | aws_ssm_document | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1110 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1111 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1112 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1113 | CKV2_AWS_37 | resource | aws_ssm_parameter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1114 | CKV2_AWS_37 | resource | aws_ssm_patch_baseline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1115 | CKV2_AWS_37 | resource | aws_ssm_patch_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1116 | CKV2_AWS_37 | resource | aws_ssm_resource_data_sync | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1117 | CKV2_AWS_37 | resource | aws_storagegateway_cache | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1118 | CKV2_AWS_37 | resource | aws_storagegateway_cached_iscsi_volume | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1119 | CKV2_AWS_37 | resource | aws_storagegateway_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1120 | CKV2_AWS_37 | resource | aws_storagegateway_nfs_file_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1121 | CKV2_AWS_37 | resource | aws_storagegateway_smb_file_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1122 | CKV2_AWS_37 | resource | aws_storagegateway_upload_buffer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1123 | CKV2_AWS_37 | resource | aws_storagegateway_working_storage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1124 | CKV2_AWS_37 | resource | aws_subnet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1125 | CKV2_AWS_37 | resource | aws_swf_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1126 | CKV2_AWS_37 | resource | aws_transfer_server | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1127 | CKV2_AWS_37 | resource | aws_transfer_ssh_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1128 | CKV2_AWS_37 | resource | aws_transfer_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1129 | CKV2_AWS_37 | resource | aws_volume_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1130 | CKV2_AWS_37 | resource | aws_vpc | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1131 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1132 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1133 | CKV2_AWS_37 | resource | aws_vpc_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1134 | CKV2_AWS_37 | resource | aws_vpc_endpoint_connection_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1135 | CKV2_AWS_37 | resource | aws_vpc_endpoint_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1136 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1137 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1138 | CKV2_AWS_37 | resource | aws_vpc_endpoint_subnet_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1139 | CKV2_AWS_37 | resource | aws_vpc_ipv4_cidr_block_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1140 | CKV2_AWS_37 | resource | aws_vpc_peering_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1141 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1142 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1143 | CKV2_AWS_37 | resource | aws_vpn_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1144 | CKV2_AWS_37 | resource | aws_vpn_connection_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1145 | CKV2_AWS_37 | resource | aws_vpn_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1146 | CKV2_AWS_37 | resource | aws_vpn_gateway_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1147 | CKV2_AWS_37 | resource | aws_vpn_gateway_route_propagation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1148 | CKV2_AWS_37 | resource | aws_waf_byte_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1149 | CKV2_AWS_37 | resource | aws_waf_geo_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1150 | CKV2_AWS_37 | resource | aws_waf_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1151 | CKV2_AWS_37 | resource | aws_waf_rate_based_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1152 | CKV2_AWS_37 | resource | aws_waf_regex_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1153 | CKV2_AWS_37 | resource | aws_waf_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1154 | CKV2_AWS_37 | resource | aws_waf_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1155 | CKV2_AWS_37 | resource | aws_waf_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1156 | CKV2_AWS_37 | resource | aws_waf_size_constraint_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1157 | CKV2_AWS_37 | resource | aws_waf_sql_injection_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1158 | CKV2_AWS_37 | resource | aws_waf_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1159 | CKV2_AWS_37 | resource | aws_waf_xss_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1160 | CKV2_AWS_37 | resource | aws_wafregional_byte_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1161 | CKV2_AWS_37 | resource | aws_wafregional_geo_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1162 | CKV2_AWS_37 | resource | aws_wafregional_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1163 | CKV2_AWS_37 | resource | aws_wafregional_rate_based_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1164 | CKV2_AWS_37 | resource | aws_wafregional_regex_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1165 | CKV2_AWS_37 | resource | aws_wafregional_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1166 | CKV2_AWS_37 | resource | aws_wafregional_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1167 | CKV2_AWS_37 | resource | aws_wafregional_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1168 | CKV2_AWS_37 | resource | aws_wafregional_size_constraint_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1169 | CKV2_AWS_37 | resource | aws_wafregional_sql_injection_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1170 | CKV2_AWS_37 | resource | aws_wafregional_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1171 | CKV2_AWS_37 | resource | aws_wafregional_web_acl_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1172 | CKV2_AWS_37 | resource | aws_wafregional_xss_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1173 | CKV2_AWS_37 | resource | aws_wafv2_ip_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1174 | CKV2_AWS_37 | resource | aws_wafv2_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1175 | CKV2_AWS_37 | resource | aws_wafv2_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1176 | CKV2_AWS_37 | resource | aws_wafv2_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1177 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1178 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_logging_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1179 | CKV2_AWS_37 | resource | aws_worklink_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1180 | CKV2_AWS_37 | resource | aws_worklink_website_certificate_authority_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1181 | CKV2_AWS_37 | resource | aws_workspaces_directory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1182 | CKV2_AWS_37 | resource | aws_workspaces_ip_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1183 | CKV2_AWS_37 | resource | aws_workspaces_workspace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1184 | CKV2_AWS_37 | resource | aws_xray_sampling_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1185 | CKV2_AWS_38 | resource | aws_route53_zone | Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1186 | CKV2_AWS_39 | resource | aws_route53_zone | Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1187 | CKV2_AWS_40 | resource | aws_iam_group_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1188 | CKV2_AWS_40 | resource | aws_iam_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1189 | CKV2_AWS_40 | resource | aws_iam_role_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1190 | CKV2_AWS_40 | resource | aws_iam_user_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1191 | CKV2_AWS_40 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1192 | CKV2_AWS_40 | resource | data.aws_iam_policy_document | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1193 | CKV2_AWS_41 | resource | aws_instance | Ensure an IAM role is attached to EC2 instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1194 | CKV2_AWS_42 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront distribution uses custom SSL certificate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1195 | CKV2_AWS_43 | resource | aws_s3_bucket_acl | Ensure S3 Bucket does not allow access to all Authenticated users | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1196 | CKV2_AWS_44 | resource | aws_route | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1197 | CKV2_AWS_44 | resource | aws_route_table | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1198 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureInstancePassword.py | +| 1199 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureInstancePassword.py | +| 1200 | CKV_AZURE_1 | resource | azurerm_linux_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureInstancePassword.py | +| 1201 | CKV_AZURE_1 | resource | azurerm_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureInstancePassword.py | +| 1202 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureManagedDiscEncryption.py | +| 1203 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureManagedDiscEncryption.py | +| 1204 | CKV_AZURE_2 | resource | azurerm_managed_disk | Ensure Azure managed disk has encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureManagedDiskEncryption.py | +| 1205 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountsTransportEncryption.py | +| 1206 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py | +| 1207 | CKV_AZURE_3 | resource | azurerm_storage_account | Ensure that 'Secure transfer required' is set to 'Enabled' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py | +| 1208 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSLoggingEnabled.py | +| 1209 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSLoggingEnabled.py | +| 1210 | CKV_AZURE_4 | resource | azurerm_kubernetes_cluster | Ensure AKS logging to Azure Monitoring is Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py | +| 1211 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSRbacEnabled.py | +| 1212 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSRbacEnabled.py | +| 1213 | CKV_AZURE_5 | resource | azurerm_kubernetes_cluster | Ensure RBAC is enabled on AKS clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSRbacEnabled.py | +| 1214 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py | +| 1215 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py | +| 1216 | CKV_AZURE_6 | resource | azurerm_kubernetes_cluster | Ensure AKS has an API Server Authorized IP Ranges enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py | +| 1217 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSNetworkPolicy.py | +| 1218 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSNetworkPolicy.py | +| 1219 | CKV_AZURE_7 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster has Network Policy configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py | +| 1220 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSDashboardDisabled.py | +| 1221 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSDashboardDisabled.py | +| 1222 | CKV_AZURE_8 | resource | azurerm_kubernetes_cluster | Ensure Kubernetes Dashboard is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSDashboardDisabled.py | +| 1223 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py | +| 1224 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py | +| 1225 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py | +| 1226 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py | +| 1227 | CKV_AZURE_9 | resource | azurerm_network_security_group | Ensure that RDP access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py | +| 1228 | CKV_AZURE_9 | resource | azurerm_network_security_rule | Ensure that RDP access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py | +| 1229 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py | +| 1230 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py | +| 1231 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py | +| 1232 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py | +| 1233 | CKV_AZURE_10 | resource | azurerm_network_security_group | Ensure that SSH access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py | +| 1234 | CKV_AZURE_10 | resource | azurerm_network_security_rule | Ensure that SSH access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py | +| 1235 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerNoPublicAccess.py | +| 1236 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerNoPublicAccess.py | +| 1237 | CKV_AZURE_11 | resource | azurerm_mariadb_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py | +| 1238 | CKV_AZURE_11 | resource | azurerm_mysql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py | +| 1239 | CKV_AZURE_11 | resource | azurerm_postgresql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py | +| 1240 | CKV_AZURE_11 | resource | azurerm_sql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py | +| 1241 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 1242 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 1243 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 1244 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 1245 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 1246 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 1247 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 1248 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 1249 | CKV_AZURE_12 | resource | azurerm_network_watcher_flow_log | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py | +| 1250 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceAuthentication.py | +| 1251 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceAuthentication.py | +| 1252 | CKV_AZURE_13 | resource | azurerm_app_service | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py | +| 1253 | CKV_AZURE_13 | resource | azurerm_linux_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py | +| 1254 | CKV_AZURE_13 | resource | azurerm_windows_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py | +| 1255 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceAuthentication.py | +| 1256 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceAuthentication.py | +| 1257 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceHTTPSOnly.py | +| 1258 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceHTTPSOnly.py | +| 1259 | CKV_AZURE_14 | resource | azurerm_app_service | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py | +| 1260 | CKV_AZURE_14 | resource | azurerm_linux_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py | +| 1261 | CKV_AZURE_14 | resource | azurerm_windows_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py | +| 1262 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceMinTLSVersion.py | +| 1263 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceMinTLSVersion.py | +| 1264 | CKV_AZURE_15 | resource | azurerm_app_service | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py | +| 1265 | CKV_AZURE_15 | resource | azurerm_linux_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py | +| 1266 | CKV_AZURE_15 | resource | azurerm_windows_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py | +| 1267 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceIdentity.py | +| 1268 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceIdentity.py | +| 1269 | CKV_AZURE_16 | resource | azurerm_app_service | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentity.py | +| 1270 | CKV_AZURE_16 | resource | azurerm_linux_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentity.py | +| 1271 | CKV_AZURE_16 | resource | azurerm_windows_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentity.py | +| 1272 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceClientCertificate.py | +| 1273 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceClientCertificate.py | +| 1274 | CKV_AZURE_17 | resource | azurerm_app_service | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py | +| 1275 | CKV_AZURE_17 | resource | azurerm_linux_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py | +| 1276 | CKV_AZURE_17 | resource | azurerm_windows_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py | +| 1277 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceHttps20Enabled.py | +| 1278 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceHttps20Enabled.py | +| 1279 | CKV_AZURE_18 | resource | azurerm_app_service | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py | +| 1280 | CKV_AZURE_18 | resource | azurerm_linux_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py | +| 1281 | CKV_AZURE_18 | resource | azurerm_windows_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py | +| 1282 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterStandardPricing.py | +| 1283 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterStandardPricing.py | +| 1284 | CKV_AZURE_19 | resource | azurerm_security_center_subscription_pricing | Ensure that standard pricing tier is selected | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterStandardPricing.py | +| 1285 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactPhone.py | +| 1286 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactPhone.py | +| 1287 | CKV_AZURE_20 | resource | azurerm_security_center_contact | Ensure that security contact 'Phone number' is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterContactPhone.py | +| 1288 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py | +| 1289 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py | +| 1290 | CKV_AZURE_21 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlert.py | +| 1291 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py | +| 1292 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py | +| 1293 | CKV_AZURE_22 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlertAdmins.py | +| 1294 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerAuditingEnabled.py | +| 1295 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1296 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1297 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerAuditingEnabled.py | +| 1298 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1299 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1300 | CKV_AZURE_23 | resource | azurerm_mssql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1301 | CKV_AZURE_23 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1302 | CKV_AZURE_23 | resource | azurerm_sql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1303 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerAuditingRetention90Days.py | +| 1304 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerAuditingRetention90Days.py | +| 1305 | CKV_AZURE_24 | resource | azurerm_mssql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1306 | CKV_AZURE_24 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1307 | CKV_AZURE_24 | resource | azurerm_sql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1308 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerThreatDetectionTypes.py | +| 1309 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerThreatDetectionTypes.py | +| 1310 | CKV_AZURE_25 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Threat Detection types' is set to 'All' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerThreatDetectionTypes.py | +| 1311 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py | +| 1312 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py | +| 1313 | CKV_AZURE_26 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerEmailAlertsEnabled.py | +| 1314 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py | +| 1315 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py | +| 1316 | CKV_AZURE_27 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerEmailAlertsToAdminsEnabled.py | +| 1317 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py | +| 1318 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py | +| 1319 | CKV_AZURE_28 | resource | azurerm_mysql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLServerSSLEnforcementEnabled.py | +| 1320 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py | +| 1321 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py | +| 1322 | CKV_AZURE_29 | resource | azurerm_postgresql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerSSLEnforcementEnabled.py | +| 1323 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py | +| 1324 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py | +| 1325 | CKV_AZURE_30 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerLogCheckpointsEnabled.py | +| 1326 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py | +| 1327 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py | +| 1328 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py | +| 1329 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py | +| 1330 | CKV_AZURE_31 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerLogConnectionsEnabled.py | +| 1331 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py | +| 1332 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py | +| 1333 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py | +| 1334 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py | +| 1335 | CKV_AZURE_32 | resource | azurerm_postgresql_configuration | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerConnectionThrottlingEnabled.py | +| 1336 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py | +| 1337 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py | +| 1338 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py | +| 1339 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py | +| 1340 | CKV_AZURE_33 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountLoggingQueueServiceEnabled.py | +| 1341 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 1342 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 1343 | CKV_AZURE_34 | resource | azurerm_storage_container | Ensure that 'Public access level' is set to Private for blob containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageBlobServiceContainerPrivateAccess.py | +| 1344 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 1345 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 1346 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 1347 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 1348 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountDefaultNetworkAccessDeny.py | +| 1349 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/bicep/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py | +| 1350 | CKV_AZURE_35 | resource | azurerm_storage_account | Ensure default network access rule for Storage Accounts is set to deny | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py | +| 1351 | CKV_AZURE_35 | resource | azurerm_storage_account_network_rules | Ensure default network access rule for Storage Accounts is set to deny | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py | +| 1352 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountAzureServicesAccessEnabled.py | +| 1353 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py | +| 1354 | CKV_AZURE_36 | resource | azurerm_storage_account | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py | +| 1355 | CKV_AZURE_36 | resource | azurerm_storage_account_network_rules | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py | +| 1356 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py | +| 1357 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py | +| 1358 | CKV_AZURE_37 | resource | azurerm_monitor_log_profile | Ensure that Activity Log Retention is set 365 days or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MonitorLogProfileRetentionDays.py | +| 1359 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MonitorLogProfileCategories.py | +| 1360 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MonitorLogProfileCategories.py | +| 1361 | CKV_AZURE_38 | resource | azurerm_monitor_log_profile | Ensure audit profile captures all the activities | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MonitorLogProfileCategories.py | +| 1362 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py | +| 1363 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py | +| 1364 | CKV_AZURE_39 | resource | azurerm_role_definition | Ensure that no custom subscription owner roles are created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CutsomRoleDefinitionSubscriptionOwner.py | +| 1365 | CKV_AZURE_40 | resource | azurerm_key_vault_key | Ensure that the expiration date is set on all keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyExpirationDate.py | +| 1366 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecretExpirationDate.py | +| 1367 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecretExpirationDate.py | +| 1368 | CKV_AZURE_41 | resource | azurerm_key_vault_secret | Ensure that the expiration date is set on all secrets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecretExpirationDate.py | +| 1369 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py | +| 1370 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py | +| 1371 | CKV_AZURE_42 | resource | azurerm_key_vault | Ensure the key vault is recoverable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyvaultRecoveryEnabled.py | +| 1372 | CKV_AZURE_43 | resource | azurerm_storage_account | Ensure Storage Accounts adhere to the naming rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountName.py | +| 1373 | CKV_AZURE_44 | resource | azurerm_storage_account | Ensure Storage Account is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountMinimumTlsVersion.py | +| 1374 | CKV_AZURE_45 | resource | azurerm_virtual_machine | Ensure that no sensitive credentials are exposed in VM custom_data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMCredsInCustomData.py | +| 1375 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py | +| 1376 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py | +| 1377 | CKV_AZURE_47 | resource | azurerm_mariadb_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MariaDBSSLEnforcementEnabled.py | +| 1378 | CKV_AZURE_48 | resource | azurerm_mariadb_server | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MariaDBPublicAccessDisabled.py | +| 1379 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureScaleSetPassword.py | +| 1380 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureScaleSetPassword.py | +| 1381 | CKV_AZURE_49 | resource | azurerm_linux_virtual_machine_scale_set | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureScaleSetPassword.py | +| 1382 | CKV_AZURE_50 | resource | azurerm_linux_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py | +| 1383 | CKV_AZURE_50 | resource | azurerm_windows_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py | +| 1384 | CKV_AZURE_52 | resource | azurerm_mssql_server | Ensure MSSQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MSSQLServerMinTLSVersion.py | +| 1385 | CKV_AZURE_53 | resource | azurerm_mysql_server | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLPublicAccessDisabled.py | +| 1386 | CKV_AZURE_54 | resource | azurerm_mysql_server | Ensure MySQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLServerMinTLSVersion.py | +| 1387 | CKV_AZURE_55 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnServers.py | +| 1388 | CKV_AZURE_56 | resource | azurerm_function_app | Ensure that function apps enables Authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppsEnableAuthentication.py | +| 1389 | CKV_AZURE_57 | resource | azurerm_app_service | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py | +| 1390 | CKV_AZURE_57 | resource | azurerm_linux_web_app | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py | +| 1391 | CKV_AZURE_57 | resource | azurerm_windows_web_app | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py | +| 1392 | CKV_AZURE_58 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces enables managed virtual networks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesManagedVirtualNetworks.py | +| 1393 | CKV_AZURE_59 | resource | azurerm_storage_account | Ensure that Storage accounts disallow public access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountDisablePublicAccess.py | +| 1394 | CKV_AZURE_61 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnAppServices.py | +| 1395 | CKV_AZURE_62 | resource | azurerm_function_app | Ensure function apps are not accessible from all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppDisallowCORS.py | +| 1396 | CKV_AZURE_63 | resource | azurerm_app_service | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py | +| 1397 | CKV_AZURE_63 | resource | azurerm_linux_web_app | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py | +| 1398 | CKV_AZURE_63 | resource | azurerm_windows_web_app | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py | +| 1399 | CKV_AZURE_64 | resource | azurerm_storage_sync | Ensure that Azure File Sync disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageSyncPublicAccessDisabled.py | +| 1400 | CKV_AZURE_65 | resource | azurerm_app_service | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py | +| 1401 | CKV_AZURE_65 | resource | azurerm_linux_web_app | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py | +| 1402 | CKV_AZURE_65 | resource | azurerm_windows_web_app | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py | +| 1403 | CKV_AZURE_66 | resource | azurerm_app_service | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py | +| 1404 | CKV_AZURE_66 | resource | azurerm_linux_web_app | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py | +| 1405 | CKV_AZURE_66 | resource | azurerm_windows_web_app | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py | +| 1406 | CKV_AZURE_67 | resource | azurerm_function_app | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py | +| 1407 | CKV_AZURE_67 | resource | azurerm_function_app_slot | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py | +| 1408 | CKV_AZURE_68 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerPublicAccessDisabled.py | +| 1409 | CKV_AZURE_69 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Azure SQL database servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServers.py | +| 1410 | CKV_AZURE_70 | resource | azurerm_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py | +| 1411 | CKV_AZURE_71 | resource | azurerm_app_service | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py | +| 1412 | CKV_AZURE_71 | resource | azurerm_linux_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py | +| 1413 | CKV_AZURE_71 | resource | azurerm_windows_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py | +| 1414 | CKV_AZURE_72 | resource | azurerm_app_service | Ensure that remote debugging is not enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/RemoteDebggingNotEnabled.py | +| 1415 | CKV_AZURE_73 | resource | azurerm_automation_variable_bool | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AutomationEncrypted.py | +| 1416 | CKV_AZURE_73 | resource | azurerm_automation_variable_datetime | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AutomationEncrypted.py | +| 1417 | CKV_AZURE_73 | resource | azurerm_automation_variable_int | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AutomationEncrypted.py | +| 1418 | CKV_AZURE_73 | resource | azurerm_automation_variable_string | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AutomationEncrypted.py | +| 1419 | CKV_AZURE_74 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses disk encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DataExplorerUsesDiskEncryption.py | +| 1420 | CKV_AZURE_75 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses double encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDataExplorerDoubleEncryptionEnabled.py | +| 1421 | CKV_AZURE_76 | resource | azurerm_batch_account | Ensure that Azure Batch account uses key vault to encrypt data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureBatchAccountUsesKeyVaultEncryption.py | +| 1422 | CKV_AZURE_77 | resource | azurerm_network_security_group | Ensure that UDP Services are restricted from the Internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py | +| 1423 | CKV_AZURE_77 | resource | azurerm_network_security_rule | Ensure that UDP Services are restricted from the Internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py | +| 1424 | CKV_AZURE_78 | resource | azurerm_app_service | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py | +| 1425 | CKV_AZURE_78 | resource | azurerm_linux_web_app | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py | +| 1426 | CKV_AZURE_78 | resource | azurerm_windows_web_app | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py | +| 1427 | CKV_AZURE_79 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for SQL servers on machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServerVMS.py | +| 1428 | CKV_AZURE_80 | resource | azurerm_app_service | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py | +| 1429 | CKV_AZURE_81 | resource | azurerm_app_service | Ensure that 'PHP version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServicePHPVersion.py | +| 1430 | CKV_AZURE_82 | resource | azurerm_app_service | Ensure that 'Python version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServicePythonVersion.py | +| 1431 | CKV_AZURE_83 | resource | azurerm_app_service | Ensure that 'Java version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceJavaVersion.py | +| 1432 | CKV_AZURE_84 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Storage | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnStorage.py | +| 1433 | CKV_AZURE_85 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Kubernetes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnKubernetes.py | +| 1434 | CKV_AZURE_86 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Container Registries | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnContainerRegistry.py | +| 1435 | CKV_AZURE_87 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Key Vault | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnKeyVaults.py | +| 1436 | CKV_AZURE_88 | resource | azurerm_app_service | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py | +| 1437 | CKV_AZURE_88 | resource | azurerm_linux_web_app | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py | +| 1438 | CKV_AZURE_88 | resource | azurerm_windows_web_app | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py | +| 1439 | CKV_AZURE_89 | resource | azurerm_redis_cache | Ensure that Azure Cache for Redis disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/RedisCachePublicNetworkAccessEnabled.py | +| 1440 | CKV_AZURE_91 | resource | azurerm_redis_cache | Ensure that only SSL are enabled for Cache for Redis | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/RedisCacheEnableNonSSLPort.py | +| 1441 | CKV_AZURE_92 | resource | azurerm_linux_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMStorageOsDisk.py | +| 1442 | CKV_AZURE_92 | resource | azurerm_windows_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMStorageOsDisk.py | +| 1443 | CKV_AZURE_93 | resource | azurerm_managed_disk | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureManagedDiskEncryptionSet.py | +| 1444 | CKV_AZURE_94 | resource | azurerm_mysql_server | Ensure that My SQL server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLGeoBackupEnabled.py | +| 1445 | CKV_AZURE_95 | resource | azurerm_virtual_machine_scale_set | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMScaleSetsAutoOSImagePatchingEnabled.py | +| 1446 | CKV_AZURE_96 | resource | azurerm_mysql_server | Ensure that MySQL server enables infrastructure encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLEncryptionEnaled.py | +| 1447 | CKV_AZURE_97 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py | +| 1448 | CKV_AZURE_97 | resource | azurerm_windows_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py | +| 1449 | CKV_AZURE_98 | resource | azurerm_container_group | Ensure that Azure Container group is deployed into virtual network | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureContainerGroupDeployedIntoVirtualNetwork.py | +| 1450 | CKV_AZURE_99 | resource | azurerm_cosmosdb_account | Ensure Cosmos DB accounts have restricted access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBAccountsRestrictedAccess.py | +| 1451 | CKV_AZURE_100 | resource | azurerm_cosmosdb_account | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBHaveCMK.py | +| 1452 | CKV_AZURE_101 | resource | azurerm_cosmosdb_account | Ensure that Azure Cosmos DB disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBDisablesPublicNetwork.py | +| 1453 | CKV_AZURE_102 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgressSQLGeoBackupEnabled.py | +| 1454 | CKV_AZURE_103 | resource | azurerm_data_factory | Ensure that Azure Data Factory uses Git repository for source control | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DataFactoryUsesGitRepository.py | +| 1455 | CKV_AZURE_104 | resource | azurerm_data_factory | Ensure that Azure Data factory public network access is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DataFactoryNoPublicNetworkAccess.py | +| 1456 | CKV_AZURE_105 | resource | azurerm_data_lake_store | Ensure that Data Lake Store accounts enables encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DataLakeStoreEncryption.py | +| 1457 | CKV_AZURE_106 | resource | azurerm_eventgrid_domain | Ensure that Azure Event Grid Domain public network access is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/EventgridDomainNetworkAccess.py | +| 1458 | CKV_AZURE_107 | resource | azurerm_api_management | Ensure that API management services use virtual networks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/APIServicesUseVirtualNetwork.py | +| 1459 | CKV_AZURE_108 | resource | azurerm_iothub | Ensure that Azure IoT Hub disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/IoTNoPublicNetworkAccess.py | +| 1460 | CKV_AZURE_109 | resource | azurerm_key_vault | Ensure that key vault allows firewall rules settings | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyVaultEnablesFirewallRulesSettings.py | +| 1461 | CKV_AZURE_110 | resource | azurerm_key_vault | Ensure that key vault enables purge protection | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyVaultEnablesPurgeProtection.py | +| 1462 | CKV_AZURE_111 | resource | azurerm_key_vault | Ensure that key vault enables soft delete | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyVaultEnablesSoftDelete.py | +| 1463 | CKV_AZURE_112 | resource | azurerm_key_vault_key | Ensure that key vault key is backed by HSM | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyBackedByHSM.py | +| 1464 | CKV_AZURE_113 | resource | azurerm_mssql_server | Ensure that SQL server disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerPublicAccessDisabled.py | +| 1465 | CKV_AZURE_114 | resource | azurerm_key_vault_secret | Ensure that key vault secrets have "content_type" set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecretContentType.py | +| 1466 | CKV_AZURE_115 | resource | azurerm_kubernetes_cluster | Ensure that AKS enables private clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSEnablesPrivateClusters.py | +| 1467 | CKV_AZURE_116 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses Azure Policies Add-on | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py | +| 1468 | CKV_AZURE_117 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses disk encryption set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSUsesDiskEncryptionSet.py | +| 1469 | CKV_AZURE_118 | resource | azurerm_network_interface | Ensure that Network Interfaces disable IP forwarding | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NetworkInterfaceEnableIPForwarding.py | +| 1470 | CKV_AZURE_119 | resource | azurerm_network_interface | Ensure that Network Interfaces don't use public IPs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1471 | CKV_AZURE_120 | resource | azurerm_application_gateway | Ensure that Application Gateway enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1472 | CKV_AZURE_120 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1473 | CKV_AZURE_121 | resource | azurerm_frontdoor | Ensure that Azure Front Door enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py | +| 1474 | CKV_AZURE_122 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway uses WAF in "Detection" or "Prevention" modes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppGWUseWAFMode.py | +| 1475 | CKV_AZURE_123 | resource | azurerm_frontdoor_firewall_policy | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FrontdoorUseWAFMode.py | +| 1476 | CKV_AZURE_124 | resource | azurerm_search_service | Ensure that Azure Cognitive Search disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureSearchPublicNetworkAccessDisabled.py | +| 1477 | CKV_AZURE_125 | resource | azurerm_service_fabric_cluster | Ensures that Service Fabric use three levels of protection available | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureServiceFabricClusterProtectionLevel.py | +| 1478 | CKV_AZURE_126 | resource | azurerm_service_fabric_cluster | Ensures that Active Directory is used for authentication for Service Fabric | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ActiveDirectoryUsedAuthenticationServiceFabric.py | +| 1479 | CKV_AZURE_127 | resource | azurerm_mysql_server | Ensure that My SQL server enables Threat detection policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLTreatDetectionEnabled.py | +| 1480 | CKV_AZURE_128 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables Threat detection policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgresSQLTreatDetectionEnabled.py | +| 1481 | CKV_AZURE_129 | resource | azurerm_mariadb_server | Ensure that MariaDB server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MariaDBGeoBackupEnabled.py | +| 1482 | CKV_AZURE_130 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables infrastructure encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLEncryptionEnabled.py | +| 1483 | CKV_AZURE_131 | resource | azurerm_security_center_contact | Ensure that 'Security contact emails' is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterContactEmails.py | +| 1484 | CKV_AZURE_131 | parameter | secureString | SecureString parameter should not have hardcoded default values | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/parameter/SecureStringParameterNoHardcodedValue.py | +| 1485 | CKV_AZURE_131 | parameter | string | SecureString parameter should not have hardcoded default values | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/bicep/checks/param/azure/SecureStringParameterNoHardcodedValue.py | +| 1486 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py | +| 1487 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py | +| 1488 | CKV_AZURE_132 | resource | azurerm_cosmosdb_account | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBDisableAccessKeyWrite.py | +| 1489 | CKV_AZURE_133 | resource | azurerm_frontdoor_firewall_policy | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FrontDoorWAFACLCVE202144228.py | +| 1490 | CKV_AZURE_134 | resource | azurerm_cognitive_account | Ensure that Cognitive Services accounts disable public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CognitiveServicesDisablesPublicNetwork.py | +| 1491 | CKV_AZURE_135 | resource | azurerm_web_application_firewall_policy | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppGatewayWAFACLCVE202144228.py | +| 1492 | CKV_AZURE_136 | resource | azurerm_postgresql_flexible_server | Ensure that PostgreSQL Flexible server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLFlexiServerGeoBackupEnabled.py | +| 1493 | CKV_AZURE_137 | resource | azurerm_container_registry | Ensure ACR admin account is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRAdminAccountDisabled.py | +| 1494 | CKV_AZURE_138 | resource | azurerm_container_registry | Ensures that ACR disables anonymous pulling of images | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRAnonymousPullDisabled.py | +| 1495 | CKV_AZURE_139 | resource | azurerm_container_registry | Ensure ACR set to disable public networking | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRPublicNetworkAccessDisabled.py | +| 1496 | CKV_AZURE_140 | resource | azurerm_cosmosdb_account | Ensure that Local Authentication is disabled on CosmosDB | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBLocalAuthDisabled.py | +| 1497 | CKV_AZURE_141 | resource | azurerm_kubernetes_cluster | Ensure AKS local admin account is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py | +| 1498 | CKV_AZURE_142 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Local Authentication is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MLCCLADisabled.py | +| 1499 | CKV_AZURE_143 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster nodes do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSNodePublicIpDisabled.py | +| 1500 | CKV_AZURE_144 | resource | azurerm_machine_learning_workspace | Ensure that Public Access is disabled for Machine Learning Workspace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MLPublicAccess.py | +| 1501 | CKV_AZURE_145 | resource | azurerm_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py | +| 1502 | CKV_AZURE_146 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerLogRetentionEnabled.py | +| 1503 | CKV_AZURE_147 | resource | azurerm_postgresql_server | Ensure PostgreSQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLMinTLSVersion.py | +| 1504 | CKV_AZURE_148 | resource | azurerm_redis_cache | Ensure Redis Cache is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/RedisCacheMinTLSVersion.py | +| 1505 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine | Ensure that Virtual machine does not enable password authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py | +| 1506 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine does not enable password authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py | +| 1507 | CKV_AZURE_150 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MLComputeClusterMinNodes.py | +| 1508 | CKV_AZURE_151 | resource | azurerm_windows_virtual_machine | Ensure Windows VM enables encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/WinVMEncryptionAtHost.py | +| 1509 | CKV_AZURE_152 | resource | azurerm_api_management | Ensure Client Certificates are enforced for API management | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/APIManagementCertsEnforced.py | +| 1510 | CKV_AZURE_153 | resource | azurerm_app_service_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py | +| 1511 | CKV_AZURE_154 | resource | azurerm_app_service_slot | Ensure the App service slot is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceSlotMinTLS.py | +| 1512 | CKV_AZURE_155 | resource | azurerm_app_service_slot | Ensure debugging is disabled for the App service slot | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceSlotDebugDisabled.py | +| 1513 | CKV_AZURE_156 | resource | azurerm_mssql_database_extended_auditing_policy | Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MSSQLServerAuditPolicyLogMonitor.py | +| 1514 | CKV_AZURE_157 | resource | azurerm_synapse_workspace | Ensure that Synapse workspace has data_exfiltration_protection_enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesDataExfilProtection.py | +| 1515 | CKV_AZURE_158 | resource | azurerm_databricks_workspace | Ensure that databricks workspace has not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py | +| 1516 | CKV_AZURE_159 | resource | azurerm_function_app | Ensure function app builtin logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py | +| 1517 | CKV_AZURE_159 | resource | azurerm_function_app_slot | Ensure function app builtin logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py | +| 1518 | CKV_AZURE_160 | resource | azurerm_network_security_group | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py | +| 1519 | CKV_AZURE_160 | resource | azurerm_network_security_rule | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py | +| 1520 | CKV_AZURE_161 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal is enabled on for HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SpringCloudAPIPortalHTTPSOnly.py | +| 1521 | CKV_AZURE_162 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal Public Access Is Disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SpringCloudAPIPortalPublicAccessIsDisabled.py | +| 1522 | CKV_AZURE_163 | resource | azurerm_container_registry | Enable vulnerability scanning for container images. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRContainerScanEnabled.py | +| 1523 | CKV_AZURE_164 | resource | azurerm_container_registry | Ensures that ACR uses signed/trusted images | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRUseSignedImages.py | +| 1524 | CKV_AZURE_165 | resource | azurerm_container_registry | Ensure geo-replicated container registries to match multi-region container deployments. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRGeoreplicated.py | +| 1525 | CKV_AZURE_166 | resource | azurerm_container_registry | Ensure container image quarantine, scan, and mark images verified | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACREnableImageQuarantine.py | +| 1526 | CKV_AZURE_167 | resource | azurerm_container_registry | Ensure a retention policy is set to cleanup untagged manifests. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACREnableRetentionPolicy.py | +| 1527 | CKV2_AZURE_1 | resource | azurerm_storage_account | Ensure storage for critical data are encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1528 | CKV2_AZURE_2 | resource | azurerm_mssql_server_security_alert_policy | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1529 | CKV2_AZURE_2 | resource | azurerm_sql_server | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1530 | CKV2_AZURE_3 | resource | azurerm_mssql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1531 | CKV2_AZURE_3 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1532 | CKV2_AZURE_3 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1533 | CKV2_AZURE_3 | resource | azurerm_sql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1534 | CKV2_AZURE_4 | resource | azurerm_mssql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1535 | CKV2_AZURE_4 | resource | azurerm_mssql_server_security_alert_policy | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1536 | CKV2_AZURE_4 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1537 | CKV2_AZURE_4 | resource | azurerm_sql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1538 | CKV2_AZURE_5 | resource | azurerm_mssql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1539 | CKV2_AZURE_5 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1540 | CKV2_AZURE_5 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1541 | CKV2_AZURE_5 | resource | azurerm_sql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1542 | CKV2_AZURE_6 | resource | azurerm_sql_firewall_rule | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1543 | CKV2_AZURE_6 | resource | azurerm_sql_server | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1544 | CKV2_AZURE_7 | resource | azurerm_sql_server | Ensure that Azure Active Directory Admin is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1545 | CKV2_AZURE_8 | resource | azurerm_monitor_activity_log_alert | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1546 | CKV2_AZURE_8 | resource | azurerm_storage_account | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1547 | CKV2_AZURE_8 | resource | azurerm_storage_container | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1548 | CKV2_AZURE_9 | resource | azurerm_virtual_machine | Ensure Virtual Machines are utilizing Managed Disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1549 | CKV2_AZURE_10 | resource | azurerm_virtual_machine | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1550 | CKV2_AZURE_10 | resource | azurerm_virtual_machine_extension | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1551 | CKV2_AZURE_11 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer encryption at rest uses a customer-managed key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1552 | CKV2_AZURE_12 | resource | azurerm_virtual_machine | Ensure that virtual machines are backed up using Azure Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1553 | CKV2_AZURE_13 | resource | azurerm_mssql_server_security_alert_policy | Ensure that sql servers enables data security policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1554 | CKV2_AZURE_13 | resource | azurerm_sql_server | Ensure that sql servers enables data security policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1555 | CKV2_AZURE_14 | resource | azurerm_managed_disk | Ensure that Unattached disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1556 | CKV2_AZURE_14 | resource | azurerm_virtual_machine | Ensure that Unattached disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1557 | CKV2_AZURE_15 | resource | azurerm_data_factory | Ensure that Azure data factories are encrypted with a customer-managed key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1558 | CKV2_AZURE_16 | resource | azurerm_mysql_server | Ensure that MySQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1559 | CKV2_AZURE_16 | resource | azurerm_mysql_server_key | Ensure that MySQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1560 | CKV2_AZURE_17 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1561 | CKV2_AZURE_17 | resource | azurerm_postgresql_server_key | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1562 | CKV2_AZURE_18 | resource | azurerm_storage_account | Ensure that Storage Accounts use customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1563 | CKV2_AZURE_18 | resource | azurerm_storage_account_customer_managed_key | Ensure that Storage Accounts use customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1564 | CKV2_AZURE_19 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1565 | CKV2_AZURE_20 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1566 | CKV2_AZURE_20 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1567 | CKV2_AZURE_20 | resource | azurerm_storage_table | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1568 | CKV2_AZURE_21 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1569 | CKV2_AZURE_21 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1570 | CKV2_AZURE_21 | resource | azurerm_storage_container | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1571 | CKV2_AZURE_22 | resource | azurerm_cognitive_account | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1572 | CKV2_AZURE_22 | resource | azurerm_cognitive_account_customer_managed_key | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1573 | CKV_AZUREPIPELINES_1 | azure_pipelines | jobs | Ensure container job uses a non latest version tag | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/ContainerLatestTag.py | +| 1574 | CKV_AZUREPIPELINES_1 | azure_pipelines | stages[].jobs[] | Ensure container job uses a non latest version tag | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/ContainerLatestTag.py | +| 1575 | CKV_AZUREPIPELINES_2 | azure_pipelines | jobs | Ensure container job uses a version digest | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/ContainerDigest.py | +| 1576 | CKV_AZUREPIPELINES_2 | azure_pipelines | stages[].jobs[] | Ensure container job uses a version digest | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/ContainerDigest.py | +| 1577 | CKV_AZUREPIPELINES_3 | azure_pipelines | jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/SetSecretVariable.py | +| 1578 | CKV_AZUREPIPELINES_3 | azure_pipelines | stages[].jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/SetSecretVariable.py | +| 1579 | CKV_BCW_1 | provider | bridgecrew | Ensure no hard coded API token exist in the provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/bridgecrew/credentials.py | +| 1580 | CKV_BITBUCKET_1 | bitbucket_configuration | * | Merge requests should require at least 2 approvals | bitbucket_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/bitbucket/checks/merge_requests_approvals.py | +| 1581 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | [{image:image,__startline__:__startline__,__endline__:__endline__}] | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/bitbucket_pipelines/checks/latest_image.py | +| 1582 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.*.[*][][][].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/bitbucket_pipelines/checks/latest_image.py | +| 1583 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.default[].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/bitbucket_pipelines/checks/latest_image.py | +| 1584 | CKV_CIRCLECIPIPELINES_1 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/latest_image.py | +| 1585 | CKV_CIRCLECIPIPELINES_2 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image version is referenced via hash not arbitrary tag. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/image_version_not_hash.py | +| 1586 | CKV_CIRCLECIPIPELINES_3 | circleci_pipelines | orbs.{orbs: @} | Ensure mutable development orbs are not used. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/prevent_development_orbs.py | +| 1587 | CKV_CIRCLECIPIPELINES_4 | circleci_pipelines | orbs.{orbs: @} | Ensure unversioned volatile orbs are not used. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/prevent_volatile_orbs.py | +| 1588 | CKV_CIRCLECIPIPELINES_5 | circleci_pipelines | jobs.*.steps[] | Suspicious use of netcat with IP address | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/ReverseShellNetcat.py | +| 1589 | CKV_CIRCLECIPIPELINES_6 | circleci_pipelines | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/ShellInjection.py | +| 1590 | CKV_CIRCLECIPIPELINES_7 | circleci_pipelines | jobs.*.steps[] | Suspicious use of curl in run task | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/SuspectCurlInScript.py | +| 1591 | CKV_CIRCLECIPIPELINES_8 | circleci_pipelines | executors.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Detecting image usages in circleci pipelines | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/DetectImagesUsage.py | +| 1592 | CKV_DIO_1 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/digitalocean/SpacesBucketVersioning.py | +| 1593 | CKV_DIO_2 | resource | digitalocean_droplet | Ensure the droplet specifies an SSH key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/digitalocean/DropletSSHKeys.py | +| 1594 | CKV_DIO_3 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket is private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/digitalocean/SpacesBucketPublicRead.py | +| 1595 | CKV_DIO_4 | resource | digitalocean_firewall | Ensure the firewall ingress is not wide open | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/digitalocean/FirewallIngressOpen.py | +| 1596 | CKV_DOCKER_1 | dockerfile | EXPOSE | Ensure port 22 is not exposed | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/ExposePort22.py | +| 1597 | CKV_DOCKER_2 | dockerfile | * | Ensure that HEALTHCHECK instructions have been added to container images | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/HealthcheckExists.py | +| 1598 | CKV_DOCKER_3 | dockerfile | * | Ensure that a user for the container has been created | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/UserExists.py | +| 1599 | CKV_DOCKER_4 | dockerfile | ADD | Ensure that COPY is used instead of ADD in Dockerfiles | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/AddExists.py | +| 1600 | CKV_DOCKER_5 | dockerfile | RUN | Ensure update instructions are not use alone in the Dockerfile | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/UpdateNotAlone.py | +| 1601 | CKV_DOCKER_6 | dockerfile | MAINTAINER | Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/MaintainerExists.py | +| 1602 | CKV_DOCKER_7 | dockerfile | FROM | Ensure the base image uses a non latest version tag | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/ReferenceLatestTag.py | +| 1603 | CKV_DOCKER_8 | dockerfile | USER | Ensure the last USER is not root | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/RootUser.py | +| 1604 | CKV_DOCKER_9 | dockerfile | RUN | Ensure that APT isn't used | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/RunUsingAPT.py | +| 1605 | CKV_DOCKER_10 | dockerfile | WORKDIR | Ensure that WORKDIR values are absolute paths | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/WorkdirIsAbsolute.py | +| 1606 | CKV_DOCKER_11 | dockerfile | FROM | Ensure From Alias are unique for multistage builds. | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/AliasIsUnique.py | +| 1607 | CKV2_DOCKER_1 | resource | RUN | Ensure that sudo isn't used | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1608 | CKV_GCP_1 | resource | google_container_cluster | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEClusterLogging.py | +| 1609 | CKV_GCP_2 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted ssh access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py | +| 1610 | CKV_GCP_3 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted rdp access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py | +| 1611 | CKV_GCP_4 | resource | google_compute_ssl_policy | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeSSLPolicy.py | +| 1612 | CKV_GCP_6 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance requires all incoming connections to use SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabaseRequireSsl.py | +| 1613 | CKV_GCP_7 | resource | google_container_cluster | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEDisableLegacyAuth.py | +| 1614 | CKV_GCP_8 | resource | google_container_cluster | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEMonitoringEnabled.py | +| 1615 | CKV_GCP_9 | resource | google_container_node_pool | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKENodePoolAutoRepairEnabled.py | +| 1616 | CKV_GCP_10 | resource | google_container_node_pool | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKENodePoolAutoUpgradeEnabled.py | +| 1617 | CKV_GCP_11 | resource | google_sql_database_instance | Ensure that Cloud SQL database Instances are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePubliclyAccessible.py | +| 1618 | CKV_GCP_12 | resource | google_container_cluster | Ensure Network Policy is enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKENetworkPolicyEnabled.py | +| 1619 | CKV_GCP_13 | resource | google_container_cluster | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py | +| 1620 | CKV_GCP_14 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance have backup configuration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlBackupConfiguration.py | +| 1621 | CKV_GCP_15 | resource | google_bigquery_dataset | Ensure that BigQuery datasets are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleBigQueryDatasetPublicACL.py | +| 1622 | CKV_GCP_16 | resource | google_dns_managed_zone | Ensure that DNSSEC is enabled for Cloud DNS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudDNSSECEnabled.py | +| 1623 | CKV_GCP_17 | resource | google_dns_managed_zone | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudDNSKeySpecsRSASHA1.py | +| 1624 | CKV_GCP_18 | resource | google_container_cluster | Ensure GKE Control Plane is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEPublicControlPlane.py | +| 1625 | CKV_GCP_19 | resource | google_container_cluster | Ensure GKE basic auth is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py | +| 1626 | CKV_GCP_20 | resource | google_container_cluster | Ensure master authorized networks is set to enabled in GKE clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEMasterAuthorizedNetworksEnabled.py | +| 1627 | CKV_GCP_21 | resource | google_container_cluster | Ensure Kubernetes Clusters are configured with Labels | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEHasLabels.py | +| 1628 | CKV_GCP_22 | resource | google_container_node_pool | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEUseCosImage.py | +| 1629 | CKV_GCP_23 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEAliasIpEnabled.py | +| 1630 | CKV_GCP_24 | resource | google_container_cluster | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEPodSecurityPolicyEnabled.py | +| 1631 | CKV_GCP_25 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Private cluster enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEPrivateClusterConfig.py | +| 1632 | CKV_GCP_26 | resource | google_compute_subnetwork | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py | +| 1633 | CKV_GCP_27 | resource | google_project | Ensure that the default network does not exist in a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectDefaultNetwork.py | +| 1634 | CKV_GCP_28 | resource | google_storage_bucket_iam_binding | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py | +| 1635 | CKV_GCP_28 | resource | google_storage_bucket_iam_member | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py | +| 1636 | CKV_GCP_29 | resource | google_storage_bucket | Ensure that Cloud Storage buckets have uniform bucket-level access enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleStorageBucketUniformAccess.py | +| 1637 | CKV_GCP_30 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py | +| 1638 | CKV_GCP_30 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py | +| 1639 | CKV_GCP_30 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py | +| 1640 | CKV_GCP_31 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py | +| 1641 | CKV_GCP_31 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py | +| 1642 | CKV_GCP_31 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py | +| 1643 | CKV_GCP_32 | resource | google_compute_instance | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py | +| 1644 | CKV_GCP_32 | resource | google_compute_instance_from_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py | +| 1645 | CKV_GCP_32 | resource | google_compute_instance_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py | +| 1646 | CKV_GCP_33 | resource | google_compute_project_metadata | Ensure oslogin is enabled for a Project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeProjectOSLogin.py | +| 1647 | CKV_GCP_34 | resource | google_compute_instance | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py | +| 1648 | CKV_GCP_34 | resource | google_compute_instance_from_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py | +| 1649 | CKV_GCP_34 | resource | google_compute_instance_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py | +| 1650 | CKV_GCP_35 | resource | google_compute_instance | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py | +| 1651 | CKV_GCP_35 | resource | google_compute_instance_from_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py | +| 1652 | CKV_GCP_35 | resource | google_compute_instance_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py | +| 1653 | CKV_GCP_36 | resource | google_compute_instance | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py | +| 1654 | CKV_GCP_36 | resource | google_compute_instance_from_template | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py | +| 1655 | CKV_GCP_36 | resource | google_compute_instance_template | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py | +| 1656 | CKV_GCP_37 | resource | google_compute_disk | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDiskEncryption.py | +| 1657 | CKV_GCP_38 | resource | google_compute_instance | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeBootDiskEncryption.py | +| 1658 | CKV_GCP_39 | resource | google_compute_instance | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py | +| 1659 | CKV_GCP_39 | resource | google_compute_instance_from_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py | +| 1660 | CKV_GCP_39 | resource | google_compute_instance_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py | +| 1661 | CKV_GCP_40 | resource | google_compute_instance | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py | +| 1662 | CKV_GCP_40 | resource | google_compute_instance_from_template | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py | +| 1663 | CKV_GCP_40 | resource | google_compute_instance_template | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py | +| 1664 | CKV_GCP_41 | resource | google_project_iam_binding | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py | +| 1665 | CKV_GCP_41 | resource | google_project_iam_member | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py | +| 1666 | CKV_GCP_42 | resource | google_project_iam_member | Ensure that Service Account has no Admin privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectAdminServiceAccount.py | +| 1667 | CKV_GCP_43 | resource | google_kms_crypto_key | Ensure KMS encryption keys are rotated within a period of 90 days | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py | +| 1668 | CKV_GCP_44 | resource | google_folder_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py | +| 1669 | CKV_GCP_44 | resource | google_folder_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py | +| 1670 | CKV_GCP_45 | resource | google_organization_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py | +| 1671 | CKV_GCP_45 | resource | google_organization_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py | +| 1672 | CKV_GCP_46 | resource | google_project_iam_binding | Ensure Default Service account is not used at a project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py | +| 1673 | CKV_GCP_46 | resource | google_project_iam_member | Ensure Default Service account is not used at a project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py | +| 1674 | CKV_GCP_47 | resource | google_organization_iam_binding | Ensure default service account is not used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py | +| 1675 | CKV_GCP_47 | resource | google_organization_iam_member | Ensure default service account is not used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py | +| 1676 | CKV_GCP_48 | resource | google_folder_iam_binding | Ensure Default Service account is not used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py | +| 1677 | CKV_GCP_48 | resource | google_folder_iam_member | Ensure Default Service account is not used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py | +| 1678 | CKV_GCP_49 | resource | google_project_iam_binding | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py | +| 1679 | CKV_GCP_49 | resource | google_project_iam_member | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py | +| 1680 | CKV_GCP_50 | resource | google_sql_database_instance | Ensure MySQL database 'local_infile' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudMySqlLocalInfileOff.py | +| 1681 | CKV_GCP_51 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogCheckpoints.py | +| 1682 | CKV_GCP_52 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_connections' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogConnection.py | +| 1683 | CKV_GCP_53 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_disconnections' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogDisconnection.py | +| 1684 | CKV_GCP_54 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogLockWaits.py | +| 1685 | CKV_GCP_55 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinMessage.py | +| 1686 | CKV_GCP_56 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_temp_files flag is set to '0' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogTemp.py | +| 1687 | CKV_GCP_57 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinDuration.py | +| 1688 | CKV_GCP_58 | resource | google_sql_database_instance | Ensure SQL database 'cross db ownership chaining' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerCrossDBOwnershipChaining.py | +| 1689 | CKV_GCP_59 | resource | google_sql_database_instance | Ensure SQL database 'contained database authentication' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerContainedDBAuthentication.py | +| 1690 | CKV_GCP_60 | resource | google_sql_database_instance | Ensure Cloud SQL database does not have public IP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerNoPublicIP.py | +| 1691 | CKV_GCP_61 | resource | google_container_cluster | Enable VPC Flow Logs and Intranode Visibility | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEEnableVPCFlowLogs.py | +| 1692 | CKV_GCP_62 | resource | google_storage_bucket | Bucket should log access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudStorageLogging.py | +| 1693 | CKV_GCP_63 | resource | google_storage_bucket | Bucket should not log to itself | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudStorageSelfLogging.py | +| 1694 | CKV_GCP_64 | resource | google_container_cluster | Ensure clusters are created with Private Nodes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEPrivateNodes.py | +| 1695 | CKV_GCP_65 | resource | google_container_cluster | Manage Kubernetes RBAC users with Google Groups for GKE | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEKubernetesRBACGoogleGroups.py | +| 1696 | CKV_GCP_66 | resource | google_container_cluster | Ensure use of Binary Authorization | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEBinaryAuthorization.py | +| 1697 | CKV_GCP_67 | resource | google_container_cluster | Ensure legacy Compute Engine instance metadata APIs are Disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKELegacyInstanceMetadataDisabled.py | +| 1698 | CKV_GCP_68 | resource | google_container_cluster | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py | +| 1699 | CKV_GCP_68 | resource | google_container_node_pool | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py | +| 1700 | CKV_GCP_69 | resource | google_container_cluster | Ensure the GKE Metadata Server is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py | +| 1701 | CKV_GCP_69 | resource | google_container_node_pool | Ensure the GKE Metadata Server is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py | +| 1702 | CKV_GCP_70 | resource | google_container_cluster | Ensure the GKE Release Channel is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEReleaseChannel.py | +| 1703 | CKV_GCP_71 | resource | google_container_cluster | Ensure Shielded GKE Nodes are Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEEnableShieldedNodes.py | +| 1704 | CKV_GCP_72 | resource | google_container_cluster | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py | +| 1705 | CKV_GCP_72 | resource | google_container_node_pool | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py | +| 1706 | CKV_GCP_73 | resource | google_compute_security_policy | Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudArmorWAFACLCVE202144228.py | +| 1707 | CKV_GCP_74 | resource | google_compute_subnetwork | Ensure that private_ip_google_access is enabled for Subnet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleSubnetworkPrivateGoogleEnabled.py | +| 1708 | CKV_GCP_75 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted FTP access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress21.py | +| 1709 | CKV_GCP_76 | resource | google_compute_subnetwork | Ensure that Private google access is enabled for IPV6 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleSubnetworkIPV6PrivateGoogleEnabled.py | +| 1710 | CKV_GCP_77 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow on ftp port | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress20.py | +| 1711 | CKV_GCP_78 | resource | google_storage_bucket | Ensure Cloud storage has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudStorageVersioningEnabled.py | +| 1712 | CKV_GCP_79 | resource | google_sql_database_instance | Ensure SQL database is using latest Major version | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py | +| 1713 | CKV_GCP_80 | resource | google_bigquery_table | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigQueryTableEncryptedWithCMK.py | +| 1714 | CKV_GCP_81 | resource | google_bigquery_dataset | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigQueryDatasetEncryptedWithCMK.py | +| 1715 | CKV_GCP_82 | resource | google_kms_crypto_key | Ensure KMS keys are protected from deletion | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleKMSPreventDestroy.py | +| 1716 | CKV_GCP_83 | resource | google_pubsub_topic | Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudPubSubEncryptedWithCMK.py | +| 1717 | CKV_GCP_84 | resource | google_artifact_registry_repository | Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/ArtifactRegsitryEncryptedWithCMK.py | +| 1718 | CKV_GCP_85 | resource | google_bigtable_instance | Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigTableInstanceEncryptedWithCMK.py | +| 1719 | CKV_GCP_86 | resource | google_cloudbuild_worker_pool | Ensure Cloud build workers are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudBuildWorkersArePrivate.py | +| 1720 | CKV_GCP_87 | resource | google_data_fusion_instance | Ensure Data fusion instances are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataFusionPrivateInstance.py | +| 1721 | CKV_GCP_88 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted mysql access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3306.py | +| 1722 | CKV_GCP_89 | resource | google_notebooks_instance | Ensure Vertex AI instances are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/VertexAIPrivateInstance.py | +| 1723 | CKV_GCP_90 | resource | google_dataflow_job | Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataflowJobEncryptedWithCMK.py | +| 1724 | CKV_GCP_91 | resource | google_dataproc_cluster | Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataprocClusterEncryptedWithCMK.py | +| 1725 | CKV_GCP_92 | resource | google_vertex_ai_dataset | Ensure Vertex AI datasets uses a CMK (Customer Manager Key) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/VertexAIDatasetEncryptedWithCMK.py | +| 1726 | CKV_GCP_93 | resource | google_spanner_database | Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/SpannerDatabaseEncryptedWithCMK.py | +| 1727 | CKV_GCP_94 | resource | google_dataflow_job | Ensure Dataflow jobs are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataflowPrivateJob.py | +| 1728 | CKV_GCP_95 | resource | google_redis_instance | Ensure Memorystore for Redis has AUTH enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/MemorystoreForRedisAuthEnabled.py | +| 1729 | CKV_GCP_96 | resource | google_vertex_ai_metadata_store | Ensure Vertex AI Metadata Store uses a CMK (Customer Manager Key) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/VertexAIMetadataStoreEncryptedWithCMK.py | +| 1730 | CKV_GCP_97 | resource | google_redis_instance | Ensure Memorystore for Redis uses intransit encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/MemorystoreForRedisInTransitEncryption.py | +| 1731 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_binding | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py | +| 1732 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_member | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py | +| 1733 | CKV_GCP_99 | resource | google_pubsub_topic_iam_binding | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py | +| 1734 | CKV_GCP_99 | resource | google_pubsub_topic_iam_member | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py | +| 1735 | CKV_GCP_100 | resource | google_bigquery_table_iam_binding | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py | +| 1736 | CKV_GCP_100 | resource | google_bigquery_table_iam_member | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py | +| 1737 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_binding | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py | +| 1738 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_member | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py | +| 1739 | CKV_GCP_102 | resource | google_cloud_run_service_iam_binding | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py | +| 1740 | CKV_GCP_102 | resource | google_cloud_run_service_iam_member | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py | +| 1741 | CKV_GCP_103 | resource | google_dataproc_cluster | Ensure Dataproc Clusters do not have public IPs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataprocPublicIpCluster.py | +| 1742 | CKV_GCP_104 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataFusionStackdriverLogs.py | +| 1743 | CKV_GCP_105 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver monitoring enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataFusionStackdriverMonitoring.py | +| 1744 | CKV_GCP_106 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress80.py | +| 1745 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_binding | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py | +| 1746 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_member | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py | +| 1747 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_binding | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py | +| 1748 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_member | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py | +| 1749 | CKV_GCP_108 | resource | google_sql_database_instance | Ensure hostnames are logged for GCP PostgreSQL databases | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogHostname.py | +| 1750 | CKV_GCP_109 | resource | google_sql_database_instance | Ensure the GCP PostgreSQL database log levels are set to ERROR or lower | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinErrorStatement.py | +| 1751 | CKV_GCP_110 | resource | google_sql_database_instance | Ensure pgAudit is enabled for your GCP PostgreSQL database | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlEnablePgaudit.py | +| 1752 | CKV_GCP_111 | resource | google_sql_database_instance | Ensure GCP PostgreSQL logs SQL statements | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogStatement.py | +| 1753 | CKV2_GCP_1 | resource | google_project_default_service_accounts | Ensure GKE clusters are not running using the Compute Engine default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1754 | CKV2_GCP_2 | resource | google_compute_network | Ensure legacy networks do not exist for a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1755 | CKV2_GCP_3 | resource | google_service_account_key | Ensure that there are only GCP-managed service account keys for each service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1756 | CKV2_GCP_4 | resource | google_logging_folder_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1757 | CKV2_GCP_4 | resource | google_logging_organization_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1758 | CKV2_GCP_4 | resource | google_logging_project_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1759 | CKV2_GCP_4 | resource | google_storage_bucket | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1760 | CKV2_GCP_5 | resource | google_project | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1761 | CKV2_GCP_5 | resource | google_project_iam_audit_config | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1762 | CKV2_GCP_6 | resource | google_kms_crypto_key | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1763 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_binding | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1764 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_member | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1765 | CKV2_GCP_7 | resource | google_sql_database_instance | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1766 | CKV2_GCP_7 | resource | google_sql_user | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1767 | CKV2_GCP_8 | resource | google_kms_key_ring | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1768 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_binding | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1769 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_member | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1770 | CKV2_GCP_9 | resource | google_container_registry | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1771 | CKV2_GCP_9 | resource | google_storage_bucket_iam_binding | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1772 | CKV2_GCP_9 | resource | google_storage_bucket_iam_member | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1773 | CKV2_GCP_10 | resource | google_cloudfunctions_function | Ensure GCP Cloud Function HTTP trigger is secured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1774 | CKV2_GCP_11 | resource | google_project_services | Ensure GCP GCR Container Vulnerability Scanning is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1775 | CKV2_GCP_12 | resource | google_compute_firewall | Ensure GCP compute firewall ingress does not allow unrestricted access to all ports | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1776 | CKV_GHA_1 | jobs | jobs | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py | +| 1777 | CKV_GHA_1 | jobs | jobs.*.steps[] | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py | +| 1778 | CKV_GHA_2 | jobs | jobs | Ensure run commands are not vulnerable to shell injection | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/ShellInjection.py | +| 1779 | CKV_GHA_2 | jobs | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/ShellInjection.py | +| 1780 | CKV_GHA_3 | jobs | jobs | Suspicious use of curl with secrets | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/SuspectCurlInScript.py | +| 1781 | CKV_GHA_3 | jobs | jobs.*.steps[] | Suspicious use of curl with secrets | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/SuspectCurlInScript.py | +| 1782 | CKV_GHA_4 | jobs | jobs | Suspicious use of netcat with IP address | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/ReverseShellNetcat.py | +| 1783 | CKV_GHA_4 | jobs | jobs.*.steps[] | Suspicious use of netcat with IP address | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/ReverseShellNetcat.py | +| 1784 | CKV_GHA_5 | jobs | jobs | Found artifact build without evidence of cosign sign execution in pipeline | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/CosignArtifacts.py | +| 1785 | CKV_GHA_6 | jobs | jobs | Found artifact build without evidence of cosign sbom attestation in pipeline | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/CosignSBOM.py | +| 1786 | CKV_GHA_7 | jobs | on | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/EmptyWorkflowDispatch.py | +| 1787 | CKV2_GHA_1 | resource | permissions | Ensure top-level permissions are not set to write-all | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1788 | CKV_GIT_1 | resource | github_repository | Ensure GitHub repository is Private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/PrivateRepo.py | +| 1789 | CKV_GIT_2 | resource | github_repository_webhook | Ensure GitHub repository webhooks are using HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/WebhookInsecureSsl.py | +| 1790 | CKV_GIT_3 | resource | github_repository | Ensure GitHub repository has vulnerability alerts enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py | +| 1791 | CKV_GIT_4 | resource | github_actions_environment_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/SecretsEncrypted.py | +| 1792 | CKV_GIT_4 | resource | github_actions_organization_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/SecretsEncrypted.py | +| 1793 | CKV_GIT_4 | resource | github_actions_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/SecretsEncrypted.py | +| 1794 | CKV_GIT_5 | resource | github_branch_protection | GitHub pull requests should require at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py | +| 1795 | CKV_GIT_5 | resource | github_branch_protection_v3 | GitHub pull requests should require at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py | +| 1796 | CKV_GIT_6 | resource | github_branch_protection | Ensure GitHub branch protection rules requires signed commits | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py | +| 1797 | CKV_GIT_6 | resource | github_branch_protection_v3 | Ensure GitHub branch protection rules requires signed commits | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py | +| 1798 | CKV2_GIT_1 | resource | github_repository | Ensure each Repository has branch protection associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1799 | CKV_GITHUB_1 | github_configuration | * | Ensure GitHub organization security settings require 2FA | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/2fa.py | +| 1800 | CKV_GITHUB_2 | github_configuration | * | Ensure GitHub organization security settings require SSO | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/sso.py | +| 1801 | CKV_GITHUB_3 | github_configuration | * | Ensure GitHub organization security settings has IP allow list enabled | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/ipallowlist.py | +| 1802 | CKV_GITHUB_4 | github_configuration | * | Ensure GitHub branch protection rules requires signed commits | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_signatures.py | +| 1803 | CKV_GITHUB_5 | github_configuration | * | Ensure GitHub branch protection rules does not allow force pushes | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/disallow_force_pushes.py | +| 1804 | CKV_GITHUB_6 | github_configuration | * | Ensure GitHub organization webhooks are using HTTPS | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/webhooks_https_orgs.py | +| 1805 | CKV_GITHUB_7 | github_configuration | * | Ensure GitHub repository webhooks are using HTTPS | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/webhooks_https_repos.py | +| 1806 | CKV_GITHUB_8 | github_configuration | * | Ensure GitHub branch protection rules requires linear history | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_linear_history.py | +| 1807 | CKV_GITHUB_9 | github_configuration | * | Ensure 2 admins are set for each repository | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/repository_collaborators.py | +| 1808 | CKV_GITHUB_10 | github_configuration | * | Ensure branch protection rules are enforced on administrators | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/enforce_branch_protection_admins.py | +| 1809 | CKV_GITHUB_11 | github_configuration | * | Ensure GitHub branch protection dismisses stale review on new commit - CIS 1.1.4 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/dismiss_stale_reviews.py | +| 1810 | CKV_GITHUB_12 | github_configuration | * | Ensure GitHub branch protection restricts who can dismiss PR reviews - CIS 1.1.5 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/restrict_pr_review_dismissal.py | +| 1811 | CKV_GITHUB_13 | github_configuration | * | Ensure GitHub branch protection requires CODEOWNER reviews - CIS 1.1.6 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_code_owner_reviews.py | +| 1812 | CKV_GITHUB_14 | github_configuration | * | Ensure GitHub branch protection requires status checks - CIS 1.1.9 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_status_checks_pr.py | +| 1813 | CKV_GITHUB_16 | github_configuration | * | Ensure GitHub branch protection requires conversation resolution - CIS 1.1.11 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_conversation_resolution.py | +| 1814 | CKV_GITHUB_17 | github_configuration | * | Ensure GitHub branch protection requires push restrictions - CIS 1.1.15 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_push_restrictions.py | +| 1815 | CKV_GITHUB_18 | github_configuration | * | Ensure GitHub branch protection rules does not allow deletions - CIS 1.1.17 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/disallow_branch_deletions.py | +| 1816 | CKV_GITLAB_1 | gitlab_configuration | * | Merge requests should require at least 2 approvals | gitlab_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab/checks/merge_requests_approvals.py | +| 1817 | CKV_GITLAB_2 | gitlab_configuration | * | Ensure all Gitlab groups require two factor authentication | gitlab_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab/checks/two_factor_authentication.py | +| 1818 | CKV_GITLABCI_1 | jobs | *.script[] | Suspicious use of curl with CI environment variables in script | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab_ci/checks/job/SuspectCurlInScript.py | +| 1819 | CKV_GITLABCI_2 | jobs | *.rules | Avoid creating rules that generate double pipelines | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab_ci/checks/job/AvoidDoublePipelines.py | +| 1820 | CKV_GITLABCI_3 | jobs | *.image[] | Detecting image usages in gitlab workflows | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab_ci/checks/job/DetectImagesUsage.py | +| 1821 | CKV_GITLABCI_3 | jobs | *.services[] | Detecting image usages in gitlab workflows | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab_ci/checks/job/DetectImagesUsage.py | +| 1822 | CKV_GLB_1 | resource | gitlab_project | Ensure at least two approving reviews are required to merge a GitLab MR | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gitlab/RequireTwoApprovalsToMerge.py | +| 1823 | CKV_GLB_2 | resource | gitlab_branch_protection | Ensure GitLab branch protection rules does not allow force pushes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gitlab/ForcePushDisabled.py | +| 1824 | CKV_GLB_3 | resource | gitlab_project | Ensure GitLab prevent secrets is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gitlab/PreventSecretsEnabled.py | +| 1825 | CKV_GLB_4 | resource | gitlab_project | Ensure GitLab commits are signed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gitlab/RejectUnsignedCommits.py | +| 1826 | CKV_K8S_1 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPIDPSP.py | +| 1827 | CKV_K8S_1 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPIDPSP.py | +| 1828 | CKV_K8S_2 | resource | PodSecurityPolicy | Do not admit privileged containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainersPSP.py | +| 1829 | CKV_K8S_2 | resource | kubernetes_pod_security_policy | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainerPSP.py | +| 1830 | CKV_K8S_3 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPCPSP.py | +| 1831 | CKV_K8S_3 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPCPSP.py | +| 1832 | CKV_K8S_4 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespacePSP.py | +| 1833 | CKV_K8S_4 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespacePSP.py | +| 1834 | CKV_K8S_5 | resource | PodSecurityPolicy | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalationPSP.py | +| 1835 | CKV_K8S_5 | resource | kubernetes_pod_security_policy | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalationPSP.py | +| 1836 | CKV_K8S_6 | resource | PodSecurityPolicy | Do not admit root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersPSP.py | +| 1837 | CKV_K8S_6 | resource | kubernetes_pod_security_policy | Do not admit root containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/RootContainerPSP.py | +| 1838 | CKV_K8S_7 | resource | PodSecurityPolicy | Do not admit containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilitiesPSP.py | +| 1839 | CKV_K8S_7 | resource | kubernetes_pod_security_policy | Do not admit containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilitiesPSP.py | +| 1840 | CKV_K8S_8 | resource | DaemonSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 1841 | CKV_K8S_8 | resource | Deployment | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 1842 | CKV_K8S_8 | resource | DeploymentConfig | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 1843 | CKV_K8S_8 | resource | Pod | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 1844 | CKV_K8S_8 | resource | PodTemplate | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 1845 | CKV_K8S_8 | resource | ReplicaSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 1846 | CKV_K8S_8 | resource | ReplicationController | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 1847 | CKV_K8S_8 | resource | StatefulSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 1848 | CKV_K8S_8 | resource | kubernetes_deployment | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py | +| 1849 | CKV_K8S_8 | resource | kubernetes_deployment_v1 | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py | +| 1850 | CKV_K8S_8 | resource | kubernetes_pod | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py | +| 1851 | CKV_K8S_8 | resource | kubernetes_pod_v1 | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py | +| 1852 | CKV_K8S_9 | resource | DaemonSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 1853 | CKV_K8S_9 | resource | Deployment | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 1854 | CKV_K8S_9 | resource | DeploymentConfig | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 1855 | CKV_K8S_9 | resource | Pod | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 1856 | CKV_K8S_9 | resource | PodTemplate | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 1857 | CKV_K8S_9 | resource | ReplicaSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 1858 | CKV_K8S_9 | resource | ReplicationController | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 1859 | CKV_K8S_9 | resource | StatefulSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 1860 | CKV_K8S_9 | resource | kubernetes_deployment | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py | +| 1861 | CKV_K8S_9 | resource | kubernetes_deployment_v1 | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py | +| 1862 | CKV_K8S_9 | resource | kubernetes_pod | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py | +| 1863 | CKV_K8S_9 | resource | kubernetes_pod_v1 | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py | +| 1864 | CKV_K8S_10 | resource | CronJob | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1865 | CKV_K8S_10 | resource | DaemonSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1866 | CKV_K8S_10 | resource | Deployment | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1867 | CKV_K8S_10 | resource | DeploymentConfig | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1868 | CKV_K8S_10 | resource | Job | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1869 | CKV_K8S_10 | resource | Pod | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1870 | CKV_K8S_10 | resource | PodTemplate | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1871 | CKV_K8S_10 | resource | ReplicaSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1872 | CKV_K8S_10 | resource | ReplicationController | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1873 | CKV_K8S_10 | resource | StatefulSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 1874 | CKV_K8S_10 | resource | kubernetes_deployment | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPURequests.py | +| 1875 | CKV_K8S_10 | resource | kubernetes_deployment_v1 | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPURequests.py | +| 1876 | CKV_K8S_10 | resource | kubernetes_pod | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPURequests.py | +| 1877 | CKV_K8S_10 | resource | kubernetes_pod_v1 | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPURequests.py | +| 1878 | CKV_K8S_11 | resource | CronJob | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1879 | CKV_K8S_11 | resource | DaemonSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1880 | CKV_K8S_11 | resource | Deployment | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1881 | CKV_K8S_11 | resource | DeploymentConfig | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1882 | CKV_K8S_11 | resource | Job | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1883 | CKV_K8S_11 | resource | Pod | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1884 | CKV_K8S_11 | resource | PodTemplate | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1885 | CKV_K8S_11 | resource | ReplicaSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1886 | CKV_K8S_11 | resource | ReplicationController | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1887 | CKV_K8S_11 | resource | StatefulSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 1888 | CKV_K8S_11 | resource | kubernetes_deployment | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPULimits.py | +| 1889 | CKV_K8S_11 | resource | kubernetes_deployment_v1 | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPULimits.py | +| 1890 | CKV_K8S_11 | resource | kubernetes_pod | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPULimits.py | +| 1891 | CKV_K8S_11 | resource | kubernetes_pod_v1 | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPULimits.py | +| 1892 | CKV_K8S_12 | resource | CronJob | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1893 | CKV_K8S_12 | resource | DaemonSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1894 | CKV_K8S_12 | resource | Deployment | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1895 | CKV_K8S_12 | resource | DeploymentConfig | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1896 | CKV_K8S_12 | resource | Job | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1897 | CKV_K8S_12 | resource | Pod | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1898 | CKV_K8S_12 | resource | PodTemplate | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1899 | CKV_K8S_12 | resource | ReplicaSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1900 | CKV_K8S_12 | resource | ReplicationController | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1901 | CKV_K8S_12 | resource | StatefulSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 1902 | CKV_K8S_12 | resource | kubernetes_deployment | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py | +| 1903 | CKV_K8S_12 | resource | kubernetes_deployment_v1 | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py | +| 1904 | CKV_K8S_12 | resource | kubernetes_pod | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py | +| 1905 | CKV_K8S_12 | resource | kubernetes_pod_v1 | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py | +| 1906 | CKV_K8S_13 | resource | CronJob | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1907 | CKV_K8S_13 | resource | DaemonSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1908 | CKV_K8S_13 | resource | Deployment | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1909 | CKV_K8S_13 | resource | DeploymentConfig | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1910 | CKV_K8S_13 | resource | Job | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1911 | CKV_K8S_13 | resource | Pod | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1912 | CKV_K8S_13 | resource | PodTemplate | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1913 | CKV_K8S_13 | resource | ReplicaSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1914 | CKV_K8S_13 | resource | ReplicationController | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1915 | CKV_K8S_13 | resource | StatefulSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 1916 | CKV_K8S_13 | resource | kubernetes_deployment | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py | +| 1917 | CKV_K8S_13 | resource | kubernetes_deployment_v1 | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py | +| 1918 | CKV_K8S_13 | resource | kubernetes_pod | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py | +| 1919 | CKV_K8S_13 | resource | kubernetes_pod_v1 | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py | +| 1920 | CKV_K8S_14 | resource | CronJob | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1921 | CKV_K8S_14 | resource | DaemonSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1922 | CKV_K8S_14 | resource | Deployment | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1923 | CKV_K8S_14 | resource | DeploymentConfig | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1924 | CKV_K8S_14 | resource | Job | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1925 | CKV_K8S_14 | resource | Pod | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1926 | CKV_K8S_14 | resource | PodTemplate | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1927 | CKV_K8S_14 | resource | ReplicaSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1928 | CKV_K8S_14 | resource | ReplicationController | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1929 | CKV_K8S_14 | resource | StatefulSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 1930 | CKV_K8S_14 | resource | kubernetes_deployment | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py | +| 1931 | CKV_K8S_14 | resource | kubernetes_deployment_v1 | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py | +| 1932 | CKV_K8S_14 | resource | kubernetes_pod | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py | +| 1933 | CKV_K8S_14 | resource | kubernetes_pod_v1 | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py | +| 1934 | CKV_K8S_15 | resource | CronJob | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1935 | CKV_K8S_15 | resource | DaemonSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1936 | CKV_K8S_15 | resource | Deployment | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1937 | CKV_K8S_15 | resource | DeploymentConfig | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1938 | CKV_K8S_15 | resource | Job | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1939 | CKV_K8S_15 | resource | Pod | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1940 | CKV_K8S_15 | resource | PodTemplate | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1941 | CKV_K8S_15 | resource | ReplicaSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1942 | CKV_K8S_15 | resource | ReplicationController | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1943 | CKV_K8S_15 | resource | StatefulSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 1944 | CKV_K8S_15 | resource | kubernetes_deployment | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py | +| 1945 | CKV_K8S_15 | resource | kubernetes_deployment_v1 | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py | +| 1946 | CKV_K8S_15 | resource | kubernetes_pod | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py | +| 1947 | CKV_K8S_15 | resource | kubernetes_pod_v1 | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py | +| 1948 | CKV_K8S_16 | resource | CronJob | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1949 | CKV_K8S_16 | resource | DaemonSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1950 | CKV_K8S_16 | resource | Deployment | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1951 | CKV_K8S_16 | resource | DeploymentConfig | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1952 | CKV_K8S_16 | resource | Job | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1953 | CKV_K8S_16 | resource | Pod | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1954 | CKV_K8S_16 | resource | PodTemplate | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1955 | CKV_K8S_16 | resource | ReplicaSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1956 | CKV_K8S_16 | resource | ReplicationController | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1957 | CKV_K8S_16 | resource | StatefulSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 1958 | CKV_K8S_16 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py | +| 1959 | CKV_K8S_16 | resource | kubernetes_deployment_v1 | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py | +| 1960 | CKV_K8S_16 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py | +| 1961 | CKV_K8S_16 | resource | kubernetes_pod_v1 | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py | +| 1962 | CKV_K8S_17 | resource | CronJob | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 1963 | CKV_K8S_17 | resource | DaemonSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 1964 | CKV_K8S_17 | resource | Deployment | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 1965 | CKV_K8S_17 | resource | Job | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 1966 | CKV_K8S_17 | resource | Pod | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 1967 | CKV_K8S_17 | resource | ReplicaSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 1968 | CKV_K8S_17 | resource | ReplicationController | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 1969 | CKV_K8S_17 | resource | StatefulSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 1970 | CKV_K8S_17 | resource | kubernetes_deployment | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py | +| 1971 | CKV_K8S_17 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py | +| 1972 | CKV_K8S_17 | resource | kubernetes_pod | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py | +| 1973 | CKV_K8S_17 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py | +| 1974 | CKV_K8S_18 | resource | CronJob | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 1975 | CKV_K8S_18 | resource | DaemonSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 1976 | CKV_K8S_18 | resource | Deployment | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 1977 | CKV_K8S_18 | resource | Job | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 1978 | CKV_K8S_18 | resource | Pod | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 1979 | CKV_K8S_18 | resource | ReplicaSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 1980 | CKV_K8S_18 | resource | ReplicationController | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 1981 | CKV_K8S_18 | resource | StatefulSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 1982 | CKV_K8S_18 | resource | kubernetes_deployment | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py | +| 1983 | CKV_K8S_18 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py | +| 1984 | CKV_K8S_18 | resource | kubernetes_pod | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py | +| 1985 | CKV_K8S_18 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py | +| 1986 | CKV_K8S_19 | resource | CronJob | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 1987 | CKV_K8S_19 | resource | DaemonSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 1988 | CKV_K8S_19 | resource | Deployment | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 1989 | CKV_K8S_19 | resource | Job | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 1990 | CKV_K8S_19 | resource | Pod | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 1991 | CKV_K8S_19 | resource | ReplicaSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 1992 | CKV_K8S_19 | resource | ReplicationController | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 1993 | CKV_K8S_19 | resource | StatefulSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 1994 | CKV_K8S_19 | resource | kubernetes_deployment | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py | +| 1995 | CKV_K8S_19 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py | +| 1996 | CKV_K8S_19 | resource | kubernetes_pod | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py | +| 1997 | CKV_K8S_19 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py | +| 1998 | CKV_K8S_20 | resource | CronJob | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 1999 | CKV_K8S_20 | resource | DaemonSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2000 | CKV_K8S_20 | resource | Deployment | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2001 | CKV_K8S_20 | resource | DeploymentConfig | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2002 | CKV_K8S_20 | resource | Job | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2003 | CKV_K8S_20 | resource | Pod | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2004 | CKV_K8S_20 | resource | PodTemplate | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2005 | CKV_K8S_20 | resource | ReplicaSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2006 | CKV_K8S_20 | resource | ReplicationController | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2007 | CKV_K8S_20 | resource | StatefulSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 2008 | CKV_K8S_20 | resource | kubernetes_deployment | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py | +| 2009 | CKV_K8S_20 | resource | kubernetes_deployment_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py | +| 2010 | CKV_K8S_20 | resource | kubernetes_pod | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py | +| 2011 | CKV_K8S_20 | resource | kubernetes_pod_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py | +| 2012 | CKV_K8S_21 | resource | ConfigMap | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2013 | CKV_K8S_21 | resource | CronJob | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2014 | CKV_K8S_21 | resource | DaemonSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2015 | CKV_K8S_21 | resource | Deployment | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2016 | CKV_K8S_21 | resource | Ingress | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2017 | CKV_K8S_21 | resource | Job | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2018 | CKV_K8S_21 | resource | Pod | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2019 | CKV_K8S_21 | resource | ReplicaSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2020 | CKV_K8S_21 | resource | ReplicationController | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2021 | CKV_K8S_21 | resource | Role | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2022 | CKV_K8S_21 | resource | RoleBinding | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2023 | CKV_K8S_21 | resource | Secret | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2024 | CKV_K8S_21 | resource | Service | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2025 | CKV_K8S_21 | resource | ServiceAccount | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2026 | CKV_K8S_21 | resource | StatefulSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 2027 | CKV_K8S_21 | resource | kubernetes_config_map | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2028 | CKV_K8S_21 | resource | kubernetes_config_map_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2029 | CKV_K8S_21 | resource | kubernetes_cron_job | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2030 | CKV_K8S_21 | resource | kubernetes_cron_job_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2031 | CKV_K8S_21 | resource | kubernetes_daemon_set_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2032 | CKV_K8S_21 | resource | kubernetes_daemonset | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2033 | CKV_K8S_21 | resource | kubernetes_deployment | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2034 | CKV_K8S_21 | resource | kubernetes_deployment_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2035 | CKV_K8S_21 | resource | kubernetes_ingress | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2036 | CKV_K8S_21 | resource | kubernetes_ingress_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2037 | CKV_K8S_21 | resource | kubernetes_job | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2038 | CKV_K8S_21 | resource | kubernetes_job_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2039 | CKV_K8S_21 | resource | kubernetes_pod | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2040 | CKV_K8S_21 | resource | kubernetes_pod_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2041 | CKV_K8S_21 | resource | kubernetes_replication_controller | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2042 | CKV_K8S_21 | resource | kubernetes_replication_controller_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2043 | CKV_K8S_21 | resource | kubernetes_role_binding | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2044 | CKV_K8S_21 | resource | kubernetes_role_binding_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2045 | CKV_K8S_21 | resource | kubernetes_secret | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2046 | CKV_K8S_21 | resource | kubernetes_secret_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2047 | CKV_K8S_21 | resource | kubernetes_service | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2048 | CKV_K8S_21 | resource | kubernetes_service_account | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2049 | CKV_K8S_21 | resource | kubernetes_service_account_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2050 | CKV_K8S_21 | resource | kubernetes_service_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2051 | CKV_K8S_21 | resource | kubernetes_stateful_set | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2052 | CKV_K8S_21 | resource | kubernetes_stateful_set_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 2053 | CKV_K8S_22 | resource | CronJob | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2054 | CKV_K8S_22 | resource | DaemonSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2055 | CKV_K8S_22 | resource | Deployment | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2056 | CKV_K8S_22 | resource | DeploymentConfig | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2057 | CKV_K8S_22 | resource | Job | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2058 | CKV_K8S_22 | resource | Pod | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2059 | CKV_K8S_22 | resource | PodTemplate | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2060 | CKV_K8S_22 | resource | ReplicaSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2061 | CKV_K8S_22 | resource | ReplicationController | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2062 | CKV_K8S_22 | resource | StatefulSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 2063 | CKV_K8S_22 | resource | kubernetes_deployment | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py | +| 2064 | CKV_K8S_22 | resource | kubernetes_deployment_v1 | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py | +| 2065 | CKV_K8S_22 | resource | kubernetes_pod | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py | +| 2066 | CKV_K8S_22 | resource | kubernetes_pod_v1 | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py | +| 2067 | CKV_K8S_23 | resource | CronJob | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 2068 | CKV_K8S_23 | resource | DaemonSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 2069 | CKV_K8S_23 | resource | Deployment | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 2070 | CKV_K8S_23 | resource | Job | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 2071 | CKV_K8S_23 | resource | Pod | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 2072 | CKV_K8S_23 | resource | ReplicaSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 2073 | CKV_K8S_23 | resource | ReplicationController | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 2074 | CKV_K8S_23 | resource | StatefulSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 2075 | CKV_K8S_24 | resource | PodSecurityPolicy | Do not allow containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesPSP.py | +| 2076 | CKV_K8S_24 | resource | kubernetes_pod_security_policy | Do not allow containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesPSP.py | +| 2077 | CKV_K8S_25 | resource | CronJob | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2078 | CKV_K8S_25 | resource | DaemonSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2079 | CKV_K8S_25 | resource | Deployment | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2080 | CKV_K8S_25 | resource | DeploymentConfig | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2081 | CKV_K8S_25 | resource | Job | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2082 | CKV_K8S_25 | resource | Pod | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2083 | CKV_K8S_25 | resource | PodTemplate | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2084 | CKV_K8S_25 | resource | ReplicaSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2085 | CKV_K8S_25 | resource | ReplicationController | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2086 | CKV_K8S_25 | resource | StatefulSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 2087 | CKV_K8S_25 | resource | kubernetes_deployment | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py | +| 2088 | CKV_K8S_25 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py | +| 2089 | CKV_K8S_25 | resource | kubernetes_pod | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py | +| 2090 | CKV_K8S_25 | resource | kubernetes_pod_v1 | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py | +| 2091 | CKV_K8S_26 | resource | CronJob | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2092 | CKV_K8S_26 | resource | DaemonSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2093 | CKV_K8S_26 | resource | Deployment | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2094 | CKV_K8S_26 | resource | DeploymentConfig | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2095 | CKV_K8S_26 | resource | Job | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2096 | CKV_K8S_26 | resource | Pod | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2097 | CKV_K8S_26 | resource | PodTemplate | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2098 | CKV_K8S_26 | resource | ReplicaSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2099 | CKV_K8S_26 | resource | ReplicationController | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2100 | CKV_K8S_26 | resource | StatefulSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 2101 | CKV_K8S_26 | resource | kubernetes_deployment | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/HostPort.py | +| 2102 | CKV_K8S_26 | resource | kubernetes_deployment_v1 | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/HostPort.py | +| 2103 | CKV_K8S_26 | resource | kubernetes_pod | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/HostPort.py | +| 2104 | CKV_K8S_26 | resource | kubernetes_pod_v1 | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/HostPort.py | +| 2105 | CKV_K8S_27 | resource | CronJob | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 2106 | CKV_K8S_27 | resource | DaemonSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 2107 | CKV_K8S_27 | resource | Deployment | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 2108 | CKV_K8S_27 | resource | Job | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 2109 | CKV_K8S_27 | resource | Pod | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 2110 | CKV_K8S_27 | resource | ReplicaSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 2111 | CKV_K8S_27 | resource | ReplicationController | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 2112 | CKV_K8S_27 | resource | StatefulSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 2113 | CKV_K8S_27 | resource | kubernetes_daemon_set_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 2114 | CKV_K8S_27 | resource | kubernetes_daemonset | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 2115 | CKV_K8S_27 | resource | kubernetes_deployment | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 2116 | CKV_K8S_27 | resource | kubernetes_deployment_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 2117 | CKV_K8S_27 | resource | kubernetes_pod | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 2118 | CKV_K8S_27 | resource | kubernetes_pod_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 2119 | CKV_K8S_28 | resource | CronJob | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2120 | CKV_K8S_28 | resource | DaemonSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2121 | CKV_K8S_28 | resource | Deployment | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2122 | CKV_K8S_28 | resource | DeploymentConfig | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2123 | CKV_K8S_28 | resource | Job | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2124 | CKV_K8S_28 | resource | Pod | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2125 | CKV_K8S_28 | resource | PodTemplate | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2126 | CKV_K8S_28 | resource | ReplicaSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2127 | CKV_K8S_28 | resource | ReplicationController | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2128 | CKV_K8S_28 | resource | StatefulSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 2129 | CKV_K8S_28 | resource | kubernetes_deployment | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py | +| 2130 | CKV_K8S_28 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py | +| 2131 | CKV_K8S_28 | resource | kubernetes_pod | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py | +| 2132 | CKV_K8S_28 | resource | kubernetes_pod_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py | +| 2133 | CKV_K8S_29 | resource | CronJob | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 2134 | CKV_K8S_29 | resource | DaemonSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 2135 | CKV_K8S_29 | resource | Deployment | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 2136 | CKV_K8S_29 | resource | Job | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 2137 | CKV_K8S_29 | resource | Pod | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 2138 | CKV_K8S_29 | resource | ReplicaSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 2139 | CKV_K8S_29 | resource | ReplicationController | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 2140 | CKV_K8S_29 | resource | StatefulSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 2141 | CKV_K8S_29 | resource | kubernetes_daemon_set_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 2142 | CKV_K8S_29 | resource | kubernetes_daemonset | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 2143 | CKV_K8S_29 | resource | kubernetes_deployment | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 2144 | CKV_K8S_29 | resource | kubernetes_deployment_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 2145 | CKV_K8S_29 | resource | kubernetes_pod | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 2146 | CKV_K8S_29 | resource | kubernetes_pod_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 2147 | CKV_K8S_30 | resource | CronJob | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2148 | CKV_K8S_30 | resource | DaemonSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2149 | CKV_K8S_30 | resource | Deployment | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2150 | CKV_K8S_30 | resource | DeploymentConfig | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2151 | CKV_K8S_30 | resource | Job | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2152 | CKV_K8S_30 | resource | Pod | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2153 | CKV_K8S_30 | resource | PodTemplate | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2154 | CKV_K8S_30 | resource | ReplicaSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2155 | CKV_K8S_30 | resource | ReplicationController | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2156 | CKV_K8S_30 | resource | StatefulSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 2157 | CKV_K8S_30 | resource | kubernetes_deployment | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py | +| 2158 | CKV_K8S_30 | resource | kubernetes_deployment_v1 | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py | +| 2159 | CKV_K8S_30 | resource | kubernetes_pod | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py | +| 2160 | CKV_K8S_30 | resource | kubernetes_pod_v1 | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py | +| 2161 | CKV_K8S_31 | resource | CronJob | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 2162 | CKV_K8S_31 | resource | DaemonSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 2163 | CKV_K8S_31 | resource | Deployment | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 2164 | CKV_K8S_31 | resource | Job | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 2165 | CKV_K8S_31 | resource | Pod | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 2166 | CKV_K8S_31 | resource | ReplicaSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 2167 | CKV_K8S_31 | resource | ReplicationController | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 2168 | CKV_K8S_31 | resource | StatefulSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 2169 | CKV_K8S_32 | resource | PodSecurityPolicy | Ensure default seccomp profile set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SeccompPSP.py | +| 2170 | CKV_K8S_32 | resource | kubernetes_pod_security_policy | Ensure default seccomp profile set to docker/default or runtime/default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SeccompPSP.py | +| 2171 | CKV_K8S_33 | resource | CronJob | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2172 | CKV_K8S_33 | resource | DaemonSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2173 | CKV_K8S_33 | resource | Deployment | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2174 | CKV_K8S_33 | resource | DeploymentConfig | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2175 | CKV_K8S_33 | resource | Job | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2176 | CKV_K8S_33 | resource | Pod | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2177 | CKV_K8S_33 | resource | PodTemplate | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2178 | CKV_K8S_33 | resource | ReplicaSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2179 | CKV_K8S_33 | resource | ReplicationController | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2180 | CKV_K8S_33 | resource | StatefulSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 2181 | CKV_K8S_34 | resource | CronJob | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2182 | CKV_K8S_34 | resource | DaemonSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2183 | CKV_K8S_34 | resource | Deployment | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2184 | CKV_K8S_34 | resource | DeploymentConfig | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2185 | CKV_K8S_34 | resource | Job | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2186 | CKV_K8S_34 | resource | Pod | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2187 | CKV_K8S_34 | resource | PodTemplate | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2188 | CKV_K8S_34 | resource | ReplicaSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2189 | CKV_K8S_34 | resource | ReplicationController | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2190 | CKV_K8S_34 | resource | StatefulSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 2191 | CKV_K8S_34 | resource | kubernetes_deployment | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Tiller.py | +| 2192 | CKV_K8S_34 | resource | kubernetes_deployment_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Tiller.py | +| 2193 | CKV_K8S_34 | resource | kubernetes_pod | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Tiller.py | +| 2194 | CKV_K8S_34 | resource | kubernetes_pod_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Tiller.py | +| 2195 | CKV_K8S_35 | resource | CronJob | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2196 | CKV_K8S_35 | resource | DaemonSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2197 | CKV_K8S_35 | resource | Deployment | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2198 | CKV_K8S_35 | resource | DeploymentConfig | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2199 | CKV_K8S_35 | resource | Job | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2200 | CKV_K8S_35 | resource | Pod | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2201 | CKV_K8S_35 | resource | PodTemplate | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2202 | CKV_K8S_35 | resource | ReplicaSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2203 | CKV_K8S_35 | resource | ReplicationController | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2204 | CKV_K8S_35 | resource | StatefulSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 2205 | CKV_K8S_35 | resource | kubernetes_deployment | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Secrets.py | +| 2206 | CKV_K8S_35 | resource | kubernetes_deployment_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Secrets.py | +| 2207 | CKV_K8S_35 | resource | kubernetes_pod | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Secrets.py | +| 2208 | CKV_K8S_35 | resource | kubernetes_pod_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Secrets.py | +| 2209 | CKV_K8S_36 | resource | PodSecurityPolicy | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilitiesPSP.py | +| 2210 | CKV_K8S_36 | resource | kubernetes_pod_security_policy | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilitiesPSP.py | +| 2211 | CKV_K8S_37 | resource | CronJob | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2212 | CKV_K8S_37 | resource | DaemonSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2213 | CKV_K8S_37 | resource | Deployment | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2214 | CKV_K8S_37 | resource | DeploymentConfig | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2215 | CKV_K8S_37 | resource | Job | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2216 | CKV_K8S_37 | resource | Pod | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2217 | CKV_K8S_37 | resource | PodTemplate | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2218 | CKV_K8S_37 | resource | ReplicaSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2219 | CKV_K8S_37 | resource | ReplicationController | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2220 | CKV_K8S_37 | resource | StatefulSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 2221 | CKV_K8S_37 | resource | kubernetes_deployment | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py | +| 2222 | CKV_K8S_37 | resource | kubernetes_deployment_v1 | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py | +| 2223 | CKV_K8S_37 | resource | kubernetes_pod | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py | +| 2224 | CKV_K8S_37 | resource | kubernetes_pod_v1 | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py | +| 2225 | CKV_K8S_38 | resource | CronJob | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 2226 | CKV_K8S_38 | resource | DaemonSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 2227 | CKV_K8S_38 | resource | Deployment | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 2228 | CKV_K8S_38 | resource | Job | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 2229 | CKV_K8S_38 | resource | Pod | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 2230 | CKV_K8S_38 | resource | ReplicaSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 2231 | CKV_K8S_38 | resource | ReplicationController | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 2232 | CKV_K8S_38 | resource | StatefulSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 2233 | CKV_K8S_39 | resource | CronJob | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2234 | CKV_K8S_39 | resource | DaemonSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2235 | CKV_K8S_39 | resource | Deployment | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2236 | CKV_K8S_39 | resource | DeploymentConfig | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2237 | CKV_K8S_39 | resource | Job | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2238 | CKV_K8S_39 | resource | Pod | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2239 | CKV_K8S_39 | resource | PodTemplate | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2240 | CKV_K8S_39 | resource | ReplicaSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2241 | CKV_K8S_39 | resource | ReplicationController | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2242 | CKV_K8S_39 | resource | StatefulSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 2243 | CKV_K8S_39 | resource | kubernetes_deployment | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py | +| 2244 | CKV_K8S_39 | resource | kubernetes_deployment_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py | +| 2245 | CKV_K8S_39 | resource | kubernetes_pod | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py | +| 2246 | CKV_K8S_39 | resource | kubernetes_pod_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py | +| 2247 | CKV_K8S_40 | resource | CronJob | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 2248 | CKV_K8S_40 | resource | DaemonSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 2249 | CKV_K8S_40 | resource | Deployment | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 2250 | CKV_K8S_40 | resource | Job | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 2251 | CKV_K8S_40 | resource | Pod | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 2252 | CKV_K8S_40 | resource | ReplicaSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 2253 | CKV_K8S_40 | resource | ReplicationController | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 2254 | CKV_K8S_40 | resource | StatefulSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 2255 | CKV_K8S_41 | resource | ServiceAccount | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccount.py | +| 2256 | CKV_K8S_41 | resource | kubernetes_service_account | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py | +| 2257 | CKV_K8S_41 | resource | kubernetes_service_account_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py | +| 2258 | CKV_K8S_42 | resource | ClusterRoleBinding | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py | +| 2259 | CKV_K8S_42 | resource | RoleBinding | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py | +| 2260 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py | +| 2261 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py | +| 2262 | CKV_K8S_42 | resource | kubernetes_role_binding | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py | +| 2263 | CKV_K8S_42 | resource | kubernetes_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py | +| 2264 | CKV_K8S_43 | resource | CronJob | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2265 | CKV_K8S_43 | resource | DaemonSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2266 | CKV_K8S_43 | resource | Deployment | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2267 | CKV_K8S_43 | resource | DeploymentConfig | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2268 | CKV_K8S_43 | resource | Job | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2269 | CKV_K8S_43 | resource | Pod | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2270 | CKV_K8S_43 | resource | PodTemplate | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2271 | CKV_K8S_43 | resource | ReplicaSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2272 | CKV_K8S_43 | resource | ReplicationController | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2273 | CKV_K8S_43 | resource | StatefulSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 2274 | CKV_K8S_43 | resource | kubernetes_deployment | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageDigest.py | +| 2275 | CKV_K8S_43 | resource | kubernetes_deployment_v1 | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageDigest.py | +| 2276 | CKV_K8S_43 | resource | kubernetes_pod | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageDigest.py | +| 2277 | CKV_K8S_43 | resource | kubernetes_pod_v1 | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageDigest.py | +| 2278 | CKV_K8S_44 | resource | Service | Ensure that the Tiller Service (Helm v2) is deleted | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerService.py | +| 2279 | CKV_K8S_44 | resource | kubernetes_service | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/TillerService.py | +| 2280 | CKV_K8S_44 | resource | kubernetes_service_v1 | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/TillerService.py | +| 2281 | CKV_K8S_45 | resource | CronJob | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2282 | CKV_K8S_45 | resource | DaemonSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2283 | CKV_K8S_45 | resource | Deployment | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2284 | CKV_K8S_45 | resource | DeploymentConfig | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2285 | CKV_K8S_45 | resource | Job | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2286 | CKV_K8S_45 | resource | Pod | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2287 | CKV_K8S_45 | resource | PodTemplate | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2288 | CKV_K8S_45 | resource | ReplicaSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2289 | CKV_K8S_45 | resource | ReplicationController | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2290 | CKV_K8S_45 | resource | StatefulSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 2291 | CKV_K8S_49 | resource | ClusterRole | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/WildcardRoles.py | +| 2292 | CKV_K8S_49 | resource | Role | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/WildcardRoles.py | +| 2293 | CKV_K8S_49 | resource | kubernetes_cluster_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py | +| 2294 | CKV_K8S_49 | resource | kubernetes_cluster_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py | +| 2295 | CKV_K8S_49 | resource | kubernetes_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py | +| 2296 | CKV_K8S_49 | resource | kubernetes_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py | +| 2297 | CKV_K8S_68 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2298 | CKV_K8S_68 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2299 | CKV_K8S_68 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2300 | CKV_K8S_68 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2301 | CKV_K8S_68 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2302 | CKV_K8S_68 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2303 | CKV_K8S_68 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2304 | CKV_K8S_68 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2305 | CKV_K8S_68 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2306 | CKV_K8S_68 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 2307 | CKV_K8S_69 | resource | CronJob | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2308 | CKV_K8S_69 | resource | DaemonSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2309 | CKV_K8S_69 | resource | Deployment | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2310 | CKV_K8S_69 | resource | DeploymentConfig | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2311 | CKV_K8S_69 | resource | Job | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2312 | CKV_K8S_69 | resource | Pod | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2313 | CKV_K8S_69 | resource | PodTemplate | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2314 | CKV_K8S_69 | resource | ReplicaSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2315 | CKV_K8S_69 | resource | ReplicationController | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2316 | CKV_K8S_69 | resource | StatefulSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 2317 | CKV_K8S_70 | resource | CronJob | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2318 | CKV_K8S_70 | resource | DaemonSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2319 | CKV_K8S_70 | resource | Deployment | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2320 | CKV_K8S_70 | resource | DeploymentConfig | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2321 | CKV_K8S_70 | resource | Job | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2322 | CKV_K8S_70 | resource | Pod | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2323 | CKV_K8S_70 | resource | PodTemplate | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2324 | CKV_K8S_70 | resource | ReplicaSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2325 | CKV_K8S_70 | resource | ReplicationController | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2326 | CKV_K8S_70 | resource | StatefulSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 2327 | CKV_K8S_71 | resource | CronJob | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2328 | CKV_K8S_71 | resource | DaemonSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2329 | CKV_K8S_71 | resource | Deployment | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2330 | CKV_K8S_71 | resource | DeploymentConfig | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2331 | CKV_K8S_71 | resource | Job | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2332 | CKV_K8S_71 | resource | Pod | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2333 | CKV_K8S_71 | resource | PodTemplate | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2334 | CKV_K8S_71 | resource | ReplicaSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2335 | CKV_K8S_71 | resource | ReplicationController | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2336 | CKV_K8S_71 | resource | StatefulSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 2337 | CKV_K8S_72 | resource | CronJob | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2338 | CKV_K8S_72 | resource | DaemonSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2339 | CKV_K8S_72 | resource | Deployment | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2340 | CKV_K8S_72 | resource | DeploymentConfig | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2341 | CKV_K8S_72 | resource | Job | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2342 | CKV_K8S_72 | resource | Pod | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2343 | CKV_K8S_72 | resource | PodTemplate | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2344 | CKV_K8S_72 | resource | ReplicaSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2345 | CKV_K8S_72 | resource | ReplicationController | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2346 | CKV_K8S_72 | resource | StatefulSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 2347 | CKV_K8S_73 | resource | CronJob | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2348 | CKV_K8S_73 | resource | DaemonSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2349 | CKV_K8S_73 | resource | Deployment | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2350 | CKV_K8S_73 | resource | DeploymentConfig | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2351 | CKV_K8S_73 | resource | Job | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2352 | CKV_K8S_73 | resource | Pod | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2353 | CKV_K8S_73 | resource | PodTemplate | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2354 | CKV_K8S_73 | resource | ReplicaSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2355 | CKV_K8S_73 | resource | ReplicationController | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2356 | CKV_K8S_73 | resource | StatefulSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 2357 | CKV_K8S_74 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2358 | CKV_K8S_74 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2359 | CKV_K8S_74 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2360 | CKV_K8S_74 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2361 | CKV_K8S_74 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2362 | CKV_K8S_74 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2363 | CKV_K8S_74 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2364 | CKV_K8S_74 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2365 | CKV_K8S_74 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2366 | CKV_K8S_74 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 2367 | CKV_K8S_75 | resource | CronJob | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2368 | CKV_K8S_75 | resource | DaemonSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2369 | CKV_K8S_75 | resource | Deployment | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2370 | CKV_K8S_75 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2371 | CKV_K8S_75 | resource | Job | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2372 | CKV_K8S_75 | resource | Pod | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2373 | CKV_K8S_75 | resource | PodTemplate | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2374 | CKV_K8S_75 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2375 | CKV_K8S_75 | resource | ReplicationController | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2376 | CKV_K8S_75 | resource | StatefulSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 2377 | CKV_K8S_77 | resource | CronJob | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2378 | CKV_K8S_77 | resource | DaemonSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2379 | CKV_K8S_77 | resource | Deployment | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2380 | CKV_K8S_77 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2381 | CKV_K8S_77 | resource | Job | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2382 | CKV_K8S_77 | resource | Pod | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2383 | CKV_K8S_77 | resource | PodTemplate | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2384 | CKV_K8S_77 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2385 | CKV_K8S_77 | resource | ReplicationController | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2386 | CKV_K8S_77 | resource | StatefulSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 2387 | CKV_K8S_78 | resource | AdmissionConfiguration | Ensure that the admission control plugin EventRateLimit is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlEventRateLimit.py | +| 2388 | CKV_K8S_79 | resource | CronJob | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2389 | CKV_K8S_79 | resource | DaemonSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2390 | CKV_K8S_79 | resource | Deployment | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2391 | CKV_K8S_79 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2392 | CKV_K8S_79 | resource | Job | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2393 | CKV_K8S_79 | resource | Pod | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2394 | CKV_K8S_79 | resource | PodTemplate | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2395 | CKV_K8S_79 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2396 | CKV_K8S_79 | resource | ReplicationController | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2397 | CKV_K8S_79 | resource | StatefulSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 2398 | CKV_K8S_80 | resource | CronJob | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2399 | CKV_K8S_80 | resource | DaemonSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2400 | CKV_K8S_80 | resource | Deployment | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2401 | CKV_K8S_80 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2402 | CKV_K8S_80 | resource | Job | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2403 | CKV_K8S_80 | resource | Pod | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2404 | CKV_K8S_80 | resource | PodTemplate | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2405 | CKV_K8S_80 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2406 | CKV_K8S_80 | resource | ReplicationController | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2407 | CKV_K8S_80 | resource | StatefulSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 2408 | CKV_K8S_81 | resource | CronJob | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2409 | CKV_K8S_81 | resource | DaemonSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2410 | CKV_K8S_81 | resource | Deployment | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2411 | CKV_K8S_81 | resource | DeploymentConfig | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2412 | CKV_K8S_81 | resource | Job | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2413 | CKV_K8S_81 | resource | Pod | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2414 | CKV_K8S_81 | resource | PodTemplate | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2415 | CKV_K8S_81 | resource | ReplicaSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2416 | CKV_K8S_81 | resource | ReplicationController | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2417 | CKV_K8S_81 | resource | StatefulSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 2418 | CKV_K8S_82 | resource | CronJob | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2419 | CKV_K8S_82 | resource | DaemonSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2420 | CKV_K8S_82 | resource | Deployment | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2421 | CKV_K8S_82 | resource | DeploymentConfig | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2422 | CKV_K8S_82 | resource | Job | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2423 | CKV_K8S_82 | resource | Pod | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2424 | CKV_K8S_82 | resource | PodTemplate | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2425 | CKV_K8S_82 | resource | ReplicaSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2426 | CKV_K8S_82 | resource | ReplicationController | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2427 | CKV_K8S_82 | resource | StatefulSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 2428 | CKV_K8S_83 | resource | CronJob | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2429 | CKV_K8S_83 | resource | DaemonSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2430 | CKV_K8S_83 | resource | Deployment | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2431 | CKV_K8S_83 | resource | DeploymentConfig | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2432 | CKV_K8S_83 | resource | Job | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2433 | CKV_K8S_83 | resource | Pod | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2434 | CKV_K8S_83 | resource | PodTemplate | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2435 | CKV_K8S_83 | resource | ReplicaSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2436 | CKV_K8S_83 | resource | ReplicationController | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2437 | CKV_K8S_83 | resource | StatefulSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 2438 | CKV_K8S_84 | resource | CronJob | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2439 | CKV_K8S_84 | resource | DaemonSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2440 | CKV_K8S_84 | resource | Deployment | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2441 | CKV_K8S_84 | resource | DeploymentConfig | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2442 | CKV_K8S_84 | resource | Job | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2443 | CKV_K8S_84 | resource | Pod | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2444 | CKV_K8S_84 | resource | PodTemplate | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2445 | CKV_K8S_84 | resource | ReplicaSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2446 | CKV_K8S_84 | resource | ReplicationController | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2447 | CKV_K8S_84 | resource | StatefulSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 2448 | CKV_K8S_85 | resource | CronJob | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2449 | CKV_K8S_85 | resource | DaemonSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2450 | CKV_K8S_85 | resource | Deployment | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2451 | CKV_K8S_85 | resource | DeploymentConfig | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2452 | CKV_K8S_85 | resource | Job | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2453 | CKV_K8S_85 | resource | Pod | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2454 | CKV_K8S_85 | resource | PodTemplate | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2455 | CKV_K8S_85 | resource | ReplicaSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2456 | CKV_K8S_85 | resource | ReplicationController | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2457 | CKV_K8S_85 | resource | StatefulSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 2458 | CKV_K8S_86 | resource | CronJob | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2459 | CKV_K8S_86 | resource | DaemonSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2460 | CKV_K8S_86 | resource | Deployment | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2461 | CKV_K8S_86 | resource | DeploymentConfig | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2462 | CKV_K8S_86 | resource | Job | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2463 | CKV_K8S_86 | resource | Pod | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2464 | CKV_K8S_86 | resource | PodTemplate | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2465 | CKV_K8S_86 | resource | ReplicaSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2466 | CKV_K8S_86 | resource | ReplicationController | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2467 | CKV_K8S_86 | resource | StatefulSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 2468 | CKV_K8S_88 | resource | CronJob | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2469 | CKV_K8S_88 | resource | DaemonSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2470 | CKV_K8S_88 | resource | Deployment | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2471 | CKV_K8S_88 | resource | DeploymentConfig | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2472 | CKV_K8S_88 | resource | Job | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2473 | CKV_K8S_88 | resource | Pod | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2474 | CKV_K8S_88 | resource | PodTemplate | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2475 | CKV_K8S_88 | resource | ReplicaSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2476 | CKV_K8S_88 | resource | ReplicationController | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2477 | CKV_K8S_88 | resource | StatefulSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 2478 | CKV_K8S_89 | resource | CronJob | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2479 | CKV_K8S_89 | resource | DaemonSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2480 | CKV_K8S_89 | resource | Deployment | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2481 | CKV_K8S_89 | resource | DeploymentConfig | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2482 | CKV_K8S_89 | resource | Job | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2483 | CKV_K8S_89 | resource | Pod | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2484 | CKV_K8S_89 | resource | PodTemplate | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2485 | CKV_K8S_89 | resource | ReplicaSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2486 | CKV_K8S_89 | resource | ReplicationController | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2487 | CKV_K8S_89 | resource | StatefulSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 2488 | CKV_K8S_90 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2489 | CKV_K8S_90 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2490 | CKV_K8S_90 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2491 | CKV_K8S_90 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2492 | CKV_K8S_90 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2493 | CKV_K8S_90 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2494 | CKV_K8S_90 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2495 | CKV_K8S_90 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2496 | CKV_K8S_90 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2497 | CKV_K8S_90 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 2498 | CKV_K8S_91 | resource | CronJob | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2499 | CKV_K8S_91 | resource | DaemonSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2500 | CKV_K8S_91 | resource | Deployment | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2501 | CKV_K8S_91 | resource | DeploymentConfig | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2502 | CKV_K8S_91 | resource | Job | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2503 | CKV_K8S_91 | resource | Pod | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2504 | CKV_K8S_91 | resource | PodTemplate | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2505 | CKV_K8S_91 | resource | ReplicaSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2506 | CKV_K8S_91 | resource | ReplicationController | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2507 | CKV_K8S_91 | resource | StatefulSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 2508 | CKV_K8S_92 | resource | CronJob | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2509 | CKV_K8S_92 | resource | DaemonSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2510 | CKV_K8S_92 | resource | Deployment | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2511 | CKV_K8S_92 | resource | DeploymentConfig | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2512 | CKV_K8S_92 | resource | Job | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2513 | CKV_K8S_92 | resource | Pod | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2514 | CKV_K8S_92 | resource | PodTemplate | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2515 | CKV_K8S_92 | resource | ReplicaSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2516 | CKV_K8S_92 | resource | ReplicationController | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2517 | CKV_K8S_92 | resource | StatefulSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 2518 | CKV_K8S_93 | resource | CronJob | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2519 | CKV_K8S_93 | resource | DaemonSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2520 | CKV_K8S_93 | resource | Deployment | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2521 | CKV_K8S_93 | resource | DeploymentConfig | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2522 | CKV_K8S_93 | resource | Job | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2523 | CKV_K8S_93 | resource | Pod | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2524 | CKV_K8S_93 | resource | PodTemplate | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2525 | CKV_K8S_93 | resource | ReplicaSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2526 | CKV_K8S_93 | resource | ReplicationController | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2527 | CKV_K8S_93 | resource | StatefulSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 2528 | CKV_K8S_94 | resource | CronJob | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2529 | CKV_K8S_94 | resource | DaemonSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2530 | CKV_K8S_94 | resource | Deployment | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2531 | CKV_K8S_94 | resource | DeploymentConfig | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2532 | CKV_K8S_94 | resource | Job | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2533 | CKV_K8S_94 | resource | Pod | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2534 | CKV_K8S_94 | resource | PodTemplate | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2535 | CKV_K8S_94 | resource | ReplicaSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2536 | CKV_K8S_94 | resource | ReplicationController | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2537 | CKV_K8S_94 | resource | StatefulSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 2538 | CKV_K8S_95 | resource | CronJob | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2539 | CKV_K8S_95 | resource | DaemonSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2540 | CKV_K8S_95 | resource | Deployment | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2541 | CKV_K8S_95 | resource | DeploymentConfig | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2542 | CKV_K8S_95 | resource | Job | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2543 | CKV_K8S_95 | resource | Pod | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2544 | CKV_K8S_95 | resource | PodTemplate | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2545 | CKV_K8S_95 | resource | ReplicaSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2546 | CKV_K8S_95 | resource | ReplicationController | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2547 | CKV_K8S_95 | resource | StatefulSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 2548 | CKV_K8S_96 | resource | CronJob | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2549 | CKV_K8S_96 | resource | DaemonSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2550 | CKV_K8S_96 | resource | Deployment | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2551 | CKV_K8S_96 | resource | DeploymentConfig | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2552 | CKV_K8S_96 | resource | Job | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2553 | CKV_K8S_96 | resource | Pod | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2554 | CKV_K8S_96 | resource | PodTemplate | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2555 | CKV_K8S_96 | resource | ReplicaSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2556 | CKV_K8S_96 | resource | ReplicationController | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2557 | CKV_K8S_96 | resource | StatefulSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 2558 | CKV_K8S_97 | resource | CronJob | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2559 | CKV_K8S_97 | resource | DaemonSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2560 | CKV_K8S_97 | resource | Deployment | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2561 | CKV_K8S_97 | resource | DeploymentConfig | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2562 | CKV_K8S_97 | resource | Job | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2563 | CKV_K8S_97 | resource | Pod | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2564 | CKV_K8S_97 | resource | PodTemplate | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2565 | CKV_K8S_97 | resource | ReplicaSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2566 | CKV_K8S_97 | resource | ReplicationController | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2567 | CKV_K8S_97 | resource | StatefulSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 2568 | CKV_K8S_99 | resource | CronJob | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2569 | CKV_K8S_99 | resource | DaemonSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2570 | CKV_K8S_99 | resource | Deployment | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2571 | CKV_K8S_99 | resource | DeploymentConfig | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2572 | CKV_K8S_99 | resource | Job | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2573 | CKV_K8S_99 | resource | Pod | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2574 | CKV_K8S_99 | resource | PodTemplate | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2575 | CKV_K8S_99 | resource | ReplicaSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2576 | CKV_K8S_99 | resource | ReplicationController | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2577 | CKV_K8S_99 | resource | StatefulSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 2578 | CKV_K8S_100 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2579 | CKV_K8S_100 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2580 | CKV_K8S_100 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2581 | CKV_K8S_100 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2582 | CKV_K8S_100 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2583 | CKV_K8S_100 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2584 | CKV_K8S_100 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2585 | CKV_K8S_100 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2586 | CKV_K8S_100 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2587 | CKV_K8S_100 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 2588 | CKV_K8S_102 | resource | CronJob | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2589 | CKV_K8S_102 | resource | DaemonSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2590 | CKV_K8S_102 | resource | Deployment | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2591 | CKV_K8S_102 | resource | DeploymentConfig | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2592 | CKV_K8S_102 | resource | Job | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2593 | CKV_K8S_102 | resource | Pod | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2594 | CKV_K8S_102 | resource | PodTemplate | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2595 | CKV_K8S_102 | resource | ReplicaSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2596 | CKV_K8S_102 | resource | ReplicationController | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2597 | CKV_K8S_102 | resource | StatefulSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 2598 | CKV_K8S_104 | resource | CronJob | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2599 | CKV_K8S_104 | resource | DaemonSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2600 | CKV_K8S_104 | resource | Deployment | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2601 | CKV_K8S_104 | resource | DeploymentConfig | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2602 | CKV_K8S_104 | resource | Job | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2603 | CKV_K8S_104 | resource | Pod | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2604 | CKV_K8S_104 | resource | PodTemplate | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2605 | CKV_K8S_104 | resource | ReplicaSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2606 | CKV_K8S_104 | resource | ReplicationController | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2607 | CKV_K8S_104 | resource | StatefulSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 2608 | CKV_K8S_105 | resource | CronJob | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2609 | CKV_K8S_105 | resource | DaemonSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2610 | CKV_K8S_105 | resource | Deployment | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2611 | CKV_K8S_105 | resource | DeploymentConfig | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2612 | CKV_K8S_105 | resource | Job | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2613 | CKV_K8S_105 | resource | Pod | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2614 | CKV_K8S_105 | resource | PodTemplate | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2615 | CKV_K8S_105 | resource | ReplicaSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2616 | CKV_K8S_105 | resource | ReplicationController | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2617 | CKV_K8S_105 | resource | StatefulSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 2618 | CKV_K8S_106 | resource | CronJob | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2619 | CKV_K8S_106 | resource | DaemonSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2620 | CKV_K8S_106 | resource | Deployment | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2621 | CKV_K8S_106 | resource | DeploymentConfig | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2622 | CKV_K8S_106 | resource | Job | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2623 | CKV_K8S_106 | resource | Pod | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2624 | CKV_K8S_106 | resource | PodTemplate | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2625 | CKV_K8S_106 | resource | ReplicaSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2626 | CKV_K8S_106 | resource | ReplicationController | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2627 | CKV_K8S_106 | resource | StatefulSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 2628 | CKV_K8S_107 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2629 | CKV_K8S_107 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2630 | CKV_K8S_107 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2631 | CKV_K8S_107 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2632 | CKV_K8S_107 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2633 | CKV_K8S_107 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2634 | CKV_K8S_107 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2635 | CKV_K8S_107 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2636 | CKV_K8S_107 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2637 | CKV_K8S_107 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 2638 | CKV_K8S_108 | resource | CronJob | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2639 | CKV_K8S_108 | resource | DaemonSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2640 | CKV_K8S_108 | resource | Deployment | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2641 | CKV_K8S_108 | resource | DeploymentConfig | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2642 | CKV_K8S_108 | resource | Job | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2643 | CKV_K8S_108 | resource | Pod | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2644 | CKV_K8S_108 | resource | PodTemplate | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2645 | CKV_K8S_108 | resource | ReplicaSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2646 | CKV_K8S_108 | resource | ReplicationController | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2647 | CKV_K8S_108 | resource | StatefulSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 2648 | CKV_K8S_110 | resource | CronJob | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2649 | CKV_K8S_110 | resource | DaemonSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2650 | CKV_K8S_110 | resource | Deployment | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2651 | CKV_K8S_110 | resource | DeploymentConfig | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2652 | CKV_K8S_110 | resource | Job | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2653 | CKV_K8S_110 | resource | Pod | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2654 | CKV_K8S_110 | resource | PodTemplate | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2655 | CKV_K8S_110 | resource | ReplicaSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2656 | CKV_K8S_110 | resource | ReplicationController | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2657 | CKV_K8S_110 | resource | StatefulSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 2658 | CKV_K8S_111 | resource | CronJob | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2659 | CKV_K8S_111 | resource | DaemonSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2660 | CKV_K8S_111 | resource | Deployment | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2661 | CKV_K8S_111 | resource | DeploymentConfig | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2662 | CKV_K8S_111 | resource | Job | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2663 | CKV_K8S_111 | resource | Pod | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2664 | CKV_K8S_111 | resource | PodTemplate | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2665 | CKV_K8S_111 | resource | ReplicaSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2666 | CKV_K8S_111 | resource | ReplicationController | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2667 | CKV_K8S_111 | resource | StatefulSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 2668 | CKV_K8S_112 | resource | CronJob | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2669 | CKV_K8S_112 | resource | DaemonSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2670 | CKV_K8S_112 | resource | Deployment | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2671 | CKV_K8S_112 | resource | DeploymentConfig | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2672 | CKV_K8S_112 | resource | Job | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2673 | CKV_K8S_112 | resource | Pod | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2674 | CKV_K8S_112 | resource | PodTemplate | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2675 | CKV_K8S_112 | resource | ReplicaSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2676 | CKV_K8S_112 | resource | ReplicationController | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2677 | CKV_K8S_112 | resource | StatefulSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 2678 | CKV_K8S_113 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2679 | CKV_K8S_113 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2680 | CKV_K8S_113 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2681 | CKV_K8S_113 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2682 | CKV_K8S_113 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2683 | CKV_K8S_113 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2684 | CKV_K8S_113 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2685 | CKV_K8S_113 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2686 | CKV_K8S_113 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2687 | CKV_K8S_113 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 2688 | CKV_K8S_114 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2689 | CKV_K8S_114 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2690 | CKV_K8S_114 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2691 | CKV_K8S_114 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2692 | CKV_K8S_114 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2693 | CKV_K8S_114 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2694 | CKV_K8S_114 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2695 | CKV_K8S_114 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2696 | CKV_K8S_114 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2697 | CKV_K8S_114 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 2698 | CKV_K8S_115 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2699 | CKV_K8S_115 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2700 | CKV_K8S_115 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2701 | CKV_K8S_115 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2702 | CKV_K8S_115 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2703 | CKV_K8S_115 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2704 | CKV_K8S_115 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2705 | CKV_K8S_115 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2706 | CKV_K8S_115 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2707 | CKV_K8S_115 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 2708 | CKV_K8S_116 | resource | CronJob | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2709 | CKV_K8S_116 | resource | DaemonSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2710 | CKV_K8S_116 | resource | Deployment | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2711 | CKV_K8S_116 | resource | DeploymentConfig | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2712 | CKV_K8S_116 | resource | Job | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2713 | CKV_K8S_116 | resource | Pod | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2714 | CKV_K8S_116 | resource | PodTemplate | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2715 | CKV_K8S_116 | resource | ReplicaSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2716 | CKV_K8S_116 | resource | ReplicationController | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2717 | CKV_K8S_116 | resource | StatefulSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 2718 | CKV_K8S_117 | resource | CronJob | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2719 | CKV_K8S_117 | resource | DaemonSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2720 | CKV_K8S_117 | resource | Deployment | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2721 | CKV_K8S_117 | resource | DeploymentConfig | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2722 | CKV_K8S_117 | resource | Job | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2723 | CKV_K8S_117 | resource | Pod | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2724 | CKV_K8S_117 | resource | PodTemplate | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2725 | CKV_K8S_117 | resource | ReplicaSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2726 | CKV_K8S_117 | resource | ReplicationController | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2727 | CKV_K8S_117 | resource | StatefulSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 2728 | CKV_K8S_118 | resource | CronJob | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2729 | CKV_K8S_118 | resource | DaemonSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2730 | CKV_K8S_118 | resource | Deployment | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2731 | CKV_K8S_118 | resource | DeploymentConfig | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2732 | CKV_K8S_118 | resource | Job | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2733 | CKV_K8S_118 | resource | Pod | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2734 | CKV_K8S_118 | resource | PodTemplate | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2735 | CKV_K8S_118 | resource | ReplicaSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2736 | CKV_K8S_118 | resource | ReplicationController | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2737 | CKV_K8S_118 | resource | StatefulSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 2738 | CKV_K8S_119 | resource | CronJob | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2739 | CKV_K8S_119 | resource | DaemonSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2740 | CKV_K8S_119 | resource | Deployment | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2741 | CKV_K8S_119 | resource | DeploymentConfig | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2742 | CKV_K8S_119 | resource | Job | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2743 | CKV_K8S_119 | resource | Pod | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2744 | CKV_K8S_119 | resource | PodTemplate | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2745 | CKV_K8S_119 | resource | ReplicaSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2746 | CKV_K8S_119 | resource | ReplicationController | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2747 | CKV_K8S_119 | resource | StatefulSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 2748 | CKV_K8S_121 | resource | Pod | Ensure that the --peer-client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PeerClientCertAuthTrue.py | +| 2749 | CKV_K8S_138 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2750 | CKV_K8S_138 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2751 | CKV_K8S_138 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2752 | CKV_K8S_138 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2753 | CKV_K8S_138 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2754 | CKV_K8S_138 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2755 | CKV_K8S_138 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2756 | CKV_K8S_138 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2757 | CKV_K8S_138 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2758 | CKV_K8S_138 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 2759 | CKV_K8S_139 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2760 | CKV_K8S_139 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2761 | CKV_K8S_139 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2762 | CKV_K8S_139 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2763 | CKV_K8S_139 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2764 | CKV_K8S_139 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2765 | CKV_K8S_139 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2766 | CKV_K8S_139 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2767 | CKV_K8S_139 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2768 | CKV_K8S_139 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 2769 | CKV_K8S_140 | resource | CronJob | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2770 | CKV_K8S_140 | resource | DaemonSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2771 | CKV_K8S_140 | resource | Deployment | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2772 | CKV_K8S_140 | resource | DeploymentConfig | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2773 | CKV_K8S_140 | resource | Job | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2774 | CKV_K8S_140 | resource | Pod | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2775 | CKV_K8S_140 | resource | PodTemplate | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2776 | CKV_K8S_140 | resource | ReplicaSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2777 | CKV_K8S_140 | resource | ReplicationController | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2778 | CKV_K8S_140 | resource | StatefulSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 2779 | CKV_K8S_141 | resource | CronJob | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2780 | CKV_K8S_141 | resource | DaemonSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2781 | CKV_K8S_141 | resource | Deployment | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2782 | CKV_K8S_141 | resource | DeploymentConfig | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2783 | CKV_K8S_141 | resource | Job | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2784 | CKV_K8S_141 | resource | Pod | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2785 | CKV_K8S_141 | resource | PodTemplate | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2786 | CKV_K8S_141 | resource | ReplicaSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2787 | CKV_K8S_141 | resource | ReplicationController | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2788 | CKV_K8S_141 | resource | StatefulSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 2789 | CKV_K8S_143 | resource | CronJob | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2790 | CKV_K8S_143 | resource | DaemonSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2791 | CKV_K8S_143 | resource | Deployment | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2792 | CKV_K8S_143 | resource | DeploymentConfig | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2793 | CKV_K8S_143 | resource | Job | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2794 | CKV_K8S_143 | resource | Pod | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2795 | CKV_K8S_143 | resource | PodTemplate | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2796 | CKV_K8S_143 | resource | ReplicaSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2797 | CKV_K8S_143 | resource | ReplicationController | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2798 | CKV_K8S_143 | resource | StatefulSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 2799 | CKV_K8S_144 | resource | CronJob | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2800 | CKV_K8S_144 | resource | DaemonSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2801 | CKV_K8S_144 | resource | Deployment | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2802 | CKV_K8S_144 | resource | DeploymentConfig | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2803 | CKV_K8S_144 | resource | Job | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2804 | CKV_K8S_144 | resource | Pod | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2805 | CKV_K8S_144 | resource | PodTemplate | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2806 | CKV_K8S_144 | resource | ReplicaSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2807 | CKV_K8S_144 | resource | ReplicationController | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2808 | CKV_K8S_144 | resource | StatefulSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 2809 | CKV_K8S_145 | resource | CronJob | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2810 | CKV_K8S_145 | resource | DaemonSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2811 | CKV_K8S_145 | resource | Deployment | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2812 | CKV_K8S_145 | resource | DeploymentConfig | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2813 | CKV_K8S_145 | resource | Job | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2814 | CKV_K8S_145 | resource | Pod | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2815 | CKV_K8S_145 | resource | PodTemplate | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2816 | CKV_K8S_145 | resource | ReplicaSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2817 | CKV_K8S_145 | resource | ReplicationController | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2818 | CKV_K8S_145 | resource | StatefulSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 2819 | CKV_K8S_146 | resource | CronJob | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2820 | CKV_K8S_146 | resource | DaemonSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2821 | CKV_K8S_146 | resource | Deployment | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2822 | CKV_K8S_146 | resource | DeploymentConfig | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2823 | CKV_K8S_146 | resource | Job | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2824 | CKV_K8S_146 | resource | Pod | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2825 | CKV_K8S_146 | resource | PodTemplate | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2826 | CKV_K8S_146 | resource | ReplicaSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2827 | CKV_K8S_146 | resource | ReplicationController | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2828 | CKV_K8S_146 | resource | StatefulSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 2829 | CKV_K8S_147 | resource | CronJob | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2830 | CKV_K8S_147 | resource | DaemonSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2831 | CKV_K8S_147 | resource | Deployment | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2832 | CKV_K8S_147 | resource | DeploymentConfig | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2833 | CKV_K8S_147 | resource | Job | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2834 | CKV_K8S_147 | resource | Pod | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2835 | CKV_K8S_147 | resource | PodTemplate | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2836 | CKV_K8S_147 | resource | ReplicaSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2837 | CKV_K8S_147 | resource | ReplicationController | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2838 | CKV_K8S_147 | resource | StatefulSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 2839 | CKV_K8S_148 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2840 | CKV_K8S_148 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2841 | CKV_K8S_148 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2842 | CKV_K8S_148 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2843 | CKV_K8S_148 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2844 | CKV_K8S_148 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2845 | CKV_K8S_148 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2846 | CKV_K8S_148 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2847 | CKV_K8S_148 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2848 | CKV_K8S_148 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 2849 | CKV_K8S_149 | resource | CronJob | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2850 | CKV_K8S_149 | resource | DaemonSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2851 | CKV_K8S_149 | resource | Deployment | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2852 | CKV_K8S_149 | resource | DeploymentConfig | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2853 | CKV_K8S_149 | resource | Job | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2854 | CKV_K8S_149 | resource | Pod | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2855 | CKV_K8S_149 | resource | PodTemplate | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2856 | CKV_K8S_149 | resource | ReplicaSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2857 | CKV_K8S_149 | resource | ReplicationController | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2858 | CKV_K8S_149 | resource | StatefulSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 2859 | CKV_K8S_151 | resource | CronJob | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2860 | CKV_K8S_151 | resource | DaemonSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2861 | CKV_K8S_151 | resource | Deployment | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2862 | CKV_K8S_151 | resource | DeploymentConfig | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2863 | CKV_K8S_151 | resource | Job | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2864 | CKV_K8S_151 | resource | Pod | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2865 | CKV_K8S_151 | resource | PodTemplate | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2866 | CKV_K8S_151 | resource | ReplicaSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2867 | CKV_K8S_151 | resource | ReplicationController | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2868 | CKV_K8S_151 | resource | StatefulSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 2869 | CKV_K8S_152 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Lua.py | +| 2870 | CKV_K8S_153 | resource | Ingress | Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742AllSnippets.py | +| 2871 | CKV_K8S_154 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Alias.py | +| 2872 | CKV_K8S_155 | resource | ClusterRole | Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacControlWebhooks.py | +| 2873 | CKV_K8S_156 | resource | ClusterRole | Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacApproveCertificateSigningRequests.py | +| 2874 | CKV_K8S_157 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py | +| 2875 | CKV_K8S_157 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py | +| 2876 | CKV_K8S_158 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py | +| 2877 | CKV_K8S_158 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py | +| 2878 | CKV_LIN_1 | provider | linode | Ensure no hard coded Linode tokens exist in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/linode/credentials.py | +| 2879 | CKV_LIN_2 | resource | linode_instance | Ensure SSH key set in authorized_keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/authorized_keys.py | +| 2880 | CKV_LIN_3 | resource | linode_user | Ensure email is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/user_email_set.py | +| 2881 | CKV_LIN_4 | resource | linode_user | Ensure username is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/user_username_set.py | +| 2882 | CKV_LIN_5 | resource | linode_firewall | Ensure Inbound Firewall Policy is not set to ACCEPT | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/firewall_inbound_policy.py | +| 2883 | CKV_LIN_6 | resource | linode_firewall | Ensure Outbound Firewall Policy is not set to ACCEPT | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/firewall_outbound_policy.py | +| 2884 | CKV_NCP_1 | resource | ncloud_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBTargetGroupDefinesHealthCheck.py | +| 2885 | CKV_NCP_2 | resource | ncloud_access_control_group | Ensure every access control groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py | +| 2886 | CKV_NCP_2 | resource | ncloud_access_control_group_rule | Ensure every access control groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py | +| 2887 | CKV_NCP_3 | resource | ncloud_access_control_group_rule | Ensure no security group rules allow outbound traffic to 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupOutboundRule.py | +| 2888 | CKV_NCP_4 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort22.py | +| 2889 | CKV_NCP_5 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort3389.py | +| 2890 | CKV_NCP_6 | resource | ncloud_server | Ensure Server instance is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/ServerEncryptionVPC.py | +| 2891 | CKV_NCP_7 | resource | ncloud_launch_configuration | Ensure Basic Block storage is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LaunchConfigurationEncryptionVPC.py | +| 2892 | CKV_NCP_8 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLInbound20.py | +| 2893 | CKV_NCP_9 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLInbound21.py | +| 2894 | CKV_NCP_10 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLInbound22.py | +| 2895 | CKV_NCP_11 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLInbound3389.py | +| 2896 | CKV_NCP_12 | resource | ncloud_network_acl_rule | An inbound Network ACL rule should not allow ALL ports. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLPortCheck.py | +| 2897 | CKV_NCP_13 | resource | ncloud_lb_listener | Ensure LB Listener uses only secure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBListenerUsesSecureProtocols.py | +| 2898 | CKV_NCP_14 | resource | ncloud_nas_volume | Ensure NAS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NASEncryptionEnabled.py | +| 2899 | CKV_NCP_15 | resource | ncloud_lb_target_group | Ensure Load Balancer Target Group is not using HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBTargetGroupUsingHTTPS.py | +| 2900 | CKV_NCP_16 | resource | ncloud_lb | Ensure Load Balancer isn't exposed to the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBNetworkPrivate.py | +| 2901 | CKV_NCP_19 | resource | ncloud_nks_cluster | Ensure Naver Kubernetes Service public endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NKSPublicAccess.py | +| 2902 | CKV_NCP_22 | resource | ncloud_nks_cluster | Ensure NKS control plane logging enabled for all log types | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NKSControlPlaneLogging.py | +| 2903 | CKV_NCP_23 | resource | ncloud_public_ip | Ensure Server instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/ServerPublicIP.py | +| 2904 | CKV_NCP_24 | resource | ncloud_lb_listener | Ensure Load Balancer Listener Using HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBListenerUsingHTTPS.py | +| 2905 | CKV_NCP_25 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort80.py | +| 2906 | CKV_OCI_1 | provider | oci | Ensure no hard coded OCI private key in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/oci/credentials.py | +| 2907 | CKV_OCI_2 | resource | oci_core_volume | Ensure OCI Block Storage Block Volume has backup enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/StorageBlockBackupEnabled.py | +| 2908 | CKV_OCI_3 | resource | oci_core_volume | OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/StorageBlockEncryption.py | +| 2909 | CKV_OCI_4 | resource | oci_core_instance | Ensure OCI Compute Instance boot volume has in-transit data encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/InstanceBootVolumeIntransitEncryption.py | +| 2910 | CKV_OCI_5 | resource | oci_core_instance | Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/InstanceMetadataServiceEnabled.py | +| 2911 | CKV_OCI_6 | resource | oci_core_instance | Ensure OCI Compute Instance has monitoring enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/InstanceMonitoringEnabled.py | +| 2912 | CKV_OCI_7 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage bucket can emit object events | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/ObjectStorageEmitEvents.py | +| 2913 | CKV_OCI_8 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/ObjectStorageVersioning.py | +| 2914 | CKV_OCI_9 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/ObjectStorageEncryption.py | +| 2915 | CKV_OCI_10 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is not Public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/ObjectStoragePublic.py | +| 2916 | CKV_OCI_11 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain lower case | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordPolicyLowerCase.py | +| 2917 | CKV_OCI_12 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Numeric characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordPolicyNumeric.py | +| 2918 | CKV_OCI_13 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Special characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordPolicySpecialCharacters.py | +| 2919 | CKV_OCI_14 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Uppercase characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordPolicyUpperCase.py | +| 2920 | CKV_OCI_15 | resource | oci_file_storage_file_system | Ensure OCI File System is Encrypted with a customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/FileSystemEncryption.py | +| 2921 | CKV_OCI_16 | resource | oci_core_security_list | Ensure VCN has an inbound security list | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityListIngress.py | +| 2922 | CKV_OCI_17 | resource | oci_core_security_list | Ensure VCN inbound security lists are stateless | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityListIngressStateless.py | +| 2923 | CKV_OCI_18 | resource | oci_identity_authentication_policy | OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordLength.py | +| 2924 | CKV_OCI_19 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 22. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress22.py | +| 2925 | CKV_OCI_20 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 3389. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress3389.py | +| 2926 | CKV_OCI_21 | resource | oci_core_network_security_group_security_rule | Ensure security group has stateless ingress security rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityGroupsIngressStatelessSecurityRules.py | +| 2927 | CKV_OCI_22 | resource | oci_core_network_security_group_security_rule | Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/AbsSecurityGroupUnrestrictedIngress.py | +| 2928 | CKV2_OCI_1 | resource | oci_identity_group | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 2929 | CKV2_OCI_1 | resource | oci_identity_user | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 2930 | CKV2_OCI_1 | resource | oci_identity_user_group_membership | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 2931 | CKV_OPENAPI_1 | resource | securityDefinitions | Ensure that securityDefinitions is defined and not empty - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v2/SecurityDefinitions.py | +| 2932 | CKV_OPENAPI_2 | resource | security | Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v2/Oauth2SecurityRequirement.py | +| 2933 | CKV_OPENAPI_3 | resource | components | Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v3/CleartextOverUnencryptedChannel.py | +| 2934 | CKV_OPENAPI_4 | resource | security | Ensure that the global security field has rules defined | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/generic/GlobalSecurityFieldIsEmpty.py | +| 2935 | CKV_OPENAPI_5 | resource | security | Ensure that security operations is not empty. | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/generic/SecurityOperations.py | +| 2936 | CKV_OPENAPI_6 | resource | security | Ensure that security requirement defined in securityDefinitions - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v2/SecurityRequirement.py | +| 2937 | CKV_OPENAPI_7 | resource | security | Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v2/PathSchemeDefineHTTP.py | +| 2938 | CKV_OPENSTACK_1 | provider | openstack | Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/openstack/credentials.py | +| 2939 | CKV_OPENSTACK_2 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py | +| 2940 | CKV_OPENSTACK_2 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py | +| 2941 | CKV_OPENSTACK_3 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py | +| 2942 | CKV_OPENSTACK_3 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py | +| 2943 | CKV_OPENSTACK_4 | resource | openstack_compute_instance_v2 | Ensure that instance does not use basic credentials | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/ComputeInstanceAdminPassword.py | +| 2944 | CKV_OPENSTACK_5 | resource | openstack_fw_rule_v1 | Ensure firewall rule set a destination IP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/FirewallRuleSetDestinationIP.py | +| 2945 | CKV_PAN_1 | provider | panos | Ensure no hard coded PAN-OS credentials exist in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/panos/credentials.py | +| 2946 | CKV_PAN_2 | resource | panos_management_profile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoHTTP.py | +| 2947 | CKV_PAN_3 | resource | panos_management_profile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoTelnet.py | +| 2948 | CKV_PAN_4 | resource | panos_security_policy | Ensure DSRI is not enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoDSRI.py | +| 2949 | CKV_PAN_4 | resource | panos_security_rule_group | Ensure DSRI is not enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoDSRI.py | +| 2950 | CKV_PAN_5 | resource | panos_security_policy | Ensure security rules do not have 'applications' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py | +| 2951 | CKV_PAN_5 | resource | panos_security_rule_group | Ensure security rules do not have 'applications' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py | +| 2952 | CKV_PAN_6 | resource | panos_security_policy | Ensure security rules do not have 'services' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py | +| 2953 | CKV_PAN_6 | resource | panos_security_rule_group | Ensure security rules do not have 'services' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py | +| 2954 | CKV_PAN_7 | resource | panos_security_policy | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py | +| 2955 | CKV_PAN_7 | resource | panos_security_rule_group | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py | +| 2956 | CKV_PAN_8 | resource | panos_security_policy | Ensure description is populated within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyDescription.py | +| 2957 | CKV_PAN_8 | resource | panos_security_rule_group | Ensure description is populated within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyDescription.py | +| 2958 | CKV_PAN_9 | resource | panos_security_policy | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyLogForwarding.py | +| 2959 | CKV_PAN_9 | resource | panos_security_rule_group | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyLogForwarding.py | +| 2960 | CKV_PAN_10 | resource | panos_security_policy | Ensure logging at session end is enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py | +| 2961 | CKV_PAN_10 | resource | panos_security_rule_group | Ensure logging at session end is enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py | +| 2962 | CKV_PAN_11 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py | +| 2963 | CKV_PAN_11 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py | +| 2964 | CKV_PAN_12 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py | +| 2965 | CKV_PAN_12 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py | +| 2966 | CKV_PAN_13 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py | +| 2967 | CKV_PAN_13 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py | +| 2968 | CKV_PAN_14 | resource | panos_panorama_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py | +| 2969 | CKV_PAN_14 | resource | panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py | +| 2970 | CKV_PAN_14 | resource | panos_zone_entry | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py | +| 2971 | CKV_PAN_15 | resource | panos_panorama_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py | +| 2972 | CKV_PAN_15 | resource | panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py | +| 2973 | CKV_SECRET_1 | Artifactory Credentials | secrets | Artifactory Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2974 | CKV_SECRET_2 | AWS Access Key | secrets | AWS Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2975 | CKV_SECRET_3 | Azure Storage Account access key | secrets | Azure Storage Account access key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2976 | CKV_SECRET_4 | Basic Auth Credentials | secrets | Basic Auth Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2977 | CKV_SECRET_5 | Cloudant Credentials | secrets | Cloudant Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2978 | CKV_SECRET_6 | Base64 High Entropy String | secrets | Base64 High Entropy String | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2979 | CKV_SECRET_7 | IBM Cloud IAM Key | secrets | IBM Cloud IAM Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2980 | CKV_SECRET_8 | IBM COS HMAC Credentials | secrets | IBM COS HMAC Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2981 | CKV_SECRET_9 | JSON Web Token | secrets | JSON Web Token | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2982 | CKV_SECRET_10 | Secret Keyword | secrets | Secret Keyword | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2983 | CKV_SECRET_11 | Mailchimp Access Key | secrets | Mailchimp Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2984 | CKV_SECRET_12 | NPM tokens | secrets | NPM tokens | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2985 | CKV_SECRET_13 | Private Key | secrets | Private Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2986 | CKV_SECRET_14 | Slack Token | secrets | Slack Token | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2987 | CKV_SECRET_15 | SoftLayer Credentials | secrets | SoftLayer Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2988 | CKV_SECRET_16 | Square OAuth Secret | secrets | Square OAuth Secret | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2989 | CKV_SECRET_17 | Stripe Access Key | secrets | Stripe Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2990 | CKV_SECRET_18 | Twilio API Key | secrets | Twilio API Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2991 | CKV_SECRET_19 | Hex High Entropy String | secrets | Hex High Entropy String | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2992 | CKV_YC_1 | resource | yandex_mdb_clickhouse_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 2993 | CKV_YC_1 | resource | yandex_mdb_elasticsearch_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 2994 | CKV_YC_1 | resource | yandex_mdb_greenplum_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 2995 | CKV_YC_1 | resource | yandex_mdb_kafka_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 2996 | CKV_YC_1 | resource | yandex_mdb_mongodb_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 2997 | CKV_YC_1 | resource | yandex_mdb_mysql_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 2998 | CKV_YC_1 | resource | yandex_mdb_postgresql_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 2999 | CKV_YC_1 | resource | yandex_mdb_redis_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 3000 | CKV_YC_1 | resource | yandex_mdb_sqlserver_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 3001 | CKV_YC_2 | resource | yandex_compute_instance | Ensure compute instance does not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeVMPublicIP.py | +| 3002 | CKV_YC_3 | resource | yandex_storage_bucket | Ensure storage bucket is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketEncryption.py | +| 3003 | CKV_YC_4 | resource | yandex_compute_instance | Ensure compute instance does not have serial console enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeVMSerialConsole.py | +| 3004 | CKV_YC_5 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster does not have public IP address. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SPublicIP.py | +| 3005 | CKV_YC_6 | resource | yandex_kubernetes_node_group | Ensure Kubernetes cluster node group does not have public IP addresses. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupPublicIP.py | +| 3006 | CKV_YC_7 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster auto-upgrade is enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SAutoUpgrade.py | +| 3007 | CKV_YC_8 | resource | yandex_kubernetes_node_group | Ensure Kubernetes node group auto-upgrade is enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupAutoUpgrade.py | +| 3008 | CKV_YC_9 | resource | yandex_kms_symmetric_key | Ensure KMS symmetric key is rotated. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/KMSSymmetricKeyRotation.py | +| 3009 | CKV_YC_10 | resource | yandex_kubernetes_cluster | Ensure etcd database is encrypted with KMS key. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SEtcdKMSEncryption.py | +| 3010 | CKV_YC_11 | resource | yandex_compute_instance | Ensure security group is assigned to network interface. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeVMSecurityGroup.py | +| 3011 | CKV_YC_12 | resource | yandex_mdb_clickhouse_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 3012 | CKV_YC_12 | resource | yandex_mdb_elasticsearch_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 3013 | CKV_YC_12 | resource | yandex_mdb_greenplum_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 3014 | CKV_YC_12 | resource | yandex_mdb_kafka_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 3015 | CKV_YC_12 | resource | yandex_mdb_mongodb_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 3016 | CKV_YC_12 | resource | yandex_mdb_mysql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 3017 | CKV_YC_12 | resource | yandex_mdb_postgresql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 3018 | CKV_YC_12 | resource | yandex_mdb_sqlserver_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 3019 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure cloud member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py | +| 3020 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_member | Ensure cloud member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py | +| 3021 | CKV_YC_14 | resource | yandex_kubernetes_cluster | Ensure security group is assigned to Kubernetes cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SSecurityGroup.py | +| 3022 | CKV_YC_15 | resource | yandex_kubernetes_node_group | Ensure security group is assigned to Kubernetes node group. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupSecurityGroup.py | +| 3023 | CKV_YC_16 | resource | yandex_kubernetes_cluster | Ensure network policy is assigned to Kubernetes cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SNetworkPolicy.py | +| 3024 | CKV_YC_17 | resource | yandex_storage_bucket | Ensure storage bucket does not have public access permissions. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketPublicAccess.py | +| 3025 | CKV_YC_18 | resource | yandex_compute_instance_group | Ensure compute instance group does not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupPublicIP.py | +| 3026 | CKV_YC_19 | resource | yandex_vpc_security_group | Ensure security group does not contain allow-all rules. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupAllowAll.py | +| 3027 | CKV_YC_20 | resource | yandex_vpc_security_group_rule | Ensure security group rule is not allow-all. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupRuleAllowAll.py | +| 3028 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_binding | Ensure organization member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py | +| 3029 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_member | Ensure organization member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py | +| 3030 | CKV_YC_22 | resource | yandex_compute_instance_group | Ensure compute instance group has security group assigned. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupSecurityGroup.py | +| 3031 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_binding | Ensure folder member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py | +| 3032 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_member | Ensure folder member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py | +| 3033 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 3034 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 3035 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 3036 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 3037 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 3038 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | --- diff --git a/docs/5.Policy Index/argo_workflows.md b/docs/5.Policy Index/argo_workflows.md index 7145548c25d..dad3ff1f4cf 100644 --- a/docs/5.Policy Index/argo_workflows.md +++ b/docs/5.Policy Index/argo_workflows.md @@ -6,10 +6,10 @@ nav_order: 1 # argo_workflows resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|------------|----------------|--------|---------------------------------------------------------------|----------------|-------------------------------------------------------------| -| 0 | CKV_ARGO_1 | argo_workflows | spec | Ensure Workflow pods are not using the default ServiceAccount | Argo Workflows | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_ARGO_2 | argo_workflows | spec | Ensure Workflow pods are running as non-root user | Argo Workflows | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|------------|----------------|--------|---------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_ARGO_1 | argo_workflows | spec | Ensure Workflow pods are not using the default ServiceAccount | Argo Workflows | https://github.com/bridgecrewio/checkov/tree/master/checkov/argo_workflows/checks/template/DefaultServiceAccount.py | +| 1 | CKV_ARGO_2 | argo_workflows | spec | Ensure Workflow pods are running as non-root user | Argo Workflows | https://github.com/bridgecrewio/checkov/tree/master/checkov/argo_workflows/checks/template/RunAsNonRoot.py | --- diff --git a/docs/5.Policy Index/arm.md b/docs/5.Policy Index/arm.md index ce7dc47a629..3bc2a10a63d 100644 --- a/docs/5.Policy Index/arm.md +++ b/docs/5.Policy Index/arm.md @@ -6,65 +6,65 @@ nav_order: 1 # arm resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|---------------|-----------|------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|----------|-------------------------------------------------------------| -| 0 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 17 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 18 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 19 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 20 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 21 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 22 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 23 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 24 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 25 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 26 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 27 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 28 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 29 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 30 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 31 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 32 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 33 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 34 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 35 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 36 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 37 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 38 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 39 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 40 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 41 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 42 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 43 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 44 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 45 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 46 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 47 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 48 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 49 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 50 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 51 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 52 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 53 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 54 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 55 | CKV_AZURE_131 | parameter | secureString | SecureString parameter should not have hardcoded default values | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 56 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|---------------|-----------|------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|----------|--------------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureInstancePassword.py | +| 1 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureManagedDiscEncryption.py | +| 2 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountsTransportEncryption.py | +| 3 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSLoggingEnabled.py | +| 4 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSRbacEnabled.py | +| 5 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py | +| 6 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSNetworkPolicy.py | +| 7 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSDashboardDisabled.py | +| 8 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py | +| 9 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py | +| 10 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py | +| 11 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py | +| 12 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerNoPublicAccess.py | +| 13 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 14 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 15 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 16 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 17 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceAuthentication.py | +| 18 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceAuthentication.py | +| 19 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceHTTPSOnly.py | +| 20 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceMinTLSVersion.py | +| 21 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceIdentity.py | +| 22 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceClientCertificate.py | +| 23 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceHttps20Enabled.py | +| 24 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterStandardPricing.py | +| 25 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactPhone.py | +| 26 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py | +| 27 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py | +| 28 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerAuditingEnabled.py | +| 29 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerAuditingEnabled.py | +| 30 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerAuditingRetention90Days.py | +| 31 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerThreatDetectionTypes.py | +| 32 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py | +| 33 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py | +| 34 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py | +| 35 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py | +| 36 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py | +| 37 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py | +| 38 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py | +| 39 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py | +| 40 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py | +| 41 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py | +| 42 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py | +| 43 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 44 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 45 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 46 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountDefaultNetworkAccessDeny.py | +| 47 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountAzureServicesAccessEnabled.py | +| 48 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py | +| 49 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MonitorLogProfileCategories.py | +| 50 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py | +| 51 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecretExpirationDate.py | +| 52 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py | +| 53 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py | +| 54 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureScaleSetPassword.py | +| 55 | CKV_AZURE_131 | parameter | secureString | SecureString parameter should not have hardcoded default values | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/parameter/SecureStringParameterNoHardcodedValue.py | +| 56 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | arm | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py | --- diff --git a/docs/5.Policy Index/azure_pipelines.md b/docs/5.Policy Index/azure_pipelines.md index e4c15989001..523cce81509 100644 --- a/docs/5.Policy Index/azure_pipelines.md +++ b/docs/5.Policy Index/azure_pipelines.md @@ -6,14 +6,14 @@ nav_order: 1 # azure_pipelines resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|----------------------|-----------------|-------------------------|----------------------------------------------------|-----------------|-------------------------------------------------------------| -| 0 | CKV_AZUREPIPELINES_1 | azure_pipelines | jobs | Ensure container job uses a non latest version tag | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_AZUREPIPELINES_1 | azure_pipelines | stages[].jobs[] | Ensure container job uses a non latest version tag | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_AZUREPIPELINES_2 | azure_pipelines | jobs | Ensure container job uses a version digest | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_AZUREPIPELINES_2 | azure_pipelines | stages[].jobs[] | Ensure container job uses a version digest | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_AZUREPIPELINES_3 | azure_pipelines | jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_AZUREPIPELINES_3 | azure_pipelines | stages[].jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|----------------------|-----------------|-------------------------|----------------------------------------------------|-----------------|--------------------------------------------------------------------------------------------------------------| +| 0 | CKV_AZUREPIPELINES_1 | azure_pipelines | jobs | Ensure container job uses a non latest version tag | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/ContainerLatestTag.py | +| 1 | CKV_AZUREPIPELINES_1 | azure_pipelines | stages[].jobs[] | Ensure container job uses a non latest version tag | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/ContainerLatestTag.py | +| 2 | CKV_AZUREPIPELINES_2 | azure_pipelines | jobs | Ensure container job uses a version digest | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/ContainerDigest.py | +| 3 | CKV_AZUREPIPELINES_2 | azure_pipelines | stages[].jobs[] | Ensure container job uses a version digest | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/ContainerDigest.py | +| 4 | CKV_AZUREPIPELINES_3 | azure_pipelines | jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/SetSecretVariable.py | +| 5 | CKV_AZUREPIPELINES_3 | azure_pipelines | stages[].jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/azure_pipelines/checks/job/SetSecretVariable.py | --- diff --git a/docs/5.Policy Index/bicep.md b/docs/5.Policy Index/bicep.md index 3926824d369..91729ab18ee 100644 --- a/docs/5.Policy Index/bicep.md +++ b/docs/5.Policy Index/bicep.md @@ -6,67 +6,67 @@ nav_order: 1 # bicep resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|---------------|-----------|------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|----------|-------------------------------------------------------------| -| 0 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 17 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 18 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 19 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 20 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 21 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 22 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 23 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 24 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 25 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 26 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 27 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 28 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 29 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 30 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 31 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 32 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 33 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 34 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 35 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 36 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 37 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 38 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 39 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 40 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 41 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 42 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 43 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 44 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 45 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 46 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 47 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 48 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 49 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 50 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 51 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 52 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 53 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 54 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 55 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 56 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 57 | CKV_AZURE_131 | parameter | string | SecureString parameter should not have hardcoded default values | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 58 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|---------------|-----------|------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|----------|-------------------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureInstancePassword.py | +| 1 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureManagedDiscEncryption.py | +| 2 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py | +| 3 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSLoggingEnabled.py | +| 4 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSRbacEnabled.py | +| 5 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py | +| 6 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSNetworkPolicy.py | +| 7 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSDashboardDisabled.py | +| 8 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py | +| 9 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py | +| 10 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py | +| 11 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py | +| 12 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerNoPublicAccess.py | +| 13 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 14 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 15 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 16 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py | +| 17 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceAuthentication.py | +| 18 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceAuthentication.py | +| 19 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceHTTPSOnly.py | +| 20 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceMinTLSVersion.py | +| 21 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceIdentity.py | +| 22 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceClientCertificate.py | +| 23 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AppServiceHttps20Enabled.py | +| 24 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterStandardPricing.py | +| 25 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactPhone.py | +| 26 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py | +| 27 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py | +| 28 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 29 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 30 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 31 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 32 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerAuditingRetention90Days.py | +| 33 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerThreatDetectionTypes.py | +| 34 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py | +| 35 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py | +| 36 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py | +| 37 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py | +| 38 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py | +| 39 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py | +| 40 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py | +| 41 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py | +| 42 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py | +| 43 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py | +| 44 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py | +| 45 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 46 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 47 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py | +| 48 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/bicep/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py | +| 49 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py | +| 50 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py | +| 51 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MonitorLogProfileCategories.py | +| 52 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py | +| 53 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/SecretExpirationDate.py | +| 54 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py | +| 55 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py | +| 56 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AzureScaleSetPassword.py | +| 57 | CKV_AZURE_131 | parameter | string | SecureString parameter should not have hardcoded default values | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/bicep/checks/param/azure/SecureStringParameterNoHardcodedValue.py | +| 58 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Bicep | https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py | --- diff --git a/docs/5.Policy Index/bitbucket_configuration.md b/docs/5.Policy Index/bitbucket_configuration.md index 406625fb26f..baeb9d99fc7 100644 --- a/docs/5.Policy Index/bitbucket_configuration.md +++ b/docs/5.Policy Index/bitbucket_configuration.md @@ -6,9 +6,9 @@ nav_order: 1 # bitbucket_configuration resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|-----------------|-------------------------|--------|----------------------------------------------------|-------------------------|-------------------------------------------------------------| -| 0 | CKV_BITBUCKET_1 | bitbucket_configuration | * | Merge requests should require at least 2 approvals | bitbucket_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|-----------------|-------------------------|--------|----------------------------------------------------|-------------------------|----------------------------------------------------------------------------------------------------------| +| 0 | CKV_BITBUCKET_1 | bitbucket_configuration | * | Merge requests should require at least 2 approvals | bitbucket_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/bitbucket/checks/merge_requests_approvals.py | --- diff --git a/docs/5.Policy Index/bitbucket_pipelines.md b/docs/5.Policy Index/bitbucket_pipelines.md index 3bd04f77ea4..f6213f0788a 100644 --- a/docs/5.Policy Index/bitbucket_pipelines.md +++ b/docs/5.Policy Index/bitbucket_pipelines.md @@ -6,11 +6,11 @@ nav_order: 1 # bitbucket_pipelines resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|--------------------------|---------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------|---------------------|-------------------------------------------------------------| -| 0 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | [{image:image,__startline__:__startline__,__endline__:__endline__}] | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.*.[*][][][].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.default[].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|--------------------------|---------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------|---------------------|--------------------------------------------------------------------------------------------------------| +| 0 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | [{image:image,__startline__:__startline__,__endline__:__endline__}] | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/bitbucket_pipelines/checks/latest_image.py | +| 1 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.*.[*][][][].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/bitbucket_pipelines/checks/latest_image.py | +| 2 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.default[].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/bitbucket_pipelines/checks/latest_image.py | --- diff --git a/docs/5.Policy Index/circleci_pipelines.md b/docs/5.Policy Index/circleci_pipelines.md index ee8d77b581e..a7701c2d5dc 100644 --- a/docs/5.Policy Index/circleci_pipelines.md +++ b/docs/5.Policy Index/circleci_pipelines.md @@ -6,16 +6,16 @@ nav_order: 1 # circleci_pipelines resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|-------------------------|--------------------|--------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|--------------------|-------------------------------------------------------------| -| 0 | CKV_CIRCLECIPIPELINES_1 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_CIRCLECIPIPELINES_2 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image version is referenced via hash not arbitrary tag. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_CIRCLECIPIPELINES_3 | circleci_pipelines | orbs.{orbs: @} | Ensure mutable development orbs are not used. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_CIRCLECIPIPELINES_4 | circleci_pipelines | orbs.{orbs: @} | Ensure unversioned volatile orbs are not used. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_CIRCLECIPIPELINES_5 | circleci_pipelines | jobs.*.steps[] | Suspicious use of netcat with IP address | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_CIRCLECIPIPELINES_6 | circleci_pipelines | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_CIRCLECIPIPELINES_7 | circleci_pipelines | jobs.*.steps[] | Suspicious use of curl in run task | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_CIRCLECIPIPELINES_8 | circleci_pipelines | executors.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Detecting image usages in circleci pipelines | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|-------------------------|--------------------|--------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|--------------------|-------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_CIRCLECIPIPELINES_1 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/latest_image.py | +| 1 | CKV_CIRCLECIPIPELINES_2 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image version is referenced via hash not arbitrary tag. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/image_version_not_hash.py | +| 2 | CKV_CIRCLECIPIPELINES_3 | circleci_pipelines | orbs.{orbs: @} | Ensure mutable development orbs are not used. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/prevent_development_orbs.py | +| 3 | CKV_CIRCLECIPIPELINES_4 | circleci_pipelines | orbs.{orbs: @} | Ensure unversioned volatile orbs are not used. | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/prevent_volatile_orbs.py | +| 4 | CKV_CIRCLECIPIPELINES_5 | circleci_pipelines | jobs.*.steps[] | Suspicious use of netcat with IP address | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/ReverseShellNetcat.py | +| 5 | CKV_CIRCLECIPIPELINES_6 | circleci_pipelines | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/ShellInjection.py | +| 6 | CKV_CIRCLECIPIPELINES_7 | circleci_pipelines | jobs.*.steps[] | Suspicious use of curl in run task | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/SuspectCurlInScript.py | +| 7 | CKV_CIRCLECIPIPELINES_8 | circleci_pipelines | executors.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Detecting image usages in circleci pipelines | circleci_pipelines | https://github.com/bridgecrewio/checkov/tree/master/checkov/circleci_pipelines/checks/DetectImagesUsage.py | --- diff --git a/docs/5.Policy Index/cloudformation.md b/docs/5.Policy Index/cloudformation.md index 0d5b88228d1..01851f2333d 100644 --- a/docs/5.Policy Index/cloudformation.md +++ b/docs/5.Policy Index/cloudformation.md @@ -6,168 +6,168 @@ nav_order: 1 # cloudformation resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|-----|-------------|----------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-------------------------------------------------------------| -| 0 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 17 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 18 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 19 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 20 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 21 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure Dynamodb point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 22 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 23 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 24 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 25 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 26 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 27 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 28 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 29 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 30 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 31 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 32 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 33 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 34 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 35 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 36 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 37 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 38 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 39 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLS enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 40 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 41 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 42 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has 'restrict_public_bucket' enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 43 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 44 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 45 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 46 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 47 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 48 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 49 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 50 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 51 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 52 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 53 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 54 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 55 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 56 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 57 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 58 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 59 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 60 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 61 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 62 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 63 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 64 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 65 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 66 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 67 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 68 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 69 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 70 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 71 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 72 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 73 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocDB Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 74 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure Cloudfront distribution has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 75 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 76 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 77 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 78 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 79 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB TLS is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 80 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 81 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 82 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 83 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 84 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 85 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 86 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 87 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 88 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 89 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 90 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 91 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB has audit logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 92 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 93 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 94 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 95 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 96 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 97 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 98 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 99 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 100 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 101 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 102 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 103 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 104 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 105 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 106 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 107 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 108 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 109 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 110 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 111 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 112 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 113 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 114 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 115 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 116 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 117 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 118 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 119 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 120 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 121 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 122 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 123 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 124 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 125 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 126 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 127 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 128 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 129 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 130 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 131 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 132 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 133 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 134 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 135 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 136 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 137 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 138 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 139 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 140 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 141 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 142 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure Dynamodb global table point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 143 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 144 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 145 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 146 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 147 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 148 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 149 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 150 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 151 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 152 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 153 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 154 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 155 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 156 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 157 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 158 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 159 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|-----|-------------|----------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBListenerHTTPS.py | +| 1 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EBSEncryption.py | +| 2 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchEncryption.py | +| 3 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py | +| 4 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KMSRotation.py | +| 5 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LaunchConfigurationEBSEncryption.py | +| 6 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSEncryption.py | +| 7 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py | +| 8 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3AccessLogs.py | +| 9 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3Encryption.py | +| 10 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3PublicACLRead.py | +| 11 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3Versioning.py | +| 12 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 13 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 14 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 15 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 16 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 17 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 18 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 19 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SNSTopicEncryption.py | +| 20 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SQSQueueEncryption.py | +| 21 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure Dynamodb point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamodbRecovery.py | +| 22 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py | +| 23 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py | +| 24 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py | +| 25 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRPolicy.py | +| 26 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KMSKeyWildCardPrincipal.py | +| 27 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionEncryption.py | +| 28 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailEncryption.py | +| 29 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailLogValidation.py | +| 30 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 31 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EFSEncryptionEnabled.py | +| 32 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KinesisStreamEncryptionType.py | +| 33 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/NeptuneClusterStorageEncrypted.py | +| 34 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py | +| 35 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py | +| 36 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2Credentials.py | +| 37 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DAXEncryption.py | +| 38 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRImmutableTags.py | +| 39 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLS enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3BlockPublicACLs.py | +| 40 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3BlockPublicPolicy.py | +| 41 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3IgnorePublicACLs.py | +| 42 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has 'restrict_public_bucket' enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3RestrictPublicBuckets.py | +| 43 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3PublicACLWrite.py | +| 44 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EKSSecretsEncryption.py | +| 45 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py | +| 46 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMRoleAllowsPublicAssume.py | +| 47 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py | +| 48 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 49 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 50 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 51 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 52 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 53 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 54 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 55 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 56 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py | +| 57 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py | +| 58 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupRetention.py | +| 59 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailMultiRegion.py | +| 60 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WAFEnabled.py | +| 61 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AmazonMQBrokerPublicAccess.py | +| 62 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterLogging.py | +| 63 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py | +| 64 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py | +| 65 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBEncryption.py | +| 66 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py | +| 67 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py | +| 68 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CodeBuildProjectEncryption.py | +| 69 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IMDSv1Disabled.py | +| 70 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AthenaWorkgroupConfiguration.py | +| 71 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py | +| 72 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py | +| 73 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocDB Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBLogging.py | +| 74 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure Cloudfront distribution has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionLogging.py | +| 75 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterPubliclyAccessible.py | +| 76 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py | +| 77 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py | +| 78 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py | +| 79 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB TLS is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBTLS.py | +| 80 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ELBv2AccessLogs.py | +| 81 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ELBAccessLogs.py | +| 82 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueDataCatalogEncryption.py | +| 83 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py | +| 84 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py | +| 85 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AuroraEncryption.py | +| 86 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py | +| 87 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfiguration.py | +| 88 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EKSNodeGroupRemoteAccess.py | +| 89 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/NeptuneClusterLogging.py | +| 90 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBListenerTLS12.py | +| 91 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB has audit logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBAuditLogs.py | +| 92 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedShiftSSL.py | +| 93 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 94 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 95 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 96 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 97 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 98 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 99 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 100 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 101 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 102 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 103 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 104 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 105 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 106 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 107 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 108 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 109 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 110 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 111 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 112 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 113 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 114 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 115 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 116 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 117 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 118 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py | +| 119 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py | +| 120 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py | +| 121 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py | +| 122 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py | +| 123 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py | +| 124 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSEnhancedMonitorEnabled.py | +| 125 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamoDBTablesEncrypted.py | +| 126 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py | +| 127 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py | +| 128 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/VPCEndpointAcceptanceConfigured.py | +| 129 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBDropHttpHeaders.py | +| 130 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRRepositoryEncrypted.py | +| 131 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecretManagerSecretEncrypted.py | +| 132 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftInEc2ClassicMode.py | +| 133 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WorkspaceUserVolumeEncrypted.py | +| 134 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WorkspaceRootVolumeEncrypted.py | +| 135 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py | +| 136 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupKMSKey.py | +| 137 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/TimestreamDatabaseKMSKey.py | +| 138 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSIAMAuthentication.py | +| 139 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSClusterIAMAuthentication.py | +| 140 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRImageScanning.py | +| 141 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/TransferServerIsPublic.py | +| 142 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure Dynamodb global table point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamodbGlobalTableRecovery.py | +| 143 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/BackupVaultEncrypted.py | +| 144 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/QLDBLedgerPermissionsMode.py | +| 145 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/QLDBLedgerDeletionProtection.py | +| 146 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py | +| 147 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py | +| 148 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudFrontTLS12.py | +| 149 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WAFACLCVE202144228.py | +| 150 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AppSyncLogging.py | +| 151 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AppSyncFieldLevelLogs.py | +| 152 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 153 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 154 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 155 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/MQBrokerAuditLogging.py | +| 156 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionURLAuth.py | +| 157 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 158 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 159 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | --- diff --git a/docs/5.Policy Index/dockerfile.md b/docs/5.Policy Index/dockerfile.md index 17ab1751d46..95e18270ffd 100644 --- a/docs/5.Policy Index/dockerfile.md +++ b/docs/5.Policy Index/dockerfile.md @@ -6,20 +6,20 @@ nav_order: 1 # dockerfile resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|---------------|------------|------------|--------------------------------------------------------------------------|------------|-------------------------------------------------------------| -| 0 | CKV_DOCKER_1 | dockerfile | EXPOSE | Ensure port 22 is not exposed | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_DOCKER_2 | dockerfile | * | Ensure that HEALTHCHECK instructions have been added to container images | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_DOCKER_3 | dockerfile | * | Ensure that a user for the container has been created | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_DOCKER_4 | dockerfile | ADD | Ensure that COPY is used instead of ADD in Dockerfiles | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_DOCKER_5 | dockerfile | RUN | Ensure update instructions are not use alone in the Dockerfile | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_DOCKER_6 | dockerfile | MAINTAINER | Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_DOCKER_7 | dockerfile | FROM | Ensure the base image uses a non latest version tag | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_DOCKER_8 | dockerfile | USER | Ensure the last USER is not root | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_DOCKER_9 | dockerfile | RUN | Ensure that APT isn't used | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_DOCKER_10 | dockerfile | WORKDIR | Ensure that WORKDIR values are absolute paths | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_DOCKER_11 | dockerfile | FROM | Ensure From Alias are unique for multistage builds. | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV2_DOCKER_1 | resource | RUN | Ensure that sudo isn't used | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|---------------|------------|------------|--------------------------------------------------------------------------|------------|-----------------------------------------------------------------------------------------------------| +| 0 | CKV_DOCKER_1 | dockerfile | EXPOSE | Ensure port 22 is not exposed | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/ExposePort22.py | +| 1 | CKV_DOCKER_2 | dockerfile | * | Ensure that HEALTHCHECK instructions have been added to container images | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/HealthcheckExists.py | +| 2 | CKV_DOCKER_3 | dockerfile | * | Ensure that a user for the container has been created | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/UserExists.py | +| 3 | CKV_DOCKER_4 | dockerfile | ADD | Ensure that COPY is used instead of ADD in Dockerfiles | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/AddExists.py | +| 4 | CKV_DOCKER_5 | dockerfile | RUN | Ensure update instructions are not use alone in the Dockerfile | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/UpdateNotAlone.py | +| 5 | CKV_DOCKER_6 | dockerfile | MAINTAINER | Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/MaintainerExists.py | +| 6 | CKV_DOCKER_7 | dockerfile | FROM | Ensure the base image uses a non latest version tag | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/ReferenceLatestTag.py | +| 7 | CKV_DOCKER_8 | dockerfile | USER | Ensure the last USER is not root | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/RootUser.py | +| 8 | CKV_DOCKER_9 | dockerfile | RUN | Ensure that APT isn't used | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/RunUsingAPT.py | +| 9 | CKV_DOCKER_10 | dockerfile | WORKDIR | Ensure that WORKDIR values are absolute paths | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/WorkdirIsAbsolute.py | +| 10 | CKV_DOCKER_11 | dockerfile | FROM | Ensure From Alias are unique for multistage builds. | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/dockerfile/checks/AliasIsUnique.py | +| 11 | CKV2_DOCKER_1 | resource | RUN | Ensure that sudo isn't used | dockerfile | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | --- diff --git a/docs/5.Policy Index/github_actions.md b/docs/5.Policy Index/github_actions.md index 5e2128585e5..2e3a3b11144 100644 --- a/docs/5.Policy Index/github_actions.md +++ b/docs/5.Policy Index/github_actions.md @@ -6,20 +6,20 @@ nav_order: 1 # github_actions resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|------------|----------|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-------------------------------------------------------------| -| 0 | CKV_GHA_1 | jobs | jobs | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_GHA_1 | jobs | jobs.*.steps[] | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_GHA_2 | jobs | jobs | Ensure run commands are not vulnerable to shell injection | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_GHA_2 | jobs | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_GHA_3 | jobs | jobs | Suspicious use of curl with secrets | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_GHA_3 | jobs | jobs.*.steps[] | Suspicious use of curl with secrets | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_GHA_4 | jobs | jobs | Suspicious use of netcat with IP address | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_GHA_4 | jobs | jobs.*.steps[] | Suspicious use of netcat with IP address | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_GHA_5 | jobs | jobs | Found artifact build without evidence of cosign sign execution in pipeline | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_GHA_6 | jobs | jobs | Found artifact build without evidence of cosign sbom attestation in pipeline | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_GHA_7 | jobs | on | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV2_GHA_1 | resource | permissions | Ensure top-level permissions are not set to write-all | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|------------|----------|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_GHA_1 | jobs | jobs | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py | +| 1 | CKV_GHA_1 | jobs | jobs.*.steps[] | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py | +| 2 | CKV_GHA_2 | jobs | jobs | Ensure run commands are not vulnerable to shell injection | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/ShellInjection.py | +| 3 | CKV_GHA_2 | jobs | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/ShellInjection.py | +| 4 | CKV_GHA_3 | jobs | jobs | Suspicious use of curl with secrets | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/SuspectCurlInScript.py | +| 5 | CKV_GHA_3 | jobs | jobs.*.steps[] | Suspicious use of curl with secrets | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/SuspectCurlInScript.py | +| 6 | CKV_GHA_4 | jobs | jobs | Suspicious use of netcat with IP address | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/ReverseShellNetcat.py | +| 7 | CKV_GHA_4 | jobs | jobs.*.steps[] | Suspicious use of netcat with IP address | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/ReverseShellNetcat.py | +| 8 | CKV_GHA_5 | jobs | jobs | Found artifact build without evidence of cosign sign execution in pipeline | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/CosignArtifacts.py | +| 9 | CKV_GHA_6 | jobs | jobs | Found artifact build without evidence of cosign sbom attestation in pipeline | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/CosignSBOM.py | +| 10 | CKV_GHA_7 | jobs | on | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/github_actions/checks/job/EmptyWorkflowDispatch.py | +| 11 | CKV2_GHA_1 | resource | permissions | Ensure top-level permissions are not set to write-all | github_actions | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | --- diff --git a/docs/5.Policy Index/github_configuration.md b/docs/5.Policy Index/github_configuration.md index 875d86b0e99..cfcdc006545 100644 --- a/docs/5.Policy Index/github_configuration.md +++ b/docs/5.Policy Index/github_configuration.md @@ -6,25 +6,25 @@ nav_order: 1 # github_configuration resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|---------------|----------------------|--------|----------------------------------------------------------------------------------|----------------------|-------------------------------------------------------------| -| 0 | CKV_GITHUB_1 | github_configuration | * | Ensure GitHub organization security settings require 2FA | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_GITHUB_2 | github_configuration | * | Ensure GitHub organization security settings require SSO | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_GITHUB_3 | github_configuration | * | Ensure GitHub organization security settings has IP allow list enabled | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_GITHUB_4 | github_configuration | * | Ensure GitHub branch protection rules requires signed commits | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_GITHUB_5 | github_configuration | * | Ensure GitHub branch protection rules does not allow force pushes | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_GITHUB_6 | github_configuration | * | Ensure GitHub organization webhooks are using HTTPS | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_GITHUB_7 | github_configuration | * | Ensure GitHub repository webhooks are using HTTPS | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_GITHUB_8 | github_configuration | * | Ensure GitHub branch protection rules requires linear history | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_GITHUB_9 | github_configuration | * | Ensure 2 admins are set for each repository | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_GITHUB_10 | github_configuration | * | Ensure branch protection rules are enforced on administrators | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_GITHUB_11 | github_configuration | * | Ensure GitHub branch protection dismisses stale review on new commit - CIS 1.1.4 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_GITHUB_12 | github_configuration | * | Ensure GitHub branch protection restricts who can dismiss PR reviews - CIS 1.1.5 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_GITHUB_13 | github_configuration | * | Ensure GitHub branch protection requires CODEOWNER reviews - CIS 1.1.6 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_GITHUB_14 | github_configuration | * | Ensure GitHub branch protection requires status checks - CIS 1.1.9 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_GITHUB_16 | github_configuration | * | Ensure GitHub branch protection requires conversation resolution - CIS 1.1.11 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_GITHUB_17 | github_configuration | * | Ensure GitHub branch protection requires push restrictions - CIS 1.1.15 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_GITHUB_18 | github_configuration | * | Ensure GitHub branch protection rules does not allow deletions - CIS 1.1.17 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|---------------|----------------------|--------|----------------------------------------------------------------------------------|----------------------|---------------------------------------------------------------------------------------------------------------| +| 0 | CKV_GITHUB_1 | github_configuration | * | Ensure GitHub organization security settings require 2FA | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/2fa.py | +| 1 | CKV_GITHUB_2 | github_configuration | * | Ensure GitHub organization security settings require SSO | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/sso.py | +| 2 | CKV_GITHUB_3 | github_configuration | * | Ensure GitHub organization security settings has IP allow list enabled | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/ipallowlist.py | +| 3 | CKV_GITHUB_4 | github_configuration | * | Ensure GitHub branch protection rules requires signed commits | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_signatures.py | +| 4 | CKV_GITHUB_5 | github_configuration | * | Ensure GitHub branch protection rules does not allow force pushes | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/disallow_force_pushes.py | +| 5 | CKV_GITHUB_6 | github_configuration | * | Ensure GitHub organization webhooks are using HTTPS | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/webhooks_https_orgs.py | +| 6 | CKV_GITHUB_7 | github_configuration | * | Ensure GitHub repository webhooks are using HTTPS | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/webhooks_https_repos.py | +| 7 | CKV_GITHUB_8 | github_configuration | * | Ensure GitHub branch protection rules requires linear history | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_linear_history.py | +| 8 | CKV_GITHUB_9 | github_configuration | * | Ensure 2 admins are set for each repository | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/repository_collaborators.py | +| 9 | CKV_GITHUB_10 | github_configuration | * | Ensure branch protection rules are enforced on administrators | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/enforce_branch_protection_admins.py | +| 10 | CKV_GITHUB_11 | github_configuration | * | Ensure GitHub branch protection dismisses stale review on new commit - CIS 1.1.4 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/dismiss_stale_reviews.py | +| 11 | CKV_GITHUB_12 | github_configuration | * | Ensure GitHub branch protection restricts who can dismiss PR reviews - CIS 1.1.5 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/restrict_pr_review_dismissal.py | +| 12 | CKV_GITHUB_13 | github_configuration | * | Ensure GitHub branch protection requires CODEOWNER reviews - CIS 1.1.6 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_code_owner_reviews.py | +| 13 | CKV_GITHUB_14 | github_configuration | * | Ensure GitHub branch protection requires status checks - CIS 1.1.9 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_status_checks_pr.py | +| 14 | CKV_GITHUB_16 | github_configuration | * | Ensure GitHub branch protection requires conversation resolution - CIS 1.1.11 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_conversation_resolution.py | +| 15 | CKV_GITHUB_17 | github_configuration | * | Ensure GitHub branch protection requires push restrictions - CIS 1.1.15 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/require_push_restrictions.py | +| 16 | CKV_GITHUB_18 | github_configuration | * | Ensure GitHub branch protection rules does not allow deletions - CIS 1.1.17 | github_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/github/checks/disallow_branch_deletions.py | --- diff --git a/docs/5.Policy Index/gitlab_ci.md b/docs/5.Policy Index/gitlab_ci.md index 6406979bc50..1debf0291a6 100644 --- a/docs/5.Policy Index/gitlab_ci.md +++ b/docs/5.Policy Index/gitlab_ci.md @@ -6,12 +6,12 @@ nav_order: 1 # gitlab_ci resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|----------------|------|--------------|----------------------------------------------------------------|-----------|-------------------------------------------------------------| -| 0 | CKV_GITLABCI_1 | jobs | *.script[] | Suspicious use of curl with CI environment variables in script | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_GITLABCI_2 | jobs | *.rules | Avoid creating rules that generate double pipelines | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_GITLABCI_3 | jobs | *.image[] | Detecting image usages in gitlab workflows | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_GITLABCI_3 | jobs | *.services[] | Detecting image usages in gitlab workflows | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|----------------|------|--------------|----------------------------------------------------------------|-----------|----------------------------------------------------------------------------------------------------------| +| 0 | CKV_GITLABCI_1 | jobs | *.script[] | Suspicious use of curl with CI environment variables in script | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab_ci/checks/job/SuspectCurlInScript.py | +| 1 | CKV_GITLABCI_2 | jobs | *.rules | Avoid creating rules that generate double pipelines | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab_ci/checks/job/AvoidDoublePipelines.py | +| 2 | CKV_GITLABCI_3 | jobs | *.image[] | Detecting image usages in gitlab workflows | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab_ci/checks/job/DetectImagesUsage.py | +| 3 | CKV_GITLABCI_3 | jobs | *.services[] | Detecting image usages in gitlab workflows | gitlab_ci | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab_ci/checks/job/DetectImagesUsage.py | --- diff --git a/docs/5.Policy Index/gitlab_configuration.md b/docs/5.Policy Index/gitlab_configuration.md index 7e68ae90913..59f9ecadb90 100644 --- a/docs/5.Policy Index/gitlab_configuration.md +++ b/docs/5.Policy Index/gitlab_configuration.md @@ -6,10 +6,10 @@ nav_order: 1 # gitlab_configuration resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|--------------|----------------------|--------|------------------------------------------------------------|----------------------|-------------------------------------------------------------| -| 0 | CKV_GITLAB_1 | gitlab_configuration | * | Merge requests should require at least 2 approvals | gitlab_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_GITLAB_2 | gitlab_configuration | * | Ensure all Gitlab groups require two factor authentication | gitlab_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|--------------|----------------------|--------|------------------------------------------------------------|----------------------|--------------------------------------------------------------------------------------------------------| +| 0 | CKV_GITLAB_1 | gitlab_configuration | * | Merge requests should require at least 2 approvals | gitlab_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab/checks/merge_requests_approvals.py | +| 1 | CKV_GITLAB_2 | gitlab_configuration | * | Ensure all Gitlab groups require two factor authentication | gitlab_configuration | https://github.com/bridgecrewio/checkov/tree/master/checkov/gitlab/checks/two_factor_authentication.py | --- diff --git a/docs/5.Policy Index/kubernetes.md b/docs/5.Policy Index/kubernetes.md index 3b05212f6b6..7a38138035b 100644 --- a/docs/5.Policy Index/kubernetes.md +++ b/docs/5.Policy Index/kubernetes.md @@ -6,908 +6,908 @@ nav_order: 1 # kubernetes resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|-----|-------------|----------|------------------------|--------------------------------------------------------------------------------------------------------|------------|-------------------------------------------------------------| -| 0 | CKV_K8S_1 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_K8S_2 | resource | PodSecurityPolicy | Do not admit privileged containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_K8S_3 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_K8S_4 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_K8S_5 | resource | PodSecurityPolicy | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_K8S_6 | resource | PodSecurityPolicy | Do not admit root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_K8S_7 | resource | PodSecurityPolicy | Do not admit containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_K8S_8 | resource | DaemonSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_K8S_8 | resource | Deployment | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_K8S_8 | resource | DeploymentConfig | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_K8S_8 | resource | Pod | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_K8S_8 | resource | PodTemplate | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_K8S_8 | resource | ReplicaSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_K8S_8 | resource | ReplicationController | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_K8S_8 | resource | StatefulSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_K8S_9 | resource | DaemonSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_K8S_9 | resource | Deployment | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 17 | CKV_K8S_9 | resource | DeploymentConfig | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 18 | CKV_K8S_9 | resource | Pod | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 19 | CKV_K8S_9 | resource | PodTemplate | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 20 | CKV_K8S_9 | resource | ReplicaSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 21 | CKV_K8S_9 | resource | ReplicationController | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 22 | CKV_K8S_9 | resource | StatefulSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 23 | CKV_K8S_10 | resource | CronJob | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 24 | CKV_K8S_10 | resource | DaemonSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 25 | CKV_K8S_10 | resource | Deployment | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 26 | CKV_K8S_10 | resource | DeploymentConfig | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 27 | CKV_K8S_10 | resource | Job | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 28 | CKV_K8S_10 | resource | Pod | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 29 | CKV_K8S_10 | resource | PodTemplate | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 30 | CKV_K8S_10 | resource | ReplicaSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 31 | CKV_K8S_10 | resource | ReplicationController | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 32 | CKV_K8S_10 | resource | StatefulSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 33 | CKV_K8S_11 | resource | CronJob | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 34 | CKV_K8S_11 | resource | DaemonSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 35 | CKV_K8S_11 | resource | Deployment | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 36 | CKV_K8S_11 | resource | DeploymentConfig | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 37 | CKV_K8S_11 | resource | Job | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 38 | CKV_K8S_11 | resource | Pod | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 39 | CKV_K8S_11 | resource | PodTemplate | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 40 | CKV_K8S_11 | resource | ReplicaSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 41 | CKV_K8S_11 | resource | ReplicationController | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 42 | CKV_K8S_11 | resource | StatefulSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 43 | CKV_K8S_12 | resource | CronJob | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 44 | CKV_K8S_12 | resource | DaemonSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 45 | CKV_K8S_12 | resource | Deployment | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 46 | CKV_K8S_12 | resource | DeploymentConfig | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 47 | CKV_K8S_12 | resource | Job | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 48 | CKV_K8S_12 | resource | Pod | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 49 | CKV_K8S_12 | resource | PodTemplate | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 50 | CKV_K8S_12 | resource | ReplicaSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 51 | CKV_K8S_12 | resource | ReplicationController | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 52 | CKV_K8S_12 | resource | StatefulSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 53 | CKV_K8S_13 | resource | CronJob | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 54 | CKV_K8S_13 | resource | DaemonSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 55 | CKV_K8S_13 | resource | Deployment | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 56 | CKV_K8S_13 | resource | DeploymentConfig | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 57 | CKV_K8S_13 | resource | Job | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 58 | CKV_K8S_13 | resource | Pod | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 59 | CKV_K8S_13 | resource | PodTemplate | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 60 | CKV_K8S_13 | resource | ReplicaSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 61 | CKV_K8S_13 | resource | ReplicationController | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 62 | CKV_K8S_13 | resource | StatefulSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 63 | CKV_K8S_14 | resource | CronJob | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 64 | CKV_K8S_14 | resource | DaemonSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 65 | CKV_K8S_14 | resource | Deployment | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 66 | CKV_K8S_14 | resource | DeploymentConfig | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 67 | CKV_K8S_14 | resource | Job | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 68 | CKV_K8S_14 | resource | Pod | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 69 | CKV_K8S_14 | resource | PodTemplate | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 70 | CKV_K8S_14 | resource | ReplicaSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 71 | CKV_K8S_14 | resource | ReplicationController | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 72 | CKV_K8S_14 | resource | StatefulSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 73 | CKV_K8S_15 | resource | CronJob | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 74 | CKV_K8S_15 | resource | DaemonSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 75 | CKV_K8S_15 | resource | Deployment | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 76 | CKV_K8S_15 | resource | DeploymentConfig | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 77 | CKV_K8S_15 | resource | Job | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 78 | CKV_K8S_15 | resource | Pod | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 79 | CKV_K8S_15 | resource | PodTemplate | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 80 | CKV_K8S_15 | resource | ReplicaSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 81 | CKV_K8S_15 | resource | ReplicationController | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 82 | CKV_K8S_15 | resource | StatefulSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 83 | CKV_K8S_16 | resource | CronJob | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 84 | CKV_K8S_16 | resource | DaemonSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 85 | CKV_K8S_16 | resource | Deployment | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 86 | CKV_K8S_16 | resource | DeploymentConfig | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 87 | CKV_K8S_16 | resource | Job | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 88 | CKV_K8S_16 | resource | Pod | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 89 | CKV_K8S_16 | resource | PodTemplate | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 90 | CKV_K8S_16 | resource | ReplicaSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 91 | CKV_K8S_16 | resource | ReplicationController | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 92 | CKV_K8S_16 | resource | StatefulSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 93 | CKV_K8S_17 | resource | CronJob | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 94 | CKV_K8S_17 | resource | DaemonSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 95 | CKV_K8S_17 | resource | Deployment | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 96 | CKV_K8S_17 | resource | Job | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 97 | CKV_K8S_17 | resource | Pod | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 98 | CKV_K8S_17 | resource | ReplicaSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 99 | CKV_K8S_17 | resource | ReplicationController | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 100 | CKV_K8S_17 | resource | StatefulSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 101 | CKV_K8S_18 | resource | CronJob | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 102 | CKV_K8S_18 | resource | DaemonSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 103 | CKV_K8S_18 | resource | Deployment | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 104 | CKV_K8S_18 | resource | Job | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 105 | CKV_K8S_18 | resource | Pod | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 106 | CKV_K8S_18 | resource | ReplicaSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 107 | CKV_K8S_18 | resource | ReplicationController | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 108 | CKV_K8S_18 | resource | StatefulSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 109 | CKV_K8S_19 | resource | CronJob | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 110 | CKV_K8S_19 | resource | DaemonSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 111 | CKV_K8S_19 | resource | Deployment | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 112 | CKV_K8S_19 | resource | Job | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 113 | CKV_K8S_19 | resource | Pod | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 114 | CKV_K8S_19 | resource | ReplicaSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 115 | CKV_K8S_19 | resource | ReplicationController | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 116 | CKV_K8S_19 | resource | StatefulSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 117 | CKV_K8S_20 | resource | CronJob | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 118 | CKV_K8S_20 | resource | DaemonSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 119 | CKV_K8S_20 | resource | Deployment | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 120 | CKV_K8S_20 | resource | DeploymentConfig | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 121 | CKV_K8S_20 | resource | Job | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 122 | CKV_K8S_20 | resource | Pod | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 123 | CKV_K8S_20 | resource | PodTemplate | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 124 | CKV_K8S_20 | resource | ReplicaSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 125 | CKV_K8S_20 | resource | ReplicationController | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 126 | CKV_K8S_20 | resource | StatefulSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 127 | CKV_K8S_21 | resource | ConfigMap | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 128 | CKV_K8S_21 | resource | CronJob | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 129 | CKV_K8S_21 | resource | DaemonSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 130 | CKV_K8S_21 | resource | Deployment | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 131 | CKV_K8S_21 | resource | Ingress | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 132 | CKV_K8S_21 | resource | Job | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 133 | CKV_K8S_21 | resource | Pod | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 134 | CKV_K8S_21 | resource | ReplicaSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 135 | CKV_K8S_21 | resource | ReplicationController | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 136 | CKV_K8S_21 | resource | Role | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 137 | CKV_K8S_21 | resource | RoleBinding | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 138 | CKV_K8S_21 | resource | Secret | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 139 | CKV_K8S_21 | resource | Service | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 140 | CKV_K8S_21 | resource | ServiceAccount | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 141 | CKV_K8S_21 | resource | StatefulSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 142 | CKV_K8S_22 | resource | CronJob | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 143 | CKV_K8S_22 | resource | DaemonSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 144 | CKV_K8S_22 | resource | Deployment | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 145 | CKV_K8S_22 | resource | DeploymentConfig | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 146 | CKV_K8S_22 | resource | Job | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 147 | CKV_K8S_22 | resource | Pod | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 148 | CKV_K8S_22 | resource | PodTemplate | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 149 | CKV_K8S_22 | resource | ReplicaSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 150 | CKV_K8S_22 | resource | ReplicationController | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 151 | CKV_K8S_22 | resource | StatefulSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 152 | CKV_K8S_23 | resource | CronJob | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 153 | CKV_K8S_23 | resource | DaemonSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 154 | CKV_K8S_23 | resource | Deployment | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 155 | CKV_K8S_23 | resource | Job | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 156 | CKV_K8S_23 | resource | Pod | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 157 | CKV_K8S_23 | resource | ReplicaSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 158 | CKV_K8S_23 | resource | ReplicationController | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 159 | CKV_K8S_23 | resource | StatefulSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 160 | CKV_K8S_24 | resource | PodSecurityPolicy | Do not allow containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 161 | CKV_K8S_25 | resource | CronJob | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 162 | CKV_K8S_25 | resource | DaemonSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 163 | CKV_K8S_25 | resource | Deployment | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 164 | CKV_K8S_25 | resource | DeploymentConfig | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 165 | CKV_K8S_25 | resource | Job | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 166 | CKV_K8S_25 | resource | Pod | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 167 | CKV_K8S_25 | resource | PodTemplate | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 168 | CKV_K8S_25 | resource | ReplicaSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 169 | CKV_K8S_25 | resource | ReplicationController | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 170 | CKV_K8S_25 | resource | StatefulSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 171 | CKV_K8S_26 | resource | CronJob | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 172 | CKV_K8S_26 | resource | DaemonSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 173 | CKV_K8S_26 | resource | Deployment | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 174 | CKV_K8S_26 | resource | DeploymentConfig | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 175 | CKV_K8S_26 | resource | Job | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 176 | CKV_K8S_26 | resource | Pod | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 177 | CKV_K8S_26 | resource | PodTemplate | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 178 | CKV_K8S_26 | resource | ReplicaSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 179 | CKV_K8S_26 | resource | ReplicationController | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 180 | CKV_K8S_26 | resource | StatefulSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 181 | CKV_K8S_27 | resource | CronJob | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 182 | CKV_K8S_27 | resource | DaemonSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 183 | CKV_K8S_27 | resource | Deployment | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 184 | CKV_K8S_27 | resource | Job | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 185 | CKV_K8S_27 | resource | Pod | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 186 | CKV_K8S_27 | resource | ReplicaSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 187 | CKV_K8S_27 | resource | ReplicationController | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 188 | CKV_K8S_27 | resource | StatefulSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 189 | CKV_K8S_28 | resource | CronJob | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 190 | CKV_K8S_28 | resource | DaemonSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 191 | CKV_K8S_28 | resource | Deployment | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 192 | CKV_K8S_28 | resource | DeploymentConfig | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 193 | CKV_K8S_28 | resource | Job | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 194 | CKV_K8S_28 | resource | Pod | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 195 | CKV_K8S_28 | resource | PodTemplate | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 196 | CKV_K8S_28 | resource | ReplicaSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 197 | CKV_K8S_28 | resource | ReplicationController | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 198 | CKV_K8S_28 | resource | StatefulSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 199 | CKV_K8S_29 | resource | CronJob | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 200 | CKV_K8S_29 | resource | DaemonSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 201 | CKV_K8S_29 | resource | Deployment | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 202 | CKV_K8S_29 | resource | Job | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 203 | CKV_K8S_29 | resource | Pod | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 204 | CKV_K8S_29 | resource | ReplicaSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 205 | CKV_K8S_29 | resource | ReplicationController | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 206 | CKV_K8S_29 | resource | StatefulSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 207 | CKV_K8S_30 | resource | CronJob | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 208 | CKV_K8S_30 | resource | DaemonSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 209 | CKV_K8S_30 | resource | Deployment | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 210 | CKV_K8S_30 | resource | DeploymentConfig | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 211 | CKV_K8S_30 | resource | Job | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 212 | CKV_K8S_30 | resource | Pod | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 213 | CKV_K8S_30 | resource | PodTemplate | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 214 | CKV_K8S_30 | resource | ReplicaSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 215 | CKV_K8S_30 | resource | ReplicationController | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 216 | CKV_K8S_30 | resource | StatefulSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 217 | CKV_K8S_31 | resource | CronJob | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 218 | CKV_K8S_31 | resource | DaemonSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 219 | CKV_K8S_31 | resource | Deployment | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 220 | CKV_K8S_31 | resource | Job | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 221 | CKV_K8S_31 | resource | Pod | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 222 | CKV_K8S_31 | resource | ReplicaSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 223 | CKV_K8S_31 | resource | ReplicationController | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 224 | CKV_K8S_31 | resource | StatefulSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 225 | CKV_K8S_32 | resource | PodSecurityPolicy | Ensure default seccomp profile set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 226 | CKV_K8S_33 | resource | CronJob | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 227 | CKV_K8S_33 | resource | DaemonSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 228 | CKV_K8S_33 | resource | Deployment | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 229 | CKV_K8S_33 | resource | DeploymentConfig | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 230 | CKV_K8S_33 | resource | Job | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 231 | CKV_K8S_33 | resource | Pod | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 232 | CKV_K8S_33 | resource | PodTemplate | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 233 | CKV_K8S_33 | resource | ReplicaSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 234 | CKV_K8S_33 | resource | ReplicationController | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 235 | CKV_K8S_33 | resource | StatefulSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 236 | CKV_K8S_34 | resource | CronJob | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 237 | CKV_K8S_34 | resource | DaemonSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 238 | CKV_K8S_34 | resource | Deployment | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 239 | CKV_K8S_34 | resource | DeploymentConfig | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 240 | CKV_K8S_34 | resource | Job | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 241 | CKV_K8S_34 | resource | Pod | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 242 | CKV_K8S_34 | resource | PodTemplate | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 243 | CKV_K8S_34 | resource | ReplicaSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 244 | CKV_K8S_34 | resource | ReplicationController | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 245 | CKV_K8S_34 | resource | StatefulSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 246 | CKV_K8S_35 | resource | CronJob | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 247 | CKV_K8S_35 | resource | DaemonSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 248 | CKV_K8S_35 | resource | Deployment | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 249 | CKV_K8S_35 | resource | DeploymentConfig | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 250 | CKV_K8S_35 | resource | Job | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 251 | CKV_K8S_35 | resource | Pod | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 252 | CKV_K8S_35 | resource | PodTemplate | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 253 | CKV_K8S_35 | resource | ReplicaSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 254 | CKV_K8S_35 | resource | ReplicationController | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 255 | CKV_K8S_35 | resource | StatefulSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 256 | CKV_K8S_36 | resource | PodSecurityPolicy | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 257 | CKV_K8S_37 | resource | CronJob | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 258 | CKV_K8S_37 | resource | DaemonSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 259 | CKV_K8S_37 | resource | Deployment | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 260 | CKV_K8S_37 | resource | DeploymentConfig | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 261 | CKV_K8S_37 | resource | Job | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 262 | CKV_K8S_37 | resource | Pod | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 263 | CKV_K8S_37 | resource | PodTemplate | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 264 | CKV_K8S_37 | resource | ReplicaSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 265 | CKV_K8S_37 | resource | ReplicationController | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 266 | CKV_K8S_37 | resource | StatefulSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 267 | CKV_K8S_38 | resource | CronJob | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 268 | CKV_K8S_38 | resource | DaemonSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 269 | CKV_K8S_38 | resource | Deployment | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 270 | CKV_K8S_38 | resource | Job | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 271 | CKV_K8S_38 | resource | Pod | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 272 | CKV_K8S_38 | resource | ReplicaSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 273 | CKV_K8S_38 | resource | ReplicationController | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 274 | CKV_K8S_38 | resource | StatefulSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 275 | CKV_K8S_39 | resource | CronJob | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 276 | CKV_K8S_39 | resource | DaemonSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 277 | CKV_K8S_39 | resource | Deployment | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 278 | CKV_K8S_39 | resource | DeploymentConfig | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 279 | CKV_K8S_39 | resource | Job | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 280 | CKV_K8S_39 | resource | Pod | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 281 | CKV_K8S_39 | resource | PodTemplate | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 282 | CKV_K8S_39 | resource | ReplicaSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 283 | CKV_K8S_39 | resource | ReplicationController | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 284 | CKV_K8S_39 | resource | StatefulSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 285 | CKV_K8S_40 | resource | CronJob | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 286 | CKV_K8S_40 | resource | DaemonSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 287 | CKV_K8S_40 | resource | Deployment | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 288 | CKV_K8S_40 | resource | Job | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 289 | CKV_K8S_40 | resource | Pod | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 290 | CKV_K8S_40 | resource | ReplicaSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 291 | CKV_K8S_40 | resource | ReplicationController | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 292 | CKV_K8S_40 | resource | StatefulSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 293 | CKV_K8S_41 | resource | ServiceAccount | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 294 | CKV_K8S_42 | resource | ClusterRoleBinding | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 295 | CKV_K8S_42 | resource | RoleBinding | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 296 | CKV_K8S_43 | resource | CronJob | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 297 | CKV_K8S_43 | resource | DaemonSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 298 | CKV_K8S_43 | resource | Deployment | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 299 | CKV_K8S_43 | resource | DeploymentConfig | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 300 | CKV_K8S_43 | resource | Job | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 301 | CKV_K8S_43 | resource | Pod | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 302 | CKV_K8S_43 | resource | PodTemplate | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 303 | CKV_K8S_43 | resource | ReplicaSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 304 | CKV_K8S_43 | resource | ReplicationController | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 305 | CKV_K8S_43 | resource | StatefulSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 306 | CKV_K8S_44 | resource | Service | Ensure that the Tiller Service (Helm v2) is deleted | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 307 | CKV_K8S_45 | resource | CronJob | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 308 | CKV_K8S_45 | resource | DaemonSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 309 | CKV_K8S_45 | resource | Deployment | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 310 | CKV_K8S_45 | resource | DeploymentConfig | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 311 | CKV_K8S_45 | resource | Job | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 312 | CKV_K8S_45 | resource | Pod | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 313 | CKV_K8S_45 | resource | PodTemplate | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 314 | CKV_K8S_45 | resource | ReplicaSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 315 | CKV_K8S_45 | resource | ReplicationController | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 316 | CKV_K8S_45 | resource | StatefulSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 317 | CKV_K8S_49 | resource | ClusterRole | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 318 | CKV_K8S_49 | resource | Role | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 319 | CKV_K8S_68 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 320 | CKV_K8S_68 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 321 | CKV_K8S_68 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 322 | CKV_K8S_68 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 323 | CKV_K8S_68 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 324 | CKV_K8S_68 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 325 | CKV_K8S_68 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 326 | CKV_K8S_68 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 327 | CKV_K8S_68 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 328 | CKV_K8S_68 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 329 | CKV_K8S_69 | resource | CronJob | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 330 | CKV_K8S_69 | resource | DaemonSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 331 | CKV_K8S_69 | resource | Deployment | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 332 | CKV_K8S_69 | resource | DeploymentConfig | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 333 | CKV_K8S_69 | resource | Job | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 334 | CKV_K8S_69 | resource | Pod | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 335 | CKV_K8S_69 | resource | PodTemplate | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 336 | CKV_K8S_69 | resource | ReplicaSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 337 | CKV_K8S_69 | resource | ReplicationController | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 338 | CKV_K8S_69 | resource | StatefulSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 339 | CKV_K8S_70 | resource | CronJob | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 340 | CKV_K8S_70 | resource | DaemonSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 341 | CKV_K8S_70 | resource | Deployment | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 342 | CKV_K8S_70 | resource | DeploymentConfig | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 343 | CKV_K8S_70 | resource | Job | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 344 | CKV_K8S_70 | resource | Pod | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 345 | CKV_K8S_70 | resource | PodTemplate | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 346 | CKV_K8S_70 | resource | ReplicaSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 347 | CKV_K8S_70 | resource | ReplicationController | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 348 | CKV_K8S_70 | resource | StatefulSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 349 | CKV_K8S_71 | resource | CronJob | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 350 | CKV_K8S_71 | resource | DaemonSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 351 | CKV_K8S_71 | resource | Deployment | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 352 | CKV_K8S_71 | resource | DeploymentConfig | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 353 | CKV_K8S_71 | resource | Job | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 354 | CKV_K8S_71 | resource | Pod | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 355 | CKV_K8S_71 | resource | PodTemplate | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 356 | CKV_K8S_71 | resource | ReplicaSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 357 | CKV_K8S_71 | resource | ReplicationController | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 358 | CKV_K8S_71 | resource | StatefulSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 359 | CKV_K8S_72 | resource | CronJob | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 360 | CKV_K8S_72 | resource | DaemonSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 361 | CKV_K8S_72 | resource | Deployment | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 362 | CKV_K8S_72 | resource | DeploymentConfig | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 363 | CKV_K8S_72 | resource | Job | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 364 | CKV_K8S_72 | resource | Pod | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 365 | CKV_K8S_72 | resource | PodTemplate | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 366 | CKV_K8S_72 | resource | ReplicaSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 367 | CKV_K8S_72 | resource | ReplicationController | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 368 | CKV_K8S_72 | resource | StatefulSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 369 | CKV_K8S_73 | resource | CronJob | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 370 | CKV_K8S_73 | resource | DaemonSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 371 | CKV_K8S_73 | resource | Deployment | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 372 | CKV_K8S_73 | resource | DeploymentConfig | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 373 | CKV_K8S_73 | resource | Job | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 374 | CKV_K8S_73 | resource | Pod | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 375 | CKV_K8S_73 | resource | PodTemplate | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 376 | CKV_K8S_73 | resource | ReplicaSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 377 | CKV_K8S_73 | resource | ReplicationController | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 378 | CKV_K8S_73 | resource | StatefulSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 379 | CKV_K8S_74 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 380 | CKV_K8S_74 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 381 | CKV_K8S_74 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 382 | CKV_K8S_74 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 383 | CKV_K8S_74 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 384 | CKV_K8S_74 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 385 | CKV_K8S_74 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 386 | CKV_K8S_74 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 387 | CKV_K8S_74 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 388 | CKV_K8S_74 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 389 | CKV_K8S_75 | resource | CronJob | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 390 | CKV_K8S_75 | resource | DaemonSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 391 | CKV_K8S_75 | resource | Deployment | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 392 | CKV_K8S_75 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 393 | CKV_K8S_75 | resource | Job | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 394 | CKV_K8S_75 | resource | Pod | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 395 | CKV_K8S_75 | resource | PodTemplate | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 396 | CKV_K8S_75 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 397 | CKV_K8S_75 | resource | ReplicationController | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 398 | CKV_K8S_75 | resource | StatefulSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 399 | CKV_K8S_77 | resource | CronJob | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 400 | CKV_K8S_77 | resource | DaemonSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 401 | CKV_K8S_77 | resource | Deployment | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 402 | CKV_K8S_77 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 403 | CKV_K8S_77 | resource | Job | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 404 | CKV_K8S_77 | resource | Pod | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 405 | CKV_K8S_77 | resource | PodTemplate | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 406 | CKV_K8S_77 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 407 | CKV_K8S_77 | resource | ReplicationController | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 408 | CKV_K8S_77 | resource | StatefulSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 409 | CKV_K8S_78 | resource | AdmissionConfiguration | Ensure that the admission control plugin EventRateLimit is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 410 | CKV_K8S_79 | resource | CronJob | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 411 | CKV_K8S_79 | resource | DaemonSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 412 | CKV_K8S_79 | resource | Deployment | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 413 | CKV_K8S_79 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 414 | CKV_K8S_79 | resource | Job | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 415 | CKV_K8S_79 | resource | Pod | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 416 | CKV_K8S_79 | resource | PodTemplate | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 417 | CKV_K8S_79 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 418 | CKV_K8S_79 | resource | ReplicationController | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 419 | CKV_K8S_79 | resource | StatefulSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 420 | CKV_K8S_80 | resource | CronJob | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 421 | CKV_K8S_80 | resource | DaemonSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 422 | CKV_K8S_80 | resource | Deployment | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 423 | CKV_K8S_80 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 424 | CKV_K8S_80 | resource | Job | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 425 | CKV_K8S_80 | resource | Pod | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 426 | CKV_K8S_80 | resource | PodTemplate | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 427 | CKV_K8S_80 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 428 | CKV_K8S_80 | resource | ReplicationController | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 429 | CKV_K8S_80 | resource | StatefulSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 430 | CKV_K8S_81 | resource | CronJob | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 431 | CKV_K8S_81 | resource | DaemonSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 432 | CKV_K8S_81 | resource | Deployment | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 433 | CKV_K8S_81 | resource | DeploymentConfig | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 434 | CKV_K8S_81 | resource | Job | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 435 | CKV_K8S_81 | resource | Pod | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 436 | CKV_K8S_81 | resource | PodTemplate | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 437 | CKV_K8S_81 | resource | ReplicaSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 438 | CKV_K8S_81 | resource | ReplicationController | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 439 | CKV_K8S_81 | resource | StatefulSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 440 | CKV_K8S_82 | resource | CronJob | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 441 | CKV_K8S_82 | resource | DaemonSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 442 | CKV_K8S_82 | resource | Deployment | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 443 | CKV_K8S_82 | resource | DeploymentConfig | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 444 | CKV_K8S_82 | resource | Job | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 445 | CKV_K8S_82 | resource | Pod | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 446 | CKV_K8S_82 | resource | PodTemplate | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 447 | CKV_K8S_82 | resource | ReplicaSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 448 | CKV_K8S_82 | resource | ReplicationController | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 449 | CKV_K8S_82 | resource | StatefulSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 450 | CKV_K8S_83 | resource | CronJob | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 451 | CKV_K8S_83 | resource | DaemonSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 452 | CKV_K8S_83 | resource | Deployment | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 453 | CKV_K8S_83 | resource | DeploymentConfig | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 454 | CKV_K8S_83 | resource | Job | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 455 | CKV_K8S_83 | resource | Pod | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 456 | CKV_K8S_83 | resource | PodTemplate | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 457 | CKV_K8S_83 | resource | ReplicaSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 458 | CKV_K8S_83 | resource | ReplicationController | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 459 | CKV_K8S_83 | resource | StatefulSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 460 | CKV_K8S_84 | resource | CronJob | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 461 | CKV_K8S_84 | resource | DaemonSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 462 | CKV_K8S_84 | resource | Deployment | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 463 | CKV_K8S_84 | resource | DeploymentConfig | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 464 | CKV_K8S_84 | resource | Job | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 465 | CKV_K8S_84 | resource | Pod | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 466 | CKV_K8S_84 | resource | PodTemplate | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 467 | CKV_K8S_84 | resource | ReplicaSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 468 | CKV_K8S_84 | resource | ReplicationController | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 469 | CKV_K8S_84 | resource | StatefulSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 470 | CKV_K8S_85 | resource | CronJob | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 471 | CKV_K8S_85 | resource | DaemonSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 472 | CKV_K8S_85 | resource | Deployment | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 473 | CKV_K8S_85 | resource | DeploymentConfig | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 474 | CKV_K8S_85 | resource | Job | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 475 | CKV_K8S_85 | resource | Pod | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 476 | CKV_K8S_85 | resource | PodTemplate | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 477 | CKV_K8S_85 | resource | ReplicaSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 478 | CKV_K8S_85 | resource | ReplicationController | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 479 | CKV_K8S_85 | resource | StatefulSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 480 | CKV_K8S_86 | resource | CronJob | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 481 | CKV_K8S_86 | resource | DaemonSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 482 | CKV_K8S_86 | resource | Deployment | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 483 | CKV_K8S_86 | resource | DeploymentConfig | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 484 | CKV_K8S_86 | resource | Job | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 485 | CKV_K8S_86 | resource | Pod | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 486 | CKV_K8S_86 | resource | PodTemplate | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 487 | CKV_K8S_86 | resource | ReplicaSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 488 | CKV_K8S_86 | resource | ReplicationController | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 489 | CKV_K8S_86 | resource | StatefulSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 490 | CKV_K8S_88 | resource | CronJob | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 491 | CKV_K8S_88 | resource | DaemonSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 492 | CKV_K8S_88 | resource | Deployment | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 493 | CKV_K8S_88 | resource | DeploymentConfig | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 494 | CKV_K8S_88 | resource | Job | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 495 | CKV_K8S_88 | resource | Pod | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 496 | CKV_K8S_88 | resource | PodTemplate | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 497 | CKV_K8S_88 | resource | ReplicaSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 498 | CKV_K8S_88 | resource | ReplicationController | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 499 | CKV_K8S_88 | resource | StatefulSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 500 | CKV_K8S_89 | resource | CronJob | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 501 | CKV_K8S_89 | resource | DaemonSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 502 | CKV_K8S_89 | resource | Deployment | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 503 | CKV_K8S_89 | resource | DeploymentConfig | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 504 | CKV_K8S_89 | resource | Job | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 505 | CKV_K8S_89 | resource | Pod | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 506 | CKV_K8S_89 | resource | PodTemplate | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 507 | CKV_K8S_89 | resource | ReplicaSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 508 | CKV_K8S_89 | resource | ReplicationController | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 509 | CKV_K8S_89 | resource | StatefulSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 510 | CKV_K8S_90 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 511 | CKV_K8S_90 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 512 | CKV_K8S_90 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 513 | CKV_K8S_90 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 514 | CKV_K8S_90 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 515 | CKV_K8S_90 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 516 | CKV_K8S_90 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 517 | CKV_K8S_90 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 518 | CKV_K8S_90 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 519 | CKV_K8S_90 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 520 | CKV_K8S_91 | resource | CronJob | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 521 | CKV_K8S_91 | resource | DaemonSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 522 | CKV_K8S_91 | resource | Deployment | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 523 | CKV_K8S_91 | resource | DeploymentConfig | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 524 | CKV_K8S_91 | resource | Job | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 525 | CKV_K8S_91 | resource | Pod | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 526 | CKV_K8S_91 | resource | PodTemplate | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 527 | CKV_K8S_91 | resource | ReplicaSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 528 | CKV_K8S_91 | resource | ReplicationController | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 529 | CKV_K8S_91 | resource | StatefulSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 530 | CKV_K8S_92 | resource | CronJob | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 531 | CKV_K8S_92 | resource | DaemonSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 532 | CKV_K8S_92 | resource | Deployment | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 533 | CKV_K8S_92 | resource | DeploymentConfig | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 534 | CKV_K8S_92 | resource | Job | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 535 | CKV_K8S_92 | resource | Pod | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 536 | CKV_K8S_92 | resource | PodTemplate | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 537 | CKV_K8S_92 | resource | ReplicaSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 538 | CKV_K8S_92 | resource | ReplicationController | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 539 | CKV_K8S_92 | resource | StatefulSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 540 | CKV_K8S_93 | resource | CronJob | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 541 | CKV_K8S_93 | resource | DaemonSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 542 | CKV_K8S_93 | resource | Deployment | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 543 | CKV_K8S_93 | resource | DeploymentConfig | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 544 | CKV_K8S_93 | resource | Job | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 545 | CKV_K8S_93 | resource | Pod | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 546 | CKV_K8S_93 | resource | PodTemplate | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 547 | CKV_K8S_93 | resource | ReplicaSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 548 | CKV_K8S_93 | resource | ReplicationController | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 549 | CKV_K8S_93 | resource | StatefulSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 550 | CKV_K8S_94 | resource | CronJob | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 551 | CKV_K8S_94 | resource | DaemonSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 552 | CKV_K8S_94 | resource | Deployment | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 553 | CKV_K8S_94 | resource | DeploymentConfig | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 554 | CKV_K8S_94 | resource | Job | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 555 | CKV_K8S_94 | resource | Pod | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 556 | CKV_K8S_94 | resource | PodTemplate | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 557 | CKV_K8S_94 | resource | ReplicaSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 558 | CKV_K8S_94 | resource | ReplicationController | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 559 | CKV_K8S_94 | resource | StatefulSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 560 | CKV_K8S_95 | resource | CronJob | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 561 | CKV_K8S_95 | resource | DaemonSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 562 | CKV_K8S_95 | resource | Deployment | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 563 | CKV_K8S_95 | resource | DeploymentConfig | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 564 | CKV_K8S_95 | resource | Job | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 565 | CKV_K8S_95 | resource | Pod | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 566 | CKV_K8S_95 | resource | PodTemplate | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 567 | CKV_K8S_95 | resource | ReplicaSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 568 | CKV_K8S_95 | resource | ReplicationController | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 569 | CKV_K8S_95 | resource | StatefulSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 570 | CKV_K8S_96 | resource | CronJob | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 571 | CKV_K8S_96 | resource | DaemonSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 572 | CKV_K8S_96 | resource | Deployment | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 573 | CKV_K8S_96 | resource | DeploymentConfig | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 574 | CKV_K8S_96 | resource | Job | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 575 | CKV_K8S_96 | resource | Pod | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 576 | CKV_K8S_96 | resource | PodTemplate | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 577 | CKV_K8S_96 | resource | ReplicaSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 578 | CKV_K8S_96 | resource | ReplicationController | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 579 | CKV_K8S_96 | resource | StatefulSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 580 | CKV_K8S_97 | resource | CronJob | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 581 | CKV_K8S_97 | resource | DaemonSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 582 | CKV_K8S_97 | resource | Deployment | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 583 | CKV_K8S_97 | resource | DeploymentConfig | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 584 | CKV_K8S_97 | resource | Job | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 585 | CKV_K8S_97 | resource | Pod | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 586 | CKV_K8S_97 | resource | PodTemplate | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 587 | CKV_K8S_97 | resource | ReplicaSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 588 | CKV_K8S_97 | resource | ReplicationController | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 589 | CKV_K8S_97 | resource | StatefulSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 590 | CKV_K8S_99 | resource | CronJob | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 591 | CKV_K8S_99 | resource | DaemonSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 592 | CKV_K8S_99 | resource | Deployment | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 593 | CKV_K8S_99 | resource | DeploymentConfig | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 594 | CKV_K8S_99 | resource | Job | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 595 | CKV_K8S_99 | resource | Pod | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 596 | CKV_K8S_99 | resource | PodTemplate | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 597 | CKV_K8S_99 | resource | ReplicaSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 598 | CKV_K8S_99 | resource | ReplicationController | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 599 | CKV_K8S_99 | resource | StatefulSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 600 | CKV_K8S_100 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 601 | CKV_K8S_100 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 602 | CKV_K8S_100 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 603 | CKV_K8S_100 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 604 | CKV_K8S_100 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 605 | CKV_K8S_100 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 606 | CKV_K8S_100 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 607 | CKV_K8S_100 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 608 | CKV_K8S_100 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 609 | CKV_K8S_100 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 610 | CKV_K8S_102 | resource | CronJob | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 611 | CKV_K8S_102 | resource | DaemonSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 612 | CKV_K8S_102 | resource | Deployment | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 613 | CKV_K8S_102 | resource | DeploymentConfig | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 614 | CKV_K8S_102 | resource | Job | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 615 | CKV_K8S_102 | resource | Pod | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 616 | CKV_K8S_102 | resource | PodTemplate | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 617 | CKV_K8S_102 | resource | ReplicaSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 618 | CKV_K8S_102 | resource | ReplicationController | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 619 | CKV_K8S_102 | resource | StatefulSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 620 | CKV_K8S_104 | resource | CronJob | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 621 | CKV_K8S_104 | resource | DaemonSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 622 | CKV_K8S_104 | resource | Deployment | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 623 | CKV_K8S_104 | resource | DeploymentConfig | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 624 | CKV_K8S_104 | resource | Job | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 625 | CKV_K8S_104 | resource | Pod | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 626 | CKV_K8S_104 | resource | PodTemplate | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 627 | CKV_K8S_104 | resource | ReplicaSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 628 | CKV_K8S_104 | resource | ReplicationController | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 629 | CKV_K8S_104 | resource | StatefulSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 630 | CKV_K8S_105 | resource | CronJob | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 631 | CKV_K8S_105 | resource | DaemonSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 632 | CKV_K8S_105 | resource | Deployment | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 633 | CKV_K8S_105 | resource | DeploymentConfig | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 634 | CKV_K8S_105 | resource | Job | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 635 | CKV_K8S_105 | resource | Pod | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 636 | CKV_K8S_105 | resource | PodTemplate | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 637 | CKV_K8S_105 | resource | ReplicaSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 638 | CKV_K8S_105 | resource | ReplicationController | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 639 | CKV_K8S_105 | resource | StatefulSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 640 | CKV_K8S_106 | resource | CronJob | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 641 | CKV_K8S_106 | resource | DaemonSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 642 | CKV_K8S_106 | resource | Deployment | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 643 | CKV_K8S_106 | resource | DeploymentConfig | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 644 | CKV_K8S_106 | resource | Job | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 645 | CKV_K8S_106 | resource | Pod | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 646 | CKV_K8S_106 | resource | PodTemplate | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 647 | CKV_K8S_106 | resource | ReplicaSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 648 | CKV_K8S_106 | resource | ReplicationController | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 649 | CKV_K8S_106 | resource | StatefulSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 650 | CKV_K8S_107 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 651 | CKV_K8S_107 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 652 | CKV_K8S_107 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 653 | CKV_K8S_107 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 654 | CKV_K8S_107 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 655 | CKV_K8S_107 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 656 | CKV_K8S_107 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 657 | CKV_K8S_107 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 658 | CKV_K8S_107 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 659 | CKV_K8S_107 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 660 | CKV_K8S_108 | resource | CronJob | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 661 | CKV_K8S_108 | resource | DaemonSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 662 | CKV_K8S_108 | resource | Deployment | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 663 | CKV_K8S_108 | resource | DeploymentConfig | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 664 | CKV_K8S_108 | resource | Job | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 665 | CKV_K8S_108 | resource | Pod | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 666 | CKV_K8S_108 | resource | PodTemplate | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 667 | CKV_K8S_108 | resource | ReplicaSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 668 | CKV_K8S_108 | resource | ReplicationController | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 669 | CKV_K8S_108 | resource | StatefulSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 670 | CKV_K8S_110 | resource | CronJob | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 671 | CKV_K8S_110 | resource | DaemonSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 672 | CKV_K8S_110 | resource | Deployment | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 673 | CKV_K8S_110 | resource | DeploymentConfig | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 674 | CKV_K8S_110 | resource | Job | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 675 | CKV_K8S_110 | resource | Pod | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 676 | CKV_K8S_110 | resource | PodTemplate | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 677 | CKV_K8S_110 | resource | ReplicaSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 678 | CKV_K8S_110 | resource | ReplicationController | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 679 | CKV_K8S_110 | resource | StatefulSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 680 | CKV_K8S_111 | resource | CronJob | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 681 | CKV_K8S_111 | resource | DaemonSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 682 | CKV_K8S_111 | resource | Deployment | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 683 | CKV_K8S_111 | resource | DeploymentConfig | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 684 | CKV_K8S_111 | resource | Job | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 685 | CKV_K8S_111 | resource | Pod | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 686 | CKV_K8S_111 | resource | PodTemplate | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 687 | CKV_K8S_111 | resource | ReplicaSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 688 | CKV_K8S_111 | resource | ReplicationController | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 689 | CKV_K8S_111 | resource | StatefulSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 690 | CKV_K8S_112 | resource | CronJob | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 691 | CKV_K8S_112 | resource | DaemonSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 692 | CKV_K8S_112 | resource | Deployment | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 693 | CKV_K8S_112 | resource | DeploymentConfig | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 694 | CKV_K8S_112 | resource | Job | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 695 | CKV_K8S_112 | resource | Pod | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 696 | CKV_K8S_112 | resource | PodTemplate | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 697 | CKV_K8S_112 | resource | ReplicaSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 698 | CKV_K8S_112 | resource | ReplicationController | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 699 | CKV_K8S_112 | resource | StatefulSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 700 | CKV_K8S_113 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 701 | CKV_K8S_113 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 702 | CKV_K8S_113 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 703 | CKV_K8S_113 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 704 | CKV_K8S_113 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 705 | CKV_K8S_113 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 706 | CKV_K8S_113 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 707 | CKV_K8S_113 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 708 | CKV_K8S_113 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 709 | CKV_K8S_113 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 710 | CKV_K8S_114 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 711 | CKV_K8S_114 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 712 | CKV_K8S_114 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 713 | CKV_K8S_114 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 714 | CKV_K8S_114 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 715 | CKV_K8S_114 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 716 | CKV_K8S_114 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 717 | CKV_K8S_114 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 718 | CKV_K8S_114 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 719 | CKV_K8S_114 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 720 | CKV_K8S_115 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 721 | CKV_K8S_115 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 722 | CKV_K8S_115 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 723 | CKV_K8S_115 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 724 | CKV_K8S_115 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 725 | CKV_K8S_115 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 726 | CKV_K8S_115 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 727 | CKV_K8S_115 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 728 | CKV_K8S_115 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 729 | CKV_K8S_115 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 730 | CKV_K8S_116 | resource | CronJob | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 731 | CKV_K8S_116 | resource | DaemonSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 732 | CKV_K8S_116 | resource | Deployment | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 733 | CKV_K8S_116 | resource | DeploymentConfig | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 734 | CKV_K8S_116 | resource | Job | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 735 | CKV_K8S_116 | resource | Pod | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 736 | CKV_K8S_116 | resource | PodTemplate | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 737 | CKV_K8S_116 | resource | ReplicaSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 738 | CKV_K8S_116 | resource | ReplicationController | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 739 | CKV_K8S_116 | resource | StatefulSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 740 | CKV_K8S_117 | resource | CronJob | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 741 | CKV_K8S_117 | resource | DaemonSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 742 | CKV_K8S_117 | resource | Deployment | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 743 | CKV_K8S_117 | resource | DeploymentConfig | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 744 | CKV_K8S_117 | resource | Job | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 745 | CKV_K8S_117 | resource | Pod | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 746 | CKV_K8S_117 | resource | PodTemplate | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 747 | CKV_K8S_117 | resource | ReplicaSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 748 | CKV_K8S_117 | resource | ReplicationController | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 749 | CKV_K8S_117 | resource | StatefulSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 750 | CKV_K8S_118 | resource | CronJob | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 751 | CKV_K8S_118 | resource | DaemonSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 752 | CKV_K8S_118 | resource | Deployment | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 753 | CKV_K8S_118 | resource | DeploymentConfig | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 754 | CKV_K8S_118 | resource | Job | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 755 | CKV_K8S_118 | resource | Pod | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 756 | CKV_K8S_118 | resource | PodTemplate | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 757 | CKV_K8S_118 | resource | ReplicaSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 758 | CKV_K8S_118 | resource | ReplicationController | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 759 | CKV_K8S_118 | resource | StatefulSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 760 | CKV_K8S_119 | resource | CronJob | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 761 | CKV_K8S_119 | resource | DaemonSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 762 | CKV_K8S_119 | resource | Deployment | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 763 | CKV_K8S_119 | resource | DeploymentConfig | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 764 | CKV_K8S_119 | resource | Job | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 765 | CKV_K8S_119 | resource | Pod | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 766 | CKV_K8S_119 | resource | PodTemplate | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 767 | CKV_K8S_119 | resource | ReplicaSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 768 | CKV_K8S_119 | resource | ReplicationController | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 769 | CKV_K8S_119 | resource | StatefulSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 770 | CKV_K8S_121 | resource | Pod | Ensure that the --peer-client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 771 | CKV_K8S_138 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 772 | CKV_K8S_138 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 773 | CKV_K8S_138 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 774 | CKV_K8S_138 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 775 | CKV_K8S_138 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 776 | CKV_K8S_138 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 777 | CKV_K8S_138 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 778 | CKV_K8S_138 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 779 | CKV_K8S_138 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 780 | CKV_K8S_138 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 781 | CKV_K8S_139 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 782 | CKV_K8S_139 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 783 | CKV_K8S_139 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 784 | CKV_K8S_139 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 785 | CKV_K8S_139 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 786 | CKV_K8S_139 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 787 | CKV_K8S_139 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 788 | CKV_K8S_139 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 789 | CKV_K8S_139 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 790 | CKV_K8S_139 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 791 | CKV_K8S_140 | resource | CronJob | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 792 | CKV_K8S_140 | resource | DaemonSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 793 | CKV_K8S_140 | resource | Deployment | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 794 | CKV_K8S_140 | resource | DeploymentConfig | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 795 | CKV_K8S_140 | resource | Job | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 796 | CKV_K8S_140 | resource | Pod | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 797 | CKV_K8S_140 | resource | PodTemplate | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 798 | CKV_K8S_140 | resource | ReplicaSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 799 | CKV_K8S_140 | resource | ReplicationController | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 800 | CKV_K8S_140 | resource | StatefulSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 801 | CKV_K8S_141 | resource | CronJob | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 802 | CKV_K8S_141 | resource | DaemonSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 803 | CKV_K8S_141 | resource | Deployment | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 804 | CKV_K8S_141 | resource | DeploymentConfig | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 805 | CKV_K8S_141 | resource | Job | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 806 | CKV_K8S_141 | resource | Pod | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 807 | CKV_K8S_141 | resource | PodTemplate | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 808 | CKV_K8S_141 | resource | ReplicaSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 809 | CKV_K8S_141 | resource | ReplicationController | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 810 | CKV_K8S_141 | resource | StatefulSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 811 | CKV_K8S_143 | resource | CronJob | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 812 | CKV_K8S_143 | resource | DaemonSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 813 | CKV_K8S_143 | resource | Deployment | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 814 | CKV_K8S_143 | resource | DeploymentConfig | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 815 | CKV_K8S_143 | resource | Job | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 816 | CKV_K8S_143 | resource | Pod | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 817 | CKV_K8S_143 | resource | PodTemplate | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 818 | CKV_K8S_143 | resource | ReplicaSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 819 | CKV_K8S_143 | resource | ReplicationController | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 820 | CKV_K8S_143 | resource | StatefulSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 821 | CKV_K8S_144 | resource | CronJob | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 822 | CKV_K8S_144 | resource | DaemonSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 823 | CKV_K8S_144 | resource | Deployment | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 824 | CKV_K8S_144 | resource | DeploymentConfig | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 825 | CKV_K8S_144 | resource | Job | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 826 | CKV_K8S_144 | resource | Pod | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 827 | CKV_K8S_144 | resource | PodTemplate | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 828 | CKV_K8S_144 | resource | ReplicaSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 829 | CKV_K8S_144 | resource | ReplicationController | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 830 | CKV_K8S_144 | resource | StatefulSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 831 | CKV_K8S_145 | resource | CronJob | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 832 | CKV_K8S_145 | resource | DaemonSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 833 | CKV_K8S_145 | resource | Deployment | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 834 | CKV_K8S_145 | resource | DeploymentConfig | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 835 | CKV_K8S_145 | resource | Job | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 836 | CKV_K8S_145 | resource | Pod | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 837 | CKV_K8S_145 | resource | PodTemplate | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 838 | CKV_K8S_145 | resource | ReplicaSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 839 | CKV_K8S_145 | resource | ReplicationController | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 840 | CKV_K8S_145 | resource | StatefulSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 841 | CKV_K8S_146 | resource | CronJob | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 842 | CKV_K8S_146 | resource | DaemonSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 843 | CKV_K8S_146 | resource | Deployment | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 844 | CKV_K8S_146 | resource | DeploymentConfig | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 845 | CKV_K8S_146 | resource | Job | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 846 | CKV_K8S_146 | resource | Pod | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 847 | CKV_K8S_146 | resource | PodTemplate | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 848 | CKV_K8S_146 | resource | ReplicaSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 849 | CKV_K8S_146 | resource | ReplicationController | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 850 | CKV_K8S_146 | resource | StatefulSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 851 | CKV_K8S_147 | resource | CronJob | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 852 | CKV_K8S_147 | resource | DaemonSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 853 | CKV_K8S_147 | resource | Deployment | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 854 | CKV_K8S_147 | resource | DeploymentConfig | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 855 | CKV_K8S_147 | resource | Job | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 856 | CKV_K8S_147 | resource | Pod | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 857 | CKV_K8S_147 | resource | PodTemplate | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 858 | CKV_K8S_147 | resource | ReplicaSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 859 | CKV_K8S_147 | resource | ReplicationController | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 860 | CKV_K8S_147 | resource | StatefulSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 861 | CKV_K8S_148 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 862 | CKV_K8S_148 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 863 | CKV_K8S_148 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 864 | CKV_K8S_148 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 865 | CKV_K8S_148 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 866 | CKV_K8S_148 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 867 | CKV_K8S_148 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 868 | CKV_K8S_148 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 869 | CKV_K8S_148 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 870 | CKV_K8S_148 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 871 | CKV_K8S_149 | resource | CronJob | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 872 | CKV_K8S_149 | resource | DaemonSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 873 | CKV_K8S_149 | resource | Deployment | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 874 | CKV_K8S_149 | resource | DeploymentConfig | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 875 | CKV_K8S_149 | resource | Job | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 876 | CKV_K8S_149 | resource | Pod | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 877 | CKV_K8S_149 | resource | PodTemplate | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 878 | CKV_K8S_149 | resource | ReplicaSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 879 | CKV_K8S_149 | resource | ReplicationController | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 880 | CKV_K8S_149 | resource | StatefulSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 881 | CKV_K8S_151 | resource | CronJob | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 882 | CKV_K8S_151 | resource | DaemonSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 883 | CKV_K8S_151 | resource | Deployment | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 884 | CKV_K8S_151 | resource | DeploymentConfig | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 885 | CKV_K8S_151 | resource | Job | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 886 | CKV_K8S_151 | resource | Pod | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 887 | CKV_K8S_151 | resource | PodTemplate | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 888 | CKV_K8S_151 | resource | ReplicaSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 889 | CKV_K8S_151 | resource | ReplicationController | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 890 | CKV_K8S_151 | resource | StatefulSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 891 | CKV_K8S_152 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 892 | CKV_K8S_153 | resource | Ingress | Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 893 | CKV_K8S_154 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 894 | CKV_K8S_155 | resource | ClusterRole | Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 895 | CKV_K8S_156 | resource | ClusterRole | Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 896 | CKV_K8S_157 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 897 | CKV_K8S_157 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 898 | CKV_K8S_158 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 899 | CKV_K8S_158 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|-----|-------------|----------|------------------------|--------------------------------------------------------------------------------------------------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_K8S_1 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPIDPSP.py | +| 1 | CKV_K8S_2 | resource | PodSecurityPolicy | Do not admit privileged containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainersPSP.py | +| 2 | CKV_K8S_3 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPCPSP.py | +| 3 | CKV_K8S_4 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespacePSP.py | +| 4 | CKV_K8S_5 | resource | PodSecurityPolicy | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalationPSP.py | +| 5 | CKV_K8S_6 | resource | PodSecurityPolicy | Do not admit root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersPSP.py | +| 6 | CKV_K8S_7 | resource | PodSecurityPolicy | Do not admit containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilitiesPSP.py | +| 7 | CKV_K8S_8 | resource | DaemonSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 8 | CKV_K8S_8 | resource | Deployment | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 9 | CKV_K8S_8 | resource | DeploymentConfig | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 10 | CKV_K8S_8 | resource | Pod | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 11 | CKV_K8S_8 | resource | PodTemplate | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 12 | CKV_K8S_8 | resource | ReplicaSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 13 | CKV_K8S_8 | resource | ReplicationController | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 14 | CKV_K8S_8 | resource | StatefulSet | Liveness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py | +| 15 | CKV_K8S_9 | resource | DaemonSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 16 | CKV_K8S_9 | resource | Deployment | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 17 | CKV_K8S_9 | resource | DeploymentConfig | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 18 | CKV_K8S_9 | resource | Pod | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 19 | CKV_K8S_9 | resource | PodTemplate | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 20 | CKV_K8S_9 | resource | ReplicaSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 21 | CKV_K8S_9 | resource | ReplicationController | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 22 | CKV_K8S_9 | resource | StatefulSet | Readiness Probe Should be Configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py | +| 23 | CKV_K8S_10 | resource | CronJob | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 24 | CKV_K8S_10 | resource | DaemonSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 25 | CKV_K8S_10 | resource | Deployment | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 26 | CKV_K8S_10 | resource | DeploymentConfig | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 27 | CKV_K8S_10 | resource | Job | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 28 | CKV_K8S_10 | resource | Pod | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 29 | CKV_K8S_10 | resource | PodTemplate | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 30 | CKV_K8S_10 | resource | ReplicaSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 31 | CKV_K8S_10 | resource | ReplicationController | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 32 | CKV_K8S_10 | resource | StatefulSet | CPU requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPURequests.py | +| 33 | CKV_K8S_11 | resource | CronJob | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 34 | CKV_K8S_11 | resource | DaemonSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 35 | CKV_K8S_11 | resource | Deployment | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 36 | CKV_K8S_11 | resource | DeploymentConfig | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 37 | CKV_K8S_11 | resource | Job | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 38 | CKV_K8S_11 | resource | Pod | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 39 | CKV_K8S_11 | resource | PodTemplate | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 40 | CKV_K8S_11 | resource | ReplicaSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 41 | CKV_K8S_11 | resource | ReplicationController | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 42 | CKV_K8S_11 | resource | StatefulSet | CPU limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/CPULimits.py | +| 43 | CKV_K8S_12 | resource | CronJob | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 44 | CKV_K8S_12 | resource | DaemonSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 45 | CKV_K8S_12 | resource | Deployment | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 46 | CKV_K8S_12 | resource | DeploymentConfig | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 47 | CKV_K8S_12 | resource | Job | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 48 | CKV_K8S_12 | resource | Pod | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 49 | CKV_K8S_12 | resource | PodTemplate | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 50 | CKV_K8S_12 | resource | ReplicaSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 51 | CKV_K8S_12 | resource | ReplicationController | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 52 | CKV_K8S_12 | resource | StatefulSet | Memory requests should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py | +| 53 | CKV_K8S_13 | resource | CronJob | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 54 | CKV_K8S_13 | resource | DaemonSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 55 | CKV_K8S_13 | resource | Deployment | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 56 | CKV_K8S_13 | resource | DeploymentConfig | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 57 | CKV_K8S_13 | resource | Job | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 58 | CKV_K8S_13 | resource | Pod | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 59 | CKV_K8S_13 | resource | PodTemplate | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 60 | CKV_K8S_13 | resource | ReplicaSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 61 | CKV_K8S_13 | resource | ReplicationController | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 62 | CKV_K8S_13 | resource | StatefulSet | Memory limits should be set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py | +| 63 | CKV_K8S_14 | resource | CronJob | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 64 | CKV_K8S_14 | resource | DaemonSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 65 | CKV_K8S_14 | resource | Deployment | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 66 | CKV_K8S_14 | resource | DeploymentConfig | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 67 | CKV_K8S_14 | resource | Job | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 68 | CKV_K8S_14 | resource | Pod | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 69 | CKV_K8S_14 | resource | PodTemplate | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 70 | CKV_K8S_14 | resource | ReplicaSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 71 | CKV_K8S_14 | resource | ReplicationController | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 72 | CKV_K8S_14 | resource | StatefulSet | Image Tag should be fixed - not latest or blank | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py | +| 73 | CKV_K8S_15 | resource | CronJob | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 74 | CKV_K8S_15 | resource | DaemonSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 75 | CKV_K8S_15 | resource | Deployment | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 76 | CKV_K8S_15 | resource | DeploymentConfig | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 77 | CKV_K8S_15 | resource | Job | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 78 | CKV_K8S_15 | resource | Pod | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 79 | CKV_K8S_15 | resource | PodTemplate | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 80 | CKV_K8S_15 | resource | ReplicaSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 81 | CKV_K8S_15 | resource | ReplicationController | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 82 | CKV_K8S_15 | resource | StatefulSet | Image Pull Policy should be Always | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py | +| 83 | CKV_K8S_16 | resource | CronJob | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 84 | CKV_K8S_16 | resource | DaemonSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 85 | CKV_K8S_16 | resource | Deployment | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 86 | CKV_K8S_16 | resource | DeploymentConfig | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 87 | CKV_K8S_16 | resource | Job | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 88 | CKV_K8S_16 | resource | Pod | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 89 | CKV_K8S_16 | resource | PodTemplate | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 90 | CKV_K8S_16 | resource | ReplicaSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 91 | CKV_K8S_16 | resource | ReplicationController | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 92 | CKV_K8S_16 | resource | StatefulSet | Container should not be privileged | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py | +| 93 | CKV_K8S_17 | resource | CronJob | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 94 | CKV_K8S_17 | resource | DaemonSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 95 | CKV_K8S_17 | resource | Deployment | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 96 | CKV_K8S_17 | resource | Job | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 97 | CKV_K8S_17 | resource | Pod | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 98 | CKV_K8S_17 | resource | ReplicaSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 99 | CKV_K8S_17 | resource | ReplicationController | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 100 | CKV_K8S_17 | resource | StatefulSet | Containers should not share the host process ID namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py | +| 101 | CKV_K8S_18 | resource | CronJob | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 102 | CKV_K8S_18 | resource | DaemonSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 103 | CKV_K8S_18 | resource | Deployment | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 104 | CKV_K8S_18 | resource | Job | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 105 | CKV_K8S_18 | resource | Pod | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 106 | CKV_K8S_18 | resource | ReplicaSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 107 | CKV_K8S_18 | resource | ReplicationController | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 108 | CKV_K8S_18 | resource | StatefulSet | Containers should not share the host IPC namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py | +| 109 | CKV_K8S_19 | resource | CronJob | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 110 | CKV_K8S_19 | resource | DaemonSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 111 | CKV_K8S_19 | resource | Deployment | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 112 | CKV_K8S_19 | resource | Job | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 113 | CKV_K8S_19 | resource | Pod | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 114 | CKV_K8S_19 | resource | ReplicaSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 115 | CKV_K8S_19 | resource | ReplicationController | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 116 | CKV_K8S_19 | resource | StatefulSet | Containers should not share the host network namespace | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py | +| 117 | CKV_K8S_20 | resource | CronJob | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 118 | CKV_K8S_20 | resource | DaemonSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 119 | CKV_K8S_20 | resource | Deployment | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 120 | CKV_K8S_20 | resource | DeploymentConfig | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 121 | CKV_K8S_20 | resource | Job | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 122 | CKV_K8S_20 | resource | Pod | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 123 | CKV_K8S_20 | resource | PodTemplate | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 124 | CKV_K8S_20 | resource | ReplicaSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 125 | CKV_K8S_20 | resource | ReplicationController | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 126 | CKV_K8S_20 | resource | StatefulSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py | +| 127 | CKV_K8S_21 | resource | ConfigMap | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 128 | CKV_K8S_21 | resource | CronJob | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 129 | CKV_K8S_21 | resource | DaemonSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 130 | CKV_K8S_21 | resource | Deployment | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 131 | CKV_K8S_21 | resource | Ingress | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 132 | CKV_K8S_21 | resource | Job | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 133 | CKV_K8S_21 | resource | Pod | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 134 | CKV_K8S_21 | resource | ReplicaSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 135 | CKV_K8S_21 | resource | ReplicationController | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 136 | CKV_K8S_21 | resource | Role | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 137 | CKV_K8S_21 | resource | RoleBinding | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 138 | CKV_K8S_21 | resource | Secret | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 139 | CKV_K8S_21 | resource | Service | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 140 | CKV_K8S_21 | resource | ServiceAccount | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 141 | CKV_K8S_21 | resource | StatefulSet | The default namespace should not be used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py | +| 142 | CKV_K8S_22 | resource | CronJob | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 143 | CKV_K8S_22 | resource | DaemonSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 144 | CKV_K8S_22 | resource | Deployment | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 145 | CKV_K8S_22 | resource | DeploymentConfig | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 146 | CKV_K8S_22 | resource | Job | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 147 | CKV_K8S_22 | resource | Pod | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 148 | CKV_K8S_22 | resource | PodTemplate | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 149 | CKV_K8S_22 | resource | ReplicaSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 150 | CKV_K8S_22 | resource | ReplicationController | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 151 | CKV_K8S_22 | resource | StatefulSet | Use read-only filesystem for containers where possible | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py | +| 152 | CKV_K8S_23 | resource | CronJob | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 153 | CKV_K8S_23 | resource | DaemonSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 154 | CKV_K8S_23 | resource | Deployment | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 155 | CKV_K8S_23 | resource | Job | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 156 | CKV_K8S_23 | resource | Pod | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 157 | CKV_K8S_23 | resource | ReplicaSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 158 | CKV_K8S_23 | resource | ReplicationController | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 159 | CKV_K8S_23 | resource | StatefulSet | Minimize the admission of root containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainers.py | +| 160 | CKV_K8S_24 | resource | PodSecurityPolicy | Do not allow containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesPSP.py | +| 161 | CKV_K8S_25 | resource | CronJob | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 162 | CKV_K8S_25 | resource | DaemonSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 163 | CKV_K8S_25 | resource | Deployment | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 164 | CKV_K8S_25 | resource | DeploymentConfig | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 165 | CKV_K8S_25 | resource | Job | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 166 | CKV_K8S_25 | resource | Pod | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 167 | CKV_K8S_25 | resource | PodTemplate | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 168 | CKV_K8S_25 | resource | ReplicaSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 169 | CKV_K8S_25 | resource | ReplicationController | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 170 | CKV_K8S_25 | resource | StatefulSet | Minimize the admission of containers with added capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py | +| 171 | CKV_K8S_26 | resource | CronJob | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 172 | CKV_K8S_26 | resource | DaemonSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 173 | CKV_K8S_26 | resource | Deployment | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 174 | CKV_K8S_26 | resource | DeploymentConfig | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 175 | CKV_K8S_26 | resource | Job | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 176 | CKV_K8S_26 | resource | Pod | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 177 | CKV_K8S_26 | resource | PodTemplate | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 178 | CKV_K8S_26 | resource | ReplicaSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 179 | CKV_K8S_26 | resource | ReplicationController | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 180 | CKV_K8S_26 | resource | StatefulSet | Do not specify hostPort unless absolutely necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/HostPort.py | +| 181 | CKV_K8S_27 | resource | CronJob | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 182 | CKV_K8S_27 | resource | DaemonSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 183 | CKV_K8S_27 | resource | Deployment | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 184 | CKV_K8S_27 | resource | Job | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 185 | CKV_K8S_27 | resource | Pod | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 186 | CKV_K8S_27 | resource | ReplicaSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 187 | CKV_K8S_27 | resource | ReplicationController | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 188 | CKV_K8S_27 | resource | StatefulSet | Do not expose the docker daemon socket to containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py | +| 189 | CKV_K8S_28 | resource | CronJob | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 190 | CKV_K8S_28 | resource | DaemonSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 191 | CKV_K8S_28 | resource | Deployment | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 192 | CKV_K8S_28 | resource | DeploymentConfig | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 193 | CKV_K8S_28 | resource | Job | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 194 | CKV_K8S_28 | resource | Pod | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 195 | CKV_K8S_28 | resource | PodTemplate | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 196 | CKV_K8S_28 | resource | ReplicaSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 197 | CKV_K8S_28 | resource | ReplicationController | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 198 | CKV_K8S_28 | resource | StatefulSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py | +| 199 | CKV_K8S_29 | resource | CronJob | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 200 | CKV_K8S_29 | resource | DaemonSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 201 | CKV_K8S_29 | resource | Deployment | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 202 | CKV_K8S_29 | resource | Job | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 203 | CKV_K8S_29 | resource | Pod | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 204 | CKV_K8S_29 | resource | ReplicaSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 205 | CKV_K8S_29 | resource | ReplicationController | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 206 | CKV_K8S_29 | resource | StatefulSet | Apply security context to your pods and containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py | +| 207 | CKV_K8S_30 | resource | CronJob | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 208 | CKV_K8S_30 | resource | DaemonSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 209 | CKV_K8S_30 | resource | Deployment | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 210 | CKV_K8S_30 | resource | DeploymentConfig | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 211 | CKV_K8S_30 | resource | Job | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 212 | CKV_K8S_30 | resource | Pod | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 213 | CKV_K8S_30 | resource | PodTemplate | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 214 | CKV_K8S_30 | resource | ReplicaSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 215 | CKV_K8S_30 | resource | ReplicationController | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 216 | CKV_K8S_30 | resource | StatefulSet | Apply security context to your containers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py | +| 217 | CKV_K8S_31 | resource | CronJob | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 218 | CKV_K8S_31 | resource | DaemonSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 219 | CKV_K8S_31 | resource | Deployment | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 220 | CKV_K8S_31 | resource | Job | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 221 | CKV_K8S_31 | resource | Pod | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 222 | CKV_K8S_31 | resource | ReplicaSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 223 | CKV_K8S_31 | resource | ReplicationController | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 224 | CKV_K8S_31 | resource | StatefulSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Seccomp.py | +| 225 | CKV_K8S_32 | resource | PodSecurityPolicy | Ensure default seccomp profile set to docker/default or runtime/default | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SeccompPSP.py | +| 226 | CKV_K8S_33 | resource | CronJob | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 227 | CKV_K8S_33 | resource | DaemonSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 228 | CKV_K8S_33 | resource | Deployment | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 229 | CKV_K8S_33 | resource | DeploymentConfig | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 230 | CKV_K8S_33 | resource | Job | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 231 | CKV_K8S_33 | resource | Pod | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 232 | CKV_K8S_33 | resource | PodTemplate | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 233 | CKV_K8S_33 | resource | ReplicaSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 234 | CKV_K8S_33 | resource | ReplicationController | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 235 | CKV_K8S_33 | resource | StatefulSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py | +| 236 | CKV_K8S_34 | resource | CronJob | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 237 | CKV_K8S_34 | resource | DaemonSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 238 | CKV_K8S_34 | resource | Deployment | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 239 | CKV_K8S_34 | resource | DeploymentConfig | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 240 | CKV_K8S_34 | resource | Job | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 241 | CKV_K8S_34 | resource | Pod | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 242 | CKV_K8S_34 | resource | PodTemplate | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 243 | CKV_K8S_34 | resource | ReplicaSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 244 | CKV_K8S_34 | resource | ReplicationController | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 245 | CKV_K8S_34 | resource | StatefulSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Tiller.py | +| 246 | CKV_K8S_35 | resource | CronJob | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 247 | CKV_K8S_35 | resource | DaemonSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 248 | CKV_K8S_35 | resource | Deployment | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 249 | CKV_K8S_35 | resource | DeploymentConfig | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 250 | CKV_K8S_35 | resource | Job | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 251 | CKV_K8S_35 | resource | Pod | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 252 | CKV_K8S_35 | resource | PodTemplate | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 253 | CKV_K8S_35 | resource | ReplicaSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 254 | CKV_K8S_35 | resource | ReplicationController | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 255 | CKV_K8S_35 | resource | StatefulSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/Secrets.py | +| 256 | CKV_K8S_36 | resource | PodSecurityPolicy | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilitiesPSP.py | +| 257 | CKV_K8S_37 | resource | CronJob | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 258 | CKV_K8S_37 | resource | DaemonSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 259 | CKV_K8S_37 | resource | Deployment | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 260 | CKV_K8S_37 | resource | DeploymentConfig | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 261 | CKV_K8S_37 | resource | Job | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 262 | CKV_K8S_37 | resource | Pod | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 263 | CKV_K8S_37 | resource | PodTemplate | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 264 | CKV_K8S_37 | resource | ReplicaSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 265 | CKV_K8S_37 | resource | ReplicationController | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 266 | CKV_K8S_37 | resource | StatefulSet | Minimize the admission of containers with capabilities assigned | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py | +| 267 | CKV_K8S_38 | resource | CronJob | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 268 | CKV_K8S_38 | resource | DaemonSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 269 | CKV_K8S_38 | resource | Deployment | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 270 | CKV_K8S_38 | resource | Job | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 271 | CKV_K8S_38 | resource | Pod | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 272 | CKV_K8S_38 | resource | ReplicaSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 273 | CKV_K8S_38 | resource | ReplicationController | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 274 | CKV_K8S_38 | resource | StatefulSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py | +| 275 | CKV_K8S_39 | resource | CronJob | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 276 | CKV_K8S_39 | resource | DaemonSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 277 | CKV_K8S_39 | resource | Deployment | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 278 | CKV_K8S_39 | resource | DeploymentConfig | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 279 | CKV_K8S_39 | resource | Job | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 280 | CKV_K8S_39 | resource | Pod | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 281 | CKV_K8S_39 | resource | PodTemplate | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 282 | CKV_K8S_39 | resource | ReplicaSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 283 | CKV_K8S_39 | resource | ReplicationController | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 284 | CKV_K8S_39 | resource | StatefulSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py | +| 285 | CKV_K8S_40 | resource | CronJob | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 286 | CKV_K8S_40 | resource | DaemonSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 287 | CKV_K8S_40 | resource | Deployment | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 288 | CKV_K8S_40 | resource | Job | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 289 | CKV_K8S_40 | resource | Pod | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 290 | CKV_K8S_40 | resource | ReplicaSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 291 | CKV_K8S_40 | resource | ReplicationController | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 292 | CKV_K8S_40 | resource | StatefulSet | Containers should run as a high UID to avoid host conflict | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py | +| 293 | CKV_K8S_41 | resource | ServiceAccount | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccount.py | +| 294 | CKV_K8S_42 | resource | ClusterRoleBinding | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py | +| 295 | CKV_K8S_42 | resource | RoleBinding | Ensure that default service accounts are not actively used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py | +| 296 | CKV_K8S_43 | resource | CronJob | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 297 | CKV_K8S_43 | resource | DaemonSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 298 | CKV_K8S_43 | resource | Deployment | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 299 | CKV_K8S_43 | resource | DeploymentConfig | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 300 | CKV_K8S_43 | resource | Job | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 301 | CKV_K8S_43 | resource | Pod | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 302 | CKV_K8S_43 | resource | PodTemplate | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 303 | CKV_K8S_43 | resource | ReplicaSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 304 | CKV_K8S_43 | resource | ReplicationController | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 305 | CKV_K8S_43 | resource | StatefulSet | Image should use digest | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ImageDigest.py | +| 306 | CKV_K8S_44 | resource | Service | Ensure that the Tiller Service (Helm v2) is deleted | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerService.py | +| 307 | CKV_K8S_45 | resource | CronJob | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 308 | CKV_K8S_45 | resource | DaemonSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 309 | CKV_K8S_45 | resource | Deployment | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 310 | CKV_K8S_45 | resource | DeploymentConfig | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 311 | CKV_K8S_45 | resource | Job | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 312 | CKV_K8S_45 | resource | Pod | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 313 | CKV_K8S_45 | resource | PodTemplate | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 314 | CKV_K8S_45 | resource | ReplicaSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 315 | CKV_K8S_45 | resource | ReplicationController | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 316 | CKV_K8S_45 | resource | StatefulSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py | +| 317 | CKV_K8S_49 | resource | ClusterRole | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/WildcardRoles.py | +| 318 | CKV_K8S_49 | resource | Role | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/WildcardRoles.py | +| 319 | CKV_K8S_68 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 320 | CKV_K8S_68 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 321 | CKV_K8S_68 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 322 | CKV_K8S_68 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 323 | CKV_K8S_68 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 324 | CKV_K8S_68 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 325 | CKV_K8S_68 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 326 | CKV_K8S_68 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 327 | CKV_K8S_68 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 328 | CKV_K8S_68 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py | +| 329 | CKV_K8S_69 | resource | CronJob | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 330 | CKV_K8S_69 | resource | DaemonSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 331 | CKV_K8S_69 | resource | Deployment | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 332 | CKV_K8S_69 | resource | DeploymentConfig | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 333 | CKV_K8S_69 | resource | Job | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 334 | CKV_K8S_69 | resource | Pod | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 335 | CKV_K8S_69 | resource | PodTemplate | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 336 | CKV_K8S_69 | resource | ReplicaSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 337 | CKV_K8S_69 | resource | ReplicationController | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 338 | CKV_K8S_69 | resource | StatefulSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py | +| 339 | CKV_K8S_70 | resource | CronJob | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 340 | CKV_K8S_70 | resource | DaemonSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 341 | CKV_K8S_70 | resource | Deployment | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 342 | CKV_K8S_70 | resource | DeploymentConfig | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 343 | CKV_K8S_70 | resource | Job | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 344 | CKV_K8S_70 | resource | Pod | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 345 | CKV_K8S_70 | resource | PodTemplate | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 346 | CKV_K8S_70 | resource | ReplicaSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 347 | CKV_K8S_70 | resource | ReplicationController | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 348 | CKV_K8S_70 | resource | StatefulSet | Ensure that the --token-auth-file argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py | +| 349 | CKV_K8S_71 | resource | CronJob | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 350 | CKV_K8S_71 | resource | DaemonSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 351 | CKV_K8S_71 | resource | Deployment | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 352 | CKV_K8S_71 | resource | DeploymentConfig | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 353 | CKV_K8S_71 | resource | Job | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 354 | CKV_K8S_71 | resource | Pod | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 355 | CKV_K8S_71 | resource | PodTemplate | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 356 | CKV_K8S_71 | resource | ReplicaSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 357 | CKV_K8S_71 | resource | ReplicationController | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 358 | CKV_K8S_71 | resource | StatefulSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py | +| 359 | CKV_K8S_72 | resource | CronJob | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 360 | CKV_K8S_72 | resource | DaemonSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 361 | CKV_K8S_72 | resource | Deployment | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 362 | CKV_K8S_72 | resource | DeploymentConfig | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 363 | CKV_K8S_72 | resource | Job | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 364 | CKV_K8S_72 | resource | Pod | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 365 | CKV_K8S_72 | resource | PodTemplate | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 366 | CKV_K8S_72 | resource | ReplicaSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 367 | CKV_K8S_72 | resource | ReplicationController | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 368 | CKV_K8S_72 | resource | StatefulSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py | +| 369 | CKV_K8S_73 | resource | CronJob | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 370 | CKV_K8S_73 | resource | DaemonSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 371 | CKV_K8S_73 | resource | Deployment | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 372 | CKV_K8S_73 | resource | DeploymentConfig | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 373 | CKV_K8S_73 | resource | Job | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 374 | CKV_K8S_73 | resource | Pod | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 375 | CKV_K8S_73 | resource | PodTemplate | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 376 | CKV_K8S_73 | resource | ReplicaSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 377 | CKV_K8S_73 | resource | ReplicationController | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 378 | CKV_K8S_73 | resource | StatefulSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py | +| 379 | CKV_K8S_74 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 380 | CKV_K8S_74 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 381 | CKV_K8S_74 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 382 | CKV_K8S_74 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 383 | CKV_K8S_74 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 384 | CKV_K8S_74 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 385 | CKV_K8S_74 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 386 | CKV_K8S_74 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 387 | CKV_K8S_74 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 388 | CKV_K8S_74 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py | +| 389 | CKV_K8S_75 | resource | CronJob | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 390 | CKV_K8S_75 | resource | DaemonSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 391 | CKV_K8S_75 | resource | Deployment | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 392 | CKV_K8S_75 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 393 | CKV_K8S_75 | resource | Job | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 394 | CKV_K8S_75 | resource | Pod | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 395 | CKV_K8S_75 | resource | PodTemplate | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 396 | CKV_K8S_75 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 397 | CKV_K8S_75 | resource | ReplicationController | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 398 | CKV_K8S_75 | resource | StatefulSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py | +| 399 | CKV_K8S_77 | resource | CronJob | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 400 | CKV_K8S_77 | resource | DaemonSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 401 | CKV_K8S_77 | resource | Deployment | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 402 | CKV_K8S_77 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 403 | CKV_K8S_77 | resource | Job | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 404 | CKV_K8S_77 | resource | Pod | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 405 | CKV_K8S_77 | resource | PodTemplate | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 406 | CKV_K8S_77 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 407 | CKV_K8S_77 | resource | ReplicationController | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 408 | CKV_K8S_77 | resource | StatefulSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py | +| 409 | CKV_K8S_78 | resource | AdmissionConfiguration | Ensure that the admission control plugin EventRateLimit is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlEventRateLimit.py | +| 410 | CKV_K8S_79 | resource | CronJob | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 411 | CKV_K8S_79 | resource | DaemonSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 412 | CKV_K8S_79 | resource | Deployment | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 413 | CKV_K8S_79 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 414 | CKV_K8S_79 | resource | Job | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 415 | CKV_K8S_79 | resource | Pod | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 416 | CKV_K8S_79 | resource | PodTemplate | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 417 | CKV_K8S_79 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 418 | CKV_K8S_79 | resource | ReplicationController | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 419 | CKV_K8S_79 | resource | StatefulSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py | +| 420 | CKV_K8S_80 | resource | CronJob | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 421 | CKV_K8S_80 | resource | DaemonSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 422 | CKV_K8S_80 | resource | Deployment | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 423 | CKV_K8S_80 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 424 | CKV_K8S_80 | resource | Job | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 425 | CKV_K8S_80 | resource | Pod | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 426 | CKV_K8S_80 | resource | PodTemplate | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 427 | CKV_K8S_80 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 428 | CKV_K8S_80 | resource | ReplicationController | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 429 | CKV_K8S_80 | resource | StatefulSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py | +| 430 | CKV_K8S_81 | resource | CronJob | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 431 | CKV_K8S_81 | resource | DaemonSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 432 | CKV_K8S_81 | resource | Deployment | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 433 | CKV_K8S_81 | resource | DeploymentConfig | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 434 | CKV_K8S_81 | resource | Job | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 435 | CKV_K8S_81 | resource | Pod | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 436 | CKV_K8S_81 | resource | PodTemplate | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 437 | CKV_K8S_81 | resource | ReplicaSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 438 | CKV_K8S_81 | resource | ReplicationController | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 439 | CKV_K8S_81 | resource | StatefulSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py | +| 440 | CKV_K8S_82 | resource | CronJob | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 441 | CKV_K8S_82 | resource | DaemonSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 442 | CKV_K8S_82 | resource | Deployment | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 443 | CKV_K8S_82 | resource | DeploymentConfig | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 444 | CKV_K8S_82 | resource | Job | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 445 | CKV_K8S_82 | resource | Pod | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 446 | CKV_K8S_82 | resource | PodTemplate | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 447 | CKV_K8S_82 | resource | ReplicaSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 448 | CKV_K8S_82 | resource | ReplicationController | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 449 | CKV_K8S_82 | resource | StatefulSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py | +| 450 | CKV_K8S_83 | resource | CronJob | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 451 | CKV_K8S_83 | resource | DaemonSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 452 | CKV_K8S_83 | resource | Deployment | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 453 | CKV_K8S_83 | resource | DeploymentConfig | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 454 | CKV_K8S_83 | resource | Job | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 455 | CKV_K8S_83 | resource | Pod | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 456 | CKV_K8S_83 | resource | PodTemplate | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 457 | CKV_K8S_83 | resource | ReplicaSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 458 | CKV_K8S_83 | resource | ReplicationController | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 459 | CKV_K8S_83 | resource | StatefulSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py | +| 460 | CKV_K8S_84 | resource | CronJob | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 461 | CKV_K8S_84 | resource | DaemonSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 462 | CKV_K8S_84 | resource | Deployment | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 463 | CKV_K8S_84 | resource | DeploymentConfig | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 464 | CKV_K8S_84 | resource | Job | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 465 | CKV_K8S_84 | resource | Pod | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 466 | CKV_K8S_84 | resource | PodTemplate | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 467 | CKV_K8S_84 | resource | ReplicaSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 468 | CKV_K8S_84 | resource | ReplicationController | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 469 | CKV_K8S_84 | resource | StatefulSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py | +| 470 | CKV_K8S_85 | resource | CronJob | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 471 | CKV_K8S_85 | resource | DaemonSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 472 | CKV_K8S_85 | resource | Deployment | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 473 | CKV_K8S_85 | resource | DeploymentConfig | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 474 | CKV_K8S_85 | resource | Job | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 475 | CKV_K8S_85 | resource | Pod | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 476 | CKV_K8S_85 | resource | PodTemplate | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 477 | CKV_K8S_85 | resource | ReplicaSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 478 | CKV_K8S_85 | resource | ReplicationController | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 479 | CKV_K8S_85 | resource | StatefulSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py | +| 480 | CKV_K8S_86 | resource | CronJob | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 481 | CKV_K8S_86 | resource | DaemonSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 482 | CKV_K8S_86 | resource | Deployment | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 483 | CKV_K8S_86 | resource | DeploymentConfig | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 484 | CKV_K8S_86 | resource | Job | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 485 | CKV_K8S_86 | resource | Pod | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 486 | CKV_K8S_86 | resource | PodTemplate | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 487 | CKV_K8S_86 | resource | ReplicaSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 488 | CKV_K8S_86 | resource | ReplicationController | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 489 | CKV_K8S_86 | resource | StatefulSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py | +| 490 | CKV_K8S_88 | resource | CronJob | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 491 | CKV_K8S_88 | resource | DaemonSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 492 | CKV_K8S_88 | resource | Deployment | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 493 | CKV_K8S_88 | resource | DeploymentConfig | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 494 | CKV_K8S_88 | resource | Job | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 495 | CKV_K8S_88 | resource | Pod | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 496 | CKV_K8S_88 | resource | PodTemplate | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 497 | CKV_K8S_88 | resource | ReplicaSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 498 | CKV_K8S_88 | resource | ReplicationController | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 499 | CKV_K8S_88 | resource | StatefulSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py | +| 500 | CKV_K8S_89 | resource | CronJob | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 501 | CKV_K8S_89 | resource | DaemonSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 502 | CKV_K8S_89 | resource | Deployment | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 503 | CKV_K8S_89 | resource | DeploymentConfig | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 504 | CKV_K8S_89 | resource | Job | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 505 | CKV_K8S_89 | resource | Pod | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 506 | CKV_K8S_89 | resource | PodTemplate | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 507 | CKV_K8S_89 | resource | ReplicaSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 508 | CKV_K8S_89 | resource | ReplicationController | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 509 | CKV_K8S_89 | resource | StatefulSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py | +| 510 | CKV_K8S_90 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 511 | CKV_K8S_90 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 512 | CKV_K8S_90 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 513 | CKV_K8S_90 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 514 | CKV_K8S_90 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 515 | CKV_K8S_90 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 516 | CKV_K8S_90 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 517 | CKV_K8S_90 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 518 | CKV_K8S_90 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 519 | CKV_K8S_90 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py | +| 520 | CKV_K8S_91 | resource | CronJob | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 521 | CKV_K8S_91 | resource | DaemonSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 522 | CKV_K8S_91 | resource | Deployment | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 523 | CKV_K8S_91 | resource | DeploymentConfig | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 524 | CKV_K8S_91 | resource | Job | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 525 | CKV_K8S_91 | resource | Pod | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 526 | CKV_K8S_91 | resource | PodTemplate | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 527 | CKV_K8S_91 | resource | ReplicaSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 528 | CKV_K8S_91 | resource | ReplicationController | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 529 | CKV_K8S_91 | resource | StatefulSet | Ensure that the --audit-log-path argument is set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py | +| 530 | CKV_K8S_92 | resource | CronJob | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 531 | CKV_K8S_92 | resource | DaemonSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 532 | CKV_K8S_92 | resource | Deployment | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 533 | CKV_K8S_92 | resource | DeploymentConfig | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 534 | CKV_K8S_92 | resource | Job | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 535 | CKV_K8S_92 | resource | Pod | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 536 | CKV_K8S_92 | resource | PodTemplate | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 537 | CKV_K8S_92 | resource | ReplicaSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 538 | CKV_K8S_92 | resource | ReplicationController | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 539 | CKV_K8S_92 | resource | StatefulSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py | +| 540 | CKV_K8S_93 | resource | CronJob | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 541 | CKV_K8S_93 | resource | DaemonSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 542 | CKV_K8S_93 | resource | Deployment | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 543 | CKV_K8S_93 | resource | DeploymentConfig | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 544 | CKV_K8S_93 | resource | Job | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 545 | CKV_K8S_93 | resource | Pod | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 546 | CKV_K8S_93 | resource | PodTemplate | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 547 | CKV_K8S_93 | resource | ReplicaSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 548 | CKV_K8S_93 | resource | ReplicationController | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 549 | CKV_K8S_93 | resource | StatefulSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py | +| 550 | CKV_K8S_94 | resource | CronJob | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 551 | CKV_K8S_94 | resource | DaemonSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 552 | CKV_K8S_94 | resource | Deployment | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 553 | CKV_K8S_94 | resource | DeploymentConfig | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 554 | CKV_K8S_94 | resource | Job | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 555 | CKV_K8S_94 | resource | Pod | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 556 | CKV_K8S_94 | resource | PodTemplate | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 557 | CKV_K8S_94 | resource | ReplicaSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 558 | CKV_K8S_94 | resource | ReplicationController | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 559 | CKV_K8S_94 | resource | StatefulSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py | +| 560 | CKV_K8S_95 | resource | CronJob | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 561 | CKV_K8S_95 | resource | DaemonSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 562 | CKV_K8S_95 | resource | Deployment | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 563 | CKV_K8S_95 | resource | DeploymentConfig | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 564 | CKV_K8S_95 | resource | Job | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 565 | CKV_K8S_95 | resource | Pod | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 566 | CKV_K8S_95 | resource | PodTemplate | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 567 | CKV_K8S_95 | resource | ReplicaSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 568 | CKV_K8S_95 | resource | ReplicationController | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 569 | CKV_K8S_95 | resource | StatefulSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py | +| 570 | CKV_K8S_96 | resource | CronJob | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 571 | CKV_K8S_96 | resource | DaemonSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 572 | CKV_K8S_96 | resource | Deployment | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 573 | CKV_K8S_96 | resource | DeploymentConfig | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 574 | CKV_K8S_96 | resource | Job | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 575 | CKV_K8S_96 | resource | Pod | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 576 | CKV_K8S_96 | resource | PodTemplate | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 577 | CKV_K8S_96 | resource | ReplicaSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 578 | CKV_K8S_96 | resource | ReplicationController | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 579 | CKV_K8S_96 | resource | StatefulSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py | +| 580 | CKV_K8S_97 | resource | CronJob | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 581 | CKV_K8S_97 | resource | DaemonSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 582 | CKV_K8S_97 | resource | Deployment | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 583 | CKV_K8S_97 | resource | DeploymentConfig | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 584 | CKV_K8S_97 | resource | Job | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 585 | CKV_K8S_97 | resource | Pod | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 586 | CKV_K8S_97 | resource | PodTemplate | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 587 | CKV_K8S_97 | resource | ReplicaSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 588 | CKV_K8S_97 | resource | ReplicationController | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 589 | CKV_K8S_97 | resource | StatefulSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py | +| 590 | CKV_K8S_99 | resource | CronJob | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 591 | CKV_K8S_99 | resource | DaemonSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 592 | CKV_K8S_99 | resource | Deployment | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 593 | CKV_K8S_99 | resource | DeploymentConfig | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 594 | CKV_K8S_99 | resource | Job | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 595 | CKV_K8S_99 | resource | Pod | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 596 | CKV_K8S_99 | resource | PodTemplate | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 597 | CKV_K8S_99 | resource | ReplicaSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 598 | CKV_K8S_99 | resource | ReplicationController | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 599 | CKV_K8S_99 | resource | StatefulSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py | +| 600 | CKV_K8S_100 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 601 | CKV_K8S_100 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 602 | CKV_K8S_100 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 603 | CKV_K8S_100 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 604 | CKV_K8S_100 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 605 | CKV_K8S_100 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 606 | CKV_K8S_100 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 607 | CKV_K8S_100 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 608 | CKV_K8S_100 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 609 | CKV_K8S_100 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py | +| 610 | CKV_K8S_102 | resource | CronJob | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 611 | CKV_K8S_102 | resource | DaemonSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 612 | CKV_K8S_102 | resource | Deployment | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 613 | CKV_K8S_102 | resource | DeploymentConfig | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 614 | CKV_K8S_102 | resource | Job | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 615 | CKV_K8S_102 | resource | Pod | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 616 | CKV_K8S_102 | resource | PodTemplate | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 617 | CKV_K8S_102 | resource | ReplicaSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 618 | CKV_K8S_102 | resource | ReplicationController | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 619 | CKV_K8S_102 | resource | StatefulSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py | +| 620 | CKV_K8S_104 | resource | CronJob | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 621 | CKV_K8S_104 | resource | DaemonSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 622 | CKV_K8S_104 | resource | Deployment | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 623 | CKV_K8S_104 | resource | DeploymentConfig | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 624 | CKV_K8S_104 | resource | Job | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 625 | CKV_K8S_104 | resource | Pod | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 626 | CKV_K8S_104 | resource | PodTemplate | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 627 | CKV_K8S_104 | resource | ReplicaSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 628 | CKV_K8S_104 | resource | ReplicationController | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 629 | CKV_K8S_104 | resource | StatefulSet | Ensure that encryption providers are appropriately configured | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py | +| 630 | CKV_K8S_105 | resource | CronJob | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 631 | CKV_K8S_105 | resource | DaemonSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 632 | CKV_K8S_105 | resource | Deployment | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 633 | CKV_K8S_105 | resource | DeploymentConfig | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 634 | CKV_K8S_105 | resource | Job | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 635 | CKV_K8S_105 | resource | Pod | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 636 | CKV_K8S_105 | resource | PodTemplate | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 637 | CKV_K8S_105 | resource | ReplicaSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 638 | CKV_K8S_105 | resource | ReplicationController | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 639 | CKV_K8S_105 | resource | StatefulSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py | +| 640 | CKV_K8S_106 | resource | CronJob | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 641 | CKV_K8S_106 | resource | DaemonSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 642 | CKV_K8S_106 | resource | Deployment | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 643 | CKV_K8S_106 | resource | DeploymentConfig | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 644 | CKV_K8S_106 | resource | Job | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 645 | CKV_K8S_106 | resource | Pod | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 646 | CKV_K8S_106 | resource | PodTemplate | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 647 | CKV_K8S_106 | resource | ReplicaSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 648 | CKV_K8S_106 | resource | ReplicationController | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 649 | CKV_K8S_106 | resource | StatefulSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py | +| 650 | CKV_K8S_107 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 651 | CKV_K8S_107 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 652 | CKV_K8S_107 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 653 | CKV_K8S_107 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 654 | CKV_K8S_107 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 655 | CKV_K8S_107 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 656 | CKV_K8S_107 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 657 | CKV_K8S_107 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 658 | CKV_K8S_107 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 659 | CKV_K8S_107 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py | +| 660 | CKV_K8S_108 | resource | CronJob | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 661 | CKV_K8S_108 | resource | DaemonSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 662 | CKV_K8S_108 | resource | Deployment | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 663 | CKV_K8S_108 | resource | DeploymentConfig | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 664 | CKV_K8S_108 | resource | Job | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 665 | CKV_K8S_108 | resource | Pod | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 666 | CKV_K8S_108 | resource | PodTemplate | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 667 | CKV_K8S_108 | resource | ReplicaSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 668 | CKV_K8S_108 | resource | ReplicationController | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 669 | CKV_K8S_108 | resource | StatefulSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py | +| 670 | CKV_K8S_110 | resource | CronJob | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 671 | CKV_K8S_110 | resource | DaemonSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 672 | CKV_K8S_110 | resource | Deployment | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 673 | CKV_K8S_110 | resource | DeploymentConfig | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 674 | CKV_K8S_110 | resource | Job | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 675 | CKV_K8S_110 | resource | Pod | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 676 | CKV_K8S_110 | resource | PodTemplate | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 677 | CKV_K8S_110 | resource | ReplicaSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 678 | CKV_K8S_110 | resource | ReplicationController | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 679 | CKV_K8S_110 | resource | StatefulSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py | +| 680 | CKV_K8S_111 | resource | CronJob | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 681 | CKV_K8S_111 | resource | DaemonSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 682 | CKV_K8S_111 | resource | Deployment | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 683 | CKV_K8S_111 | resource | DeploymentConfig | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 684 | CKV_K8S_111 | resource | Job | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 685 | CKV_K8S_111 | resource | Pod | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 686 | CKV_K8S_111 | resource | PodTemplate | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 687 | CKV_K8S_111 | resource | ReplicaSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 688 | CKV_K8S_111 | resource | ReplicationController | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 689 | CKV_K8S_111 | resource | StatefulSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py | +| 690 | CKV_K8S_112 | resource | CronJob | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 691 | CKV_K8S_112 | resource | DaemonSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 692 | CKV_K8S_112 | resource | Deployment | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 693 | CKV_K8S_112 | resource | DeploymentConfig | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 694 | CKV_K8S_112 | resource | Job | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 695 | CKV_K8S_112 | resource | Pod | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 696 | CKV_K8S_112 | resource | PodTemplate | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 697 | CKV_K8S_112 | resource | ReplicaSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 698 | CKV_K8S_112 | resource | ReplicationController | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 699 | CKV_K8S_112 | resource | StatefulSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py | +| 700 | CKV_K8S_113 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 701 | CKV_K8S_113 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 702 | CKV_K8S_113 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 703 | CKV_K8S_113 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 704 | CKV_K8S_113 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 705 | CKV_K8S_113 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 706 | CKV_K8S_113 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 707 | CKV_K8S_113 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 708 | CKV_K8S_113 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 709 | CKV_K8S_113 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py | +| 710 | CKV_K8S_114 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 711 | CKV_K8S_114 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 712 | CKV_K8S_114 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 713 | CKV_K8S_114 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 714 | CKV_K8S_114 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 715 | CKV_K8S_114 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 716 | CKV_K8S_114 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 717 | CKV_K8S_114 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 718 | CKV_K8S_114 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 719 | CKV_K8S_114 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py | +| 720 | CKV_K8S_115 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 721 | CKV_K8S_115 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 722 | CKV_K8S_115 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 723 | CKV_K8S_115 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 724 | CKV_K8S_115 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 725 | CKV_K8S_115 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 726 | CKV_K8S_115 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 727 | CKV_K8S_115 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 728 | CKV_K8S_115 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 729 | CKV_K8S_115 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py | +| 730 | CKV_K8S_116 | resource | CronJob | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 731 | CKV_K8S_116 | resource | DaemonSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 732 | CKV_K8S_116 | resource | Deployment | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 733 | CKV_K8S_116 | resource | DeploymentConfig | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 734 | CKV_K8S_116 | resource | Job | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 735 | CKV_K8S_116 | resource | Pod | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 736 | CKV_K8S_116 | resource | PodTemplate | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 737 | CKV_K8S_116 | resource | ReplicaSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 738 | CKV_K8S_116 | resource | ReplicationController | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 739 | CKV_K8S_116 | resource | StatefulSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py | +| 740 | CKV_K8S_117 | resource | CronJob | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 741 | CKV_K8S_117 | resource | DaemonSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 742 | CKV_K8S_117 | resource | Deployment | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 743 | CKV_K8S_117 | resource | DeploymentConfig | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 744 | CKV_K8S_117 | resource | Job | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 745 | CKV_K8S_117 | resource | Pod | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 746 | CKV_K8S_117 | resource | PodTemplate | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 747 | CKV_K8S_117 | resource | ReplicaSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 748 | CKV_K8S_117 | resource | ReplicationController | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 749 | CKV_K8S_117 | resource | StatefulSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py | +| 750 | CKV_K8S_118 | resource | CronJob | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 751 | CKV_K8S_118 | resource | DaemonSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 752 | CKV_K8S_118 | resource | Deployment | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 753 | CKV_K8S_118 | resource | DeploymentConfig | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 754 | CKV_K8S_118 | resource | Job | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 755 | CKV_K8S_118 | resource | Pod | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 756 | CKV_K8S_118 | resource | PodTemplate | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 757 | CKV_K8S_118 | resource | ReplicaSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 758 | CKV_K8S_118 | resource | ReplicationController | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 759 | CKV_K8S_118 | resource | StatefulSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py | +| 760 | CKV_K8S_119 | resource | CronJob | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 761 | CKV_K8S_119 | resource | DaemonSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 762 | CKV_K8S_119 | resource | Deployment | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 763 | CKV_K8S_119 | resource | DeploymentConfig | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 764 | CKV_K8S_119 | resource | Job | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 765 | CKV_K8S_119 | resource | Pod | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 766 | CKV_K8S_119 | resource | PodTemplate | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 767 | CKV_K8S_119 | resource | ReplicaSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 768 | CKV_K8S_119 | resource | ReplicationController | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 769 | CKV_K8S_119 | resource | StatefulSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py | +| 770 | CKV_K8S_121 | resource | Pod | Ensure that the --peer-client-cert-auth argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/PeerClientCertAuthTrue.py | +| 771 | CKV_K8S_138 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 772 | CKV_K8S_138 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 773 | CKV_K8S_138 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 774 | CKV_K8S_138 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 775 | CKV_K8S_138 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 776 | CKV_K8S_138 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 777 | CKV_K8S_138 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 778 | CKV_K8S_138 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 779 | CKV_K8S_138 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 780 | CKV_K8S_138 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py | +| 781 | CKV_K8S_139 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 782 | CKV_K8S_139 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 783 | CKV_K8S_139 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 784 | CKV_K8S_139 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 785 | CKV_K8S_139 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 786 | CKV_K8S_139 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 787 | CKV_K8S_139 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 788 | CKV_K8S_139 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 789 | CKV_K8S_139 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 790 | CKV_K8S_139 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py | +| 791 | CKV_K8S_140 | resource | CronJob | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 792 | CKV_K8S_140 | resource | DaemonSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 793 | CKV_K8S_140 | resource | Deployment | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 794 | CKV_K8S_140 | resource | DeploymentConfig | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 795 | CKV_K8S_140 | resource | Job | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 796 | CKV_K8S_140 | resource | Pod | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 797 | CKV_K8S_140 | resource | PodTemplate | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 798 | CKV_K8S_140 | resource | ReplicaSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 799 | CKV_K8S_140 | resource | ReplicationController | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 800 | CKV_K8S_140 | resource | StatefulSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py | +| 801 | CKV_K8S_141 | resource | CronJob | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 802 | CKV_K8S_141 | resource | DaemonSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 803 | CKV_K8S_141 | resource | Deployment | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 804 | CKV_K8S_141 | resource | DeploymentConfig | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 805 | CKV_K8S_141 | resource | Job | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 806 | CKV_K8S_141 | resource | Pod | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 807 | CKV_K8S_141 | resource | PodTemplate | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 808 | CKV_K8S_141 | resource | ReplicaSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 809 | CKV_K8S_141 | resource | ReplicationController | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 810 | CKV_K8S_141 | resource | StatefulSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py | +| 811 | CKV_K8S_143 | resource | CronJob | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 812 | CKV_K8S_143 | resource | DaemonSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 813 | CKV_K8S_143 | resource | Deployment | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 814 | CKV_K8S_143 | resource | DeploymentConfig | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 815 | CKV_K8S_143 | resource | Job | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 816 | CKV_K8S_143 | resource | Pod | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 817 | CKV_K8S_143 | resource | PodTemplate | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 818 | CKV_K8S_143 | resource | ReplicaSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 819 | CKV_K8S_143 | resource | ReplicationController | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 820 | CKV_K8S_143 | resource | StatefulSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py | +| 821 | CKV_K8S_144 | resource | CronJob | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 822 | CKV_K8S_144 | resource | DaemonSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 823 | CKV_K8S_144 | resource | Deployment | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 824 | CKV_K8S_144 | resource | DeploymentConfig | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 825 | CKV_K8S_144 | resource | Job | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 826 | CKV_K8S_144 | resource | Pod | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 827 | CKV_K8S_144 | resource | PodTemplate | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 828 | CKV_K8S_144 | resource | ReplicaSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 829 | CKV_K8S_144 | resource | ReplicationController | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 830 | CKV_K8S_144 | resource | StatefulSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py | +| 831 | CKV_K8S_145 | resource | CronJob | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 832 | CKV_K8S_145 | resource | DaemonSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 833 | CKV_K8S_145 | resource | Deployment | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 834 | CKV_K8S_145 | resource | DeploymentConfig | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 835 | CKV_K8S_145 | resource | Job | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 836 | CKV_K8S_145 | resource | Pod | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 837 | CKV_K8S_145 | resource | PodTemplate | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 838 | CKV_K8S_145 | resource | ReplicaSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 839 | CKV_K8S_145 | resource | ReplicationController | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 840 | CKV_K8S_145 | resource | StatefulSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py | +| 841 | CKV_K8S_146 | resource | CronJob | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 842 | CKV_K8S_146 | resource | DaemonSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 843 | CKV_K8S_146 | resource | Deployment | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 844 | CKV_K8S_146 | resource | DeploymentConfig | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 845 | CKV_K8S_146 | resource | Job | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 846 | CKV_K8S_146 | resource | Pod | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 847 | CKV_K8S_146 | resource | PodTemplate | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 848 | CKV_K8S_146 | resource | ReplicaSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 849 | CKV_K8S_146 | resource | ReplicationController | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 850 | CKV_K8S_146 | resource | StatefulSet | Ensure that the --hostname-override argument is not set | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py | +| 851 | CKV_K8S_147 | resource | CronJob | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 852 | CKV_K8S_147 | resource | DaemonSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 853 | CKV_K8S_147 | resource | Deployment | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 854 | CKV_K8S_147 | resource | DeploymentConfig | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 855 | CKV_K8S_147 | resource | Job | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 856 | CKV_K8S_147 | resource | Pod | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 857 | CKV_K8S_147 | resource | PodTemplate | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 858 | CKV_K8S_147 | resource | ReplicaSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 859 | CKV_K8S_147 | resource | ReplicationController | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 860 | CKV_K8S_147 | resource | StatefulSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py | +| 861 | CKV_K8S_148 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 862 | CKV_K8S_148 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 863 | CKV_K8S_148 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 864 | CKV_K8S_148 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 865 | CKV_K8S_148 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 866 | CKV_K8S_148 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 867 | CKV_K8S_148 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 868 | CKV_K8S_148 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 869 | CKV_K8S_148 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 870 | CKV_K8S_148 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py | +| 871 | CKV_K8S_149 | resource | CronJob | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 872 | CKV_K8S_149 | resource | DaemonSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 873 | CKV_K8S_149 | resource | Deployment | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 874 | CKV_K8S_149 | resource | DeploymentConfig | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 875 | CKV_K8S_149 | resource | Job | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 876 | CKV_K8S_149 | resource | Pod | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 877 | CKV_K8S_149 | resource | PodTemplate | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 878 | CKV_K8S_149 | resource | ReplicaSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 879 | CKV_K8S_149 | resource | ReplicationController | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 880 | CKV_K8S_149 | resource | StatefulSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py | +| 881 | CKV_K8S_151 | resource | CronJob | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 882 | CKV_K8S_151 | resource | DaemonSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 883 | CKV_K8S_151 | resource | Deployment | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 884 | CKV_K8S_151 | resource | DeploymentConfig | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 885 | CKV_K8S_151 | resource | Job | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 886 | CKV_K8S_151 | resource | Pod | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 887 | CKV_K8S_151 | resource | PodTemplate | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 888 | CKV_K8S_151 | resource | ReplicaSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 889 | CKV_K8S_151 | resource | ReplicationController | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 890 | CKV_K8S_151 | resource | StatefulSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py | +| 891 | CKV_K8S_152 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Lua.py | +| 892 | CKV_K8S_153 | resource | Ingress | Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742AllSnippets.py | +| 893 | CKV_K8S_154 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742 | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Alias.py | +| 894 | CKV_K8S_155 | resource | ClusterRole | Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacControlWebhooks.py | +| 895 | CKV_K8S_156 | resource | ClusterRole | Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacApproveCertificateSigningRequests.py | +| 896 | CKV_K8S_157 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py | +| 897 | CKV_K8S_157 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py | +| 898 | CKV_K8S_158 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py | +| 899 | CKV_K8S_158 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | https://github.com/bridgecrewio/checkov/tree/master/checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py | --- diff --git a/docs/5.Policy Index/openapi.md b/docs/5.Policy Index/openapi.md index 43488857a94..4469b243e5b 100644 --- a/docs/5.Policy Index/openapi.md +++ b/docs/5.Policy Index/openapi.md @@ -6,15 +6,15 @@ nav_order: 1 # openapi resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|---------------|----------|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------|-------------------------------------------------------------| -| 0 | CKV_OPENAPI_1 | resource | securityDefinitions | Ensure that securityDefinitions is defined and not empty - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_OPENAPI_2 | resource | security | Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_OPENAPI_3 | resource | components | Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_OPENAPI_4 | resource | security | Ensure that the global security field has rules defined | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_OPENAPI_5 | resource | security | Ensure that security operations is not empty. | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_OPENAPI_6 | resource | security | Ensure that security requirement defined in securityDefinitions - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_OPENAPI_7 | resource | security | Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|---------------|----------|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------|---------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_OPENAPI_1 | resource | securityDefinitions | Ensure that securityDefinitions is defined and not empty - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v2/SecurityDefinitions.py | +| 1 | CKV_OPENAPI_2 | resource | security | Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v2/Oauth2SecurityRequirement.py | +| 2 | CKV_OPENAPI_3 | resource | components | Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v3/CleartextOverUnencryptedChannel.py | +| 3 | CKV_OPENAPI_4 | resource | security | Ensure that the global security field has rules defined | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/generic/GlobalSecurityFieldIsEmpty.py | +| 4 | CKV_OPENAPI_5 | resource | security | Ensure that security operations is not empty. | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/generic/SecurityOperations.py | +| 5 | CKV_OPENAPI_6 | resource | security | Ensure that security requirement defined in securityDefinitions - version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v2/SecurityRequirement.py | +| 6 | CKV_OPENAPI_7 | resource | security | Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files | OpenAPI | https://github.com/bridgecrewio/checkov/tree/master/checkov/openapi/checks/resource/v2/PathSchemeDefineHTTP.py | --- diff --git a/docs/5.Policy Index/secrets.md b/docs/5.Policy Index/secrets.md index 98fc3dc804b..ea050a4211a 100644 --- a/docs/5.Policy Index/secrets.md +++ b/docs/5.Policy Index/secrets.md @@ -6,27 +6,27 @@ nav_order: 1 # secrets resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|---------------|----------------------------------|---------|----------------------------------|----------|-------------------------------------------------------------| -| 0 | CKV_SECRET_1 | Artifactory Credentials | secrets | Artifactory Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_SECRET_2 | AWS Access Key | secrets | AWS Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_SECRET_3 | Azure Storage Account access key | secrets | Azure Storage Account access key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_SECRET_4 | Basic Auth Credentials | secrets | Basic Auth Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_SECRET_5 | Cloudant Credentials | secrets | Cloudant Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_SECRET_6 | Base64 High Entropy String | secrets | Base64 High Entropy String | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_SECRET_7 | IBM Cloud IAM Key | secrets | IBM Cloud IAM Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_SECRET_8 | IBM COS HMAC Credentials | secrets | IBM COS HMAC Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_SECRET_9 | JSON Web Token | secrets | JSON Web Token | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_SECRET_10 | Secret Keyword | secrets | Secret Keyword | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_SECRET_11 | Mailchimp Access Key | secrets | Mailchimp Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_SECRET_12 | NPM tokens | secrets | NPM tokens | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_SECRET_13 | Private Key | secrets | Private Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_SECRET_14 | Slack Token | secrets | Slack Token | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_SECRET_15 | SoftLayer Credentials | secrets | SoftLayer Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_SECRET_16 | Square OAuth Secret | secrets | Square OAuth Secret | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_SECRET_17 | Stripe Access Key | secrets | Stripe Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 17 | CKV_SECRET_18 | Twilio API Key | secrets | Twilio API Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 18 | CKV_SECRET_19 | Hex High Entropy String | secrets | Hex High Entropy String | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|---------------|----------------------------------|---------|----------------------------------|----------|--------------------------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_SECRET_1 | Artifactory Credentials | secrets | Artifactory Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 1 | CKV_SECRET_2 | AWS Access Key | secrets | AWS Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 2 | CKV_SECRET_3 | Azure Storage Account access key | secrets | Azure Storage Account access key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 3 | CKV_SECRET_4 | Basic Auth Credentials | secrets | Basic Auth Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 4 | CKV_SECRET_5 | Cloudant Credentials | secrets | Cloudant Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 5 | CKV_SECRET_6 | Base64 High Entropy String | secrets | Base64 High Entropy String | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 6 | CKV_SECRET_7 | IBM Cloud IAM Key | secrets | IBM Cloud IAM Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 7 | CKV_SECRET_8 | IBM COS HMAC Credentials | secrets | IBM COS HMAC Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 8 | CKV_SECRET_9 | JSON Web Token | secrets | JSON Web Token | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 9 | CKV_SECRET_10 | Secret Keyword | secrets | Secret Keyword | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 10 | CKV_SECRET_11 | Mailchimp Access Key | secrets | Mailchimp Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 11 | CKV_SECRET_12 | NPM tokens | secrets | NPM tokens | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 12 | CKV_SECRET_13 | Private Key | secrets | Private Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 13 | CKV_SECRET_14 | Slack Token | secrets | Slack Token | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 14 | CKV_SECRET_15 | SoftLayer Credentials | secrets | SoftLayer Credentials | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 15 | CKV_SECRET_16 | Square OAuth Secret | secrets | Square OAuth Secret | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 16 | CKV_SECRET_17 | Stripe Access Key | secrets | Stripe Access Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 17 | CKV_SECRET_18 | Twilio API Key | secrets | Twilio API Key | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | +| 18 | CKV_SECRET_19 | Hex High Entropy String | secrets | Hex High Entropy String | secrets | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py | --- diff --git a/docs/5.Policy Index/serverless.md b/docs/5.Policy Index/serverless.md index 1e8613dca7f..5af4bd8de31 100644 --- a/docs/5.Policy Index/serverless.md +++ b/docs/5.Policy Index/serverless.md @@ -6,178 +6,178 @@ nav_order: 1 # serverless resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|----|------------|----------|----------------|-------------------------------------------------------------------------------------|------------|-------------------------------------------------------------| -| 0 | CKV_AWS_1 | resource | serverless_aws | Ensure IAM policies that allow full "*-*" administrative privileges are not created | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_AWS_41 | resource | serverless_aws | Ensure no hard coded AWS access key and secret key exists in provider | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_AWS_49 | resource | serverless_aws | Ensure no IAM policies documents allow "*" as a statement's actions | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|----|------------|----------|----------------|-------------------------------------------------------------------------------------|------------|------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_AWS_1 | resource | serverless_aws | Ensure IAM policies that allow full "*-*" administrative privileges are not created | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov/serverless/checks/function/aws/AdminPolicyDocument.py | +| 1 | CKV_AWS_41 | resource | serverless_aws | Ensure no hard coded AWS access key and secret key exists in provider | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov/serverless/checks/function/aws/AWSCredentials.py | +| 2 | CKV_AWS_49 | resource | serverless_aws | Ensure no IAM policies documents allow "*" as a statement's actions | serverless | https://github.com/bridgecrewio/checkov/tree/master/checkov/serverless/checks/function/aws/StarActionPolicyDocument.py | --- -| | | Id | Type | Entity | Policy | IaC | -|-----|-------------|----------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-------------------------------------------------------------| -| 0 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 17 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 18 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 19 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 20 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 21 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure Dynamodb point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 22 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 23 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 24 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 25 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 26 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 27 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 28 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 29 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 30 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 31 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 32 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 33 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 34 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 35 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 36 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 37 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 38 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 39 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLS enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 40 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 41 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 42 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has 'restrict_public_bucket' enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 43 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 44 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 45 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 46 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 47 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 48 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 49 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 50 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 51 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 52 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 53 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 54 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 55 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 56 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 57 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 58 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 59 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 60 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 61 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 62 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 63 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 64 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 65 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 66 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 67 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 68 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 69 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 70 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 71 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 72 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 73 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocDB Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 74 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure Cloudfront distribution has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 75 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 76 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 77 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 78 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 79 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB TLS is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 80 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 81 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 82 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 83 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 84 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 85 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 86 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 87 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 88 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 89 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 90 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 91 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB has audit logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 92 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 93 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 94 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 95 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 96 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 97 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 98 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 99 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 100 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 101 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 102 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 103 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 104 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 105 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 106 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 107 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 108 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 109 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 110 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 111 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 112 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 113 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 114 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 115 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 116 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 117 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 118 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 119 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 120 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 121 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 122 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 123 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 124 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 125 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 126 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 127 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 128 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 129 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 130 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 131 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 132 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 133 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 134 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 135 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 136 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 137 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 138 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 139 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 140 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 141 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 142 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure Dynamodb global table point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 143 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 144 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 145 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 146 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 147 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 148 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 149 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 150 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 151 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 152 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 153 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 154 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 155 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 156 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 157 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 158 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 159 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|-----|-------------|----------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBListenerHTTPS.py | +| 1 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EBSEncryption.py | +| 2 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchEncryption.py | +| 3 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py | +| 4 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KMSRotation.py | +| 5 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LaunchConfigurationEBSEncryption.py | +| 6 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSEncryption.py | +| 7 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py | +| 8 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3AccessLogs.py | +| 9 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3Encryption.py | +| 10 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3PublicACLRead.py | +| 11 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3Versioning.py | +| 12 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 13 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 14 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py | +| 15 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 16 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 17 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 18 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 19 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SNSTopicEncryption.py | +| 20 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SQSQueueEncryption.py | +| 21 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure Dynamodb point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamodbRecovery.py | +| 22 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py | +| 23 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py | +| 24 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py | +| 25 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRPolicy.py | +| 26 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KMSKeyWildCardPrincipal.py | +| 27 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionEncryption.py | +| 28 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailEncryption.py | +| 29 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailLogValidation.py | +| 30 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 31 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EFSEncryptionEnabled.py | +| 32 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/KinesisStreamEncryptionType.py | +| 33 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/NeptuneClusterStorageEncrypted.py | +| 34 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py | +| 35 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in lambda environment | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py | +| 36 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2Credentials.py | +| 37 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DAXEncryption.py | +| 38 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRImmutableTags.py | +| 39 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLS enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3BlockPublicACLs.py | +| 40 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3BlockPublicPolicy.py | +| 41 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3IgnorePublicACLs.py | +| 42 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has 'restrict_public_bucket' enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3RestrictPublicBuckets.py | +| 43 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/S3PublicACLWrite.py | +| 44 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EKSSecretsEncryption.py | +| 45 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py | +| 46 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMRoleAllowsPublicAssume.py | +| 47 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py | +| 48 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 49 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 50 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 51 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py | +| 52 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 53 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 54 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 55 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 56 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py | +| 57 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py | +| 58 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupRetention.py | +| 59 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudtrailMultiRegion.py | +| 60 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WAFEnabled.py | +| 61 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AmazonMQBrokerPublicAccess.py | +| 62 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterLogging.py | +| 63 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py | +| 64 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py | +| 65 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBEncryption.py | +| 66 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py | +| 67 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py | +| 68 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CodeBuildProjectEncryption.py | +| 69 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IMDSv1Disabled.py | +| 70 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AthenaWorkgroupConfiguration.py | +| 71 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py | +| 72 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py | +| 73 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocDB Logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBLogging.py | +| 74 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure Cloudfront distribution has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionLogging.py | +| 75 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftClusterPubliclyAccessible.py | +| 76 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py | +| 77 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py | +| 78 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py | +| 79 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB TLS is not disabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBTLS.py | +| 80 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ELBv2AccessLogs.py | +| 81 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ELBAccessLogs.py | +| 82 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueDataCatalogEncryption.py | +| 83 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py | +| 84 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py | +| 85 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AuroraEncryption.py | +| 86 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py | +| 87 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfiguration.py | +| 88 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/EKSNodeGroupRemoteAccess.py | +| 89 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/NeptuneClusterLogging.py | +| 90 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBListenerTLS12.py | +| 91 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocDB has audit logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DocDBAuditLogs.py | +| 92 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedShiftSSL.py | +| 93 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 94 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 95 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 96 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 97 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py | +| 98 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 99 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 100 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 101 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 102 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py | +| 103 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 104 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 105 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 106 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 107 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py | +| 108 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 109 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 110 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 111 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 112 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py | +| 113 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 114 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 115 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 116 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 117 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py | +| 118 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py | +| 119 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py | +| 120 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py | +| 121 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py | +| 122 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py | +| 123 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py | +| 124 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSEnhancedMonitorEnabled.py | +| 125 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamoDBTablesEncrypted.py | +| 126 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py | +| 127 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py | +| 128 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/VPCEndpointAcceptanceConfigured.py | +| 129 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ALBDropHttpHeaders.py | +| 130 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRRepositoryEncrypted.py | +| 131 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecretManagerSecretEncrypted.py | +| 132 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RedshiftInEc2ClassicMode.py | +| 133 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WorkspaceUserVolumeEncrypted.py | +| 134 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WorkspaceRootVolumeEncrypted.py | +| 135 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py | +| 136 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupKMSKey.py | +| 137 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/TimestreamDatabaseKMSKey.py | +| 138 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSIAMAuthentication.py | +| 139 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/RDSClusterIAMAuthentication.py | +| 140 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/ECRImageScanning.py | +| 141 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/TransferServerIsPublic.py | +| 142 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure Dynamodb global table point in time recovery (backup) is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/DynamodbGlobalTableRecovery.py | +| 143 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/BackupVaultEncrypted.py | +| 144 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/QLDBLedgerPermissionsMode.py | +| 145 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/QLDBLedgerDeletionProtection.py | +| 146 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py | +| 147 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environmental variable | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py | +| 148 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/CloudFrontTLS12.py | +| 149 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/WAFACLCVE202144228.py | +| 150 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AppSyncLogging.py | +| 151 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/AppSyncFieldLevelLogs.py | +| 152 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 153 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 154 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 155 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/MQBrokerAuditLogging.py | +| 156 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/LambdaFunctionURLAuth.py | +| 157 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 158 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 159 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | --- diff --git a/docs/5.Policy Index/terraform.md b/docs/5.Policy Index/terraform.md index 8d24e1f7c6c..51ee1aa943c 100644 --- a/docs/5.Policy Index/terraform.md +++ b/docs/5.Policy Index/terraform.md @@ -6,1775 +6,1775 @@ nav_order: 1 # terraform resource scans (auto generated) -| | | Id | Type | Entity | Policy | IaC | -|------|-----------------|----------|---------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|-------------------------------------------------------------| -| 0 | CKV2_ADO_1 | resource | azuredevops_branch_policy_min_reviewers | Ensure at least two approving reviews for PRs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1 | CKV2_ADO_1 | resource | azuredevops_git_repository | Ensure at least two approving reviews for PRs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 2 | CKV_ALI_1 | resource | alicloud_oss_bucket | Alibaba Cloud OSS bucket accessible to public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 3 | CKV_ALI_2 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 4 | CKV_ALI_3 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 5 | CKV_ALI_4 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 6 | CKV_ALI_5 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all events | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 7 | CKV_ALI_6 | resource | alicloud_oss_bucket | Ensure OSS bucket is encrypted with Customer Master Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 8 | CKV_ALI_7 | resource | alicloud_disk | Ensure disk is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 9 | CKV_ALI_8 | resource | alicloud_disk | Ensure Disk is encrypted with Customer Master Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 10 | CKV_ALI_9 | resource | alicloud_db_instance | Ensure database instance is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 11 | CKV_ALI_10 | resource | alicloud_oss_bucket | Ensure OSS bucket has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 12 | CKV_ALI_11 | resource | alicloud_oss_bucket | Ensure OSS bucket has transfer Acceleration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 13 | CKV_ALI_12 | resource | alicloud_oss_bucket | Ensure the OSS bucket has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 14 | CKV_ALI_13 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires minimum length of 14 or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 15 | CKV_ALI_14 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one number | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 16 | CKV_ALI_15 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one symbol | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 17 | CKV_ALI_16 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy expires passwords within 90 days or less | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 18 | CKV_ALI_17 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one lowercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 19 | CKV_ALI_18 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy prevents password reuse | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 20 | CKV_ALI_19 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one uppercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 21 | CKV_ALI_20 | resource | alicloud_db_instance | Ensure RDS instance uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 22 | CKV_ALI_21 | resource | alicloud_api_gateway_api | Ensure API Gateway API Protocol HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 23 | CKV_ALI_22 | resource | alicloud_db_instance | Ensure Transparent Data Encryption is Enabled on instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 24 | CKV_ALI_23 | resource | alicloud_ram_account_password_policy | Ensure Ram Account Password Policy Max Login Attempts not > 5 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 25 | CKV_ALI_24 | resource | alicloud_ram_security_preference | Ensure RAM enforces MFA | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 26 | CKV_ALI_25 | resource | alicloud_db_instance | Ensure RDS Instance SQL Collector Retention Period should be greater than 180 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 27 | CKV_ALI_26 | resource | alicloud_cs_kubernetes | Ensure Kubernetes installs plugin Terway or Flannel to support standard policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 28 | CKV_ALI_27 | resource | alicloud_kms_key | Ensure KMS Key Rotation is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 29 | CKV_ALI_28 | resource | alicloud_kms_key | Ensure KMS Keys are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 30 | CKV_ALI_29 | resource | alicloud_alb_acl_entry_attachment | Alibaba ALB ACL does not restrict Access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 31 | CKV_ALI_30 | resource | alicloud_db_instance | Ensure RDS instance auto upgrades for minor versions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 32 | CKV_ALI_31 | resource | alicloud_cs_kubernetes_node_pool | Ensure K8s nodepools are set to auto repair | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 33 | CKV_ALI_32 | resource | alicloud_ecs_launch_template | Ensure launch template data disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 34 | CKV_ALI_33 | resource | alicloud_slb_tls_cipher_policy | Alibaba Cloud Cypher Policy are secure | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 35 | CKV_ALI_35 | resource | alicloud_db_instance | Ensure RDS instance has log_duration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 36 | CKV_ALI_36 | resource | alicloud_db_instance | Ensure RDS instance has log_disconnections enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 37 | CKV_ALI_37 | resource | alicloud_db_instance | Ensure RDS instance has log_connections enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 38 | CKV_ALI_38 | resource | alicloud_log_audit | Ensure log audit is enabled for RDS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 39 | CKV_ALI_41 | resource | alicloud_mongodb_instance | Ensure MongoDB is deployed inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 40 | CKV_ALI_42 | resource | alicloud_mongodb_instance | Ensure Mongodb instance uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 41 | CKV_ALI_43 | resource | alicloud_mongodb_instance | Ensure MongoDB instance is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 42 | CKV_ALI_44 | resource | alicloud_mongodb_instance | Ensure MongoDB has Transparent Data Encryption Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 43 | CKV_AWS_1 | data | aws_iam_policy_document | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 44 | CKV_AWS_2 | resource | aws_alb_listener | Ensure ALB protocol is HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 45 | CKV_AWS_2 | resource | aws_lb_listener | Ensure ALB protocol is HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 46 | CKV_AWS_3 | resource | aws_ebs_volume | Ensure all data stored in the EBS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 47 | CKV_AWS_5 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 48 | CKV_AWS_5 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 49 | CKV_AWS_6 | resource | aws_elasticsearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 50 | CKV_AWS_6 | resource | aws_opensearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 51 | CKV_AWS_7 | resource | aws_kms_key | Ensure rotation for customer created CMKs is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 52 | CKV_AWS_8 | resource | aws_instance | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 53 | CKV_AWS_8 | resource | aws_launch_configuration | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 54 | CKV_AWS_9 | resource | aws_iam_account_password_policy | Ensure IAM password policy expires passwords within 90 days or less | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 55 | CKV_AWS_10 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires minimum length of 14 or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 56 | CKV_AWS_11 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one lowercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 57 | CKV_AWS_12 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one number | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 58 | CKV_AWS_13 | resource | aws_iam_account_password_policy | Ensure IAM password policy prevents password reuse | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 59 | CKV_AWS_14 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one symbol | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 60 | CKV_AWS_15 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one uppercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 61 | CKV_AWS_16 | resource | aws_db_instance | Ensure all data stored in the RDS is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 62 | CKV_AWS_17 | resource | aws_db_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 63 | CKV_AWS_17 | resource | aws_rds_cluster_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 64 | CKV_AWS_18 | resource | aws_s3_bucket | Ensure the S3 bucket has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 65 | CKV_AWS_19 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 66 | CKV_AWS_19 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 67 | CKV_AWS_20 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public READ access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 68 | CKV_AWS_20 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public READ access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 69 | CKV_AWS_21 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 70 | CKV_AWS_21 | resource | aws_s3_bucket_versioning | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 71 | CKV_AWS_22 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker Notebook is encrypted at rest using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 72 | CKV_AWS_23 | resource | aws_db_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 73 | CKV_AWS_23 | resource | aws_elasticache_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 74 | CKV_AWS_23 | resource | aws_redshift_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 75 | CKV_AWS_23 | resource | aws_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 76 | CKV_AWS_23 | resource | aws_security_group_rule | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 77 | CKV_AWS_24 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 78 | CKV_AWS_24 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 79 | CKV_AWS_25 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 80 | CKV_AWS_25 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 81 | CKV_AWS_26 | resource | aws_sns_topic | Ensure all data stored in the SNS topic is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 82 | CKV_AWS_27 | resource | aws_sqs_queue | Ensure all data stored in the SQS queue is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 83 | CKV_AWS_28 | resource | aws_dynamodb_table | Ensure Dynamodb point in time recovery (backup) is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 84 | CKV_AWS_29 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 85 | CKV_AWS_30 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 86 | CKV_AWS_31 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 87 | CKV_AWS_32 | resource | aws_ecr_repository_policy | Ensure ECR policy is not set to public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 88 | CKV_AWS_33 | resource | aws_kms_key | Ensure KMS key policy does not contain wildcard (*) principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 89 | CKV_AWS_34 | resource | aws_cloudfront_distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 90 | CKV_AWS_35 | resource | aws_cloudtrail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 91 | CKV_AWS_36 | resource | aws_cloudtrail | Ensure CloudTrail log file validation is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 92 | CKV_AWS_37 | resource | aws_eks_cluster | Ensure Amazon EKS control plane logging enabled for all log types | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 93 | CKV_AWS_38 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 94 | CKV_AWS_39 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 95 | CKV_AWS_40 | resource | aws_iam_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 96 | CKV_AWS_40 | resource | aws_iam_user_policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 97 | CKV_AWS_40 | resource | aws_iam_user_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 98 | CKV_AWS_41 | provider | aws | Ensure no hard coded AWS access key and secret key exists in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 99 | CKV_AWS_42 | resource | aws_efs_file_system | Ensure EFS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 100 | CKV_AWS_43 | resource | aws_kinesis_stream | Ensure Kinesis Stream is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 101 | CKV_AWS_44 | resource | aws_neptune_cluster | Ensure Neptune storage is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 102 | CKV_AWS_45 | resource | aws_lambda_function | Ensure no hard-coded secrets exist in lambda environment | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 103 | CKV_AWS_46 | resource | aws_instance | Ensure no hard-coded secrets exist in EC2 user data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 104 | CKV_AWS_47 | resource | aws_dax_cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 105 | CKV_AWS_48 | resource | aws_mq_broker | Ensure MQ Broker logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 106 | CKV_AWS_49 | data | aws_iam_policy_document | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 107 | CKV_AWS_50 | resource | aws_lambda_function | X-ray tracing is enabled for Lambda | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 108 | CKV_AWS_51 | resource | aws_ecr_repository | Ensure ECR Image Tags are immutable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 109 | CKV_AWS_53 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public ACLS enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 110 | CKV_AWS_54 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public policy enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 111 | CKV_AWS_55 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has ignore public ACLs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 112 | CKV_AWS_56 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has 'restrict_public_bucket' enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 113 | CKV_AWS_57 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 114 | CKV_AWS_57 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 115 | CKV_AWS_58 | resource | aws_eks_cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 116 | CKV_AWS_59 | resource | aws_api_gateway_method | Ensure there is no open access to back-end resources through API | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 117 | CKV_AWS_60 | resource | aws_iam_role | Ensure IAM role allows only specific services or principals to assume it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 118 | CKV_AWS_61 | resource | aws_iam_role | Ensure AWS IAM policy does not allow assume role permission across all services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 119 | CKV_AWS_62 | resource | aws_iam_group_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 120 | CKV_AWS_62 | resource | aws_iam_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 121 | CKV_AWS_62 | resource | aws_iam_role_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 122 | CKV_AWS_62 | resource | aws_iam_user_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 123 | CKV_AWS_62 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 124 | CKV_AWS_63 | resource | aws_iam_group_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 125 | CKV_AWS_63 | resource | aws_iam_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 126 | CKV_AWS_63 | resource | aws_iam_role_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 127 | CKV_AWS_63 | resource | aws_iam_user_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 128 | CKV_AWS_63 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 129 | CKV_AWS_64 | resource | aws_redshift_cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 130 | CKV_AWS_65 | resource | aws_ecs_cluster | Ensure container insights are enabled on ECS cluster | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 131 | CKV_AWS_66 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group specifies retention days | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 132 | CKV_AWS_67 | resource | aws_cloudtrail | Ensure CloudTrail is enabled in all Regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 133 | CKV_AWS_68 | resource | aws_cloudfront_distribution | CloudFront Distribution should have WAF enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 134 | CKV_AWS_69 | resource | aws_mq_broker | Ensure MQ Broker is not publicly exposed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 135 | CKV_AWS_70 | resource | aws_s3_bucket | Ensure S3 bucket does not allow an action with any Principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 136 | CKV_AWS_70 | resource | aws_s3_bucket_policy | Ensure S3 bucket does not allow an action with any Principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 137 | CKV_AWS_71 | resource | aws_redshift_cluster | Ensure Redshift Cluster logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 138 | CKV_AWS_72 | resource | aws_sqs_queue_policy | Ensure SQS policy does not allow ALL (*) actions. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 139 | CKV_AWS_73 | resource | aws_api_gateway_stage | Ensure API Gateway has X-Ray Tracing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 140 | CKV_AWS_74 | resource | aws_docdb_cluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 141 | CKV_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure Global Accelerator accelerator has flow logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 142 | CKV_AWS_76 | resource | aws_api_gateway_stage | Ensure API Gateway has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 143 | CKV_AWS_76 | resource | aws_apigatewayv2_stage | Ensure API Gateway has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 144 | CKV_AWS_77 | resource | aws_athena_database | Ensure Athena Database is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 145 | CKV_AWS_78 | resource | aws_codebuild_project | Ensure that CodeBuild Project encryption is not disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 146 | CKV_AWS_79 | resource | aws_instance | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 147 | CKV_AWS_79 | resource | aws_launch_configuration | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 148 | CKV_AWS_79 | resource | aws_launch_template | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 149 | CKV_AWS_80 | resource | aws_msk_cluster | Ensure MSK Cluster logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 150 | CKV_AWS_81 | resource | aws_msk_cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 151 | CKV_AWS_82 | resource | aws_athena_workgroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 152 | CKV_AWS_83 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 153 | CKV_AWS_83 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 154 | CKV_AWS_84 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 155 | CKV_AWS_84 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 156 | CKV_AWS_85 | resource | aws_docdb_cluster | Ensure DocDB Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 157 | CKV_AWS_86 | resource | aws_cloudfront_distribution | Ensure Cloudfront distribution has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 158 | CKV_AWS_87 | resource | aws_redshift_cluster | Redshift cluster should not be publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 159 | CKV_AWS_88 | resource | aws_instance | EC2 instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 160 | CKV_AWS_88 | resource | aws_launch_template | EC2 instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 161 | CKV_AWS_89 | resource | aws_dms_replication_instance | DMS replication instance should not be publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 162 | CKV_AWS_90 | resource | aws_docdb_cluster_parameter_group | Ensure DocDB TLS is not disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 163 | CKV_AWS_91 | resource | aws_alb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 164 | CKV_AWS_91 | resource | aws_lb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 165 | CKV_AWS_92 | resource | aws_elb | Ensure the ELB has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 166 | CKV_AWS_93 | resource | aws_s3_bucket | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 167 | CKV_AWS_93 | resource | aws_s3_bucket_policy | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 168 | CKV_AWS_94 | resource | aws_glue_data_catalog_encryption_settings | Ensure Glue Data Catalog Encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 169 | CKV_AWS_96 | resource | aws_rds_cluster | Ensure all data stored in Aurora is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 170 | CKV_AWS_97 | resource | aws_ecs_task_definition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 171 | CKV_AWS_98 | resource | aws_sagemaker_endpoint_configuration | Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 172 | CKV_AWS_99 | resource | aws_glue_security_configuration | Ensure Glue Security Configuration Encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 173 | CKV_AWS_100 | resource | aws_eks_node_group | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 174 | CKV_AWS_101 | resource | aws_neptune_cluster | Ensure Neptune logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 175 | CKV_AWS_102 | resource | aws_neptune_cluster_instance | Ensure Neptune Cluster instance is not publicly available | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 176 | CKV_AWS_103 | resource | aws_alb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 177 | CKV_AWS_103 | resource | aws_lb | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 178 | CKV_AWS_103 | resource | aws_lb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 179 | CKV_AWS_104 | resource | aws_docdb_cluster_parameter_group | Ensure DocDB has audit logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 180 | CKV_AWS_105 | resource | aws_redshift_parameter_group | Ensure Redshift uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 181 | CKV_AWS_106 | resource | aws_ebs_encryption_by_default | Ensure EBS default encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 182 | CKV_AWS_107 | data | aws_iam_policy_document | Ensure IAM policies does not allow credentials exposure | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 183 | CKV_AWS_108 | data | aws_iam_policy_document | Ensure IAM policies does not allow data exfiltration | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 184 | CKV_AWS_109 | data | aws_iam_policy_document | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 185 | CKV_AWS_110 | data | aws_iam_policy_document | Ensure IAM policies does not allow privilege escalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 186 | CKV_AWS_111 | data | aws_iam_policy_document | Ensure IAM policies does not allow write access without constraints | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 187 | CKV_AWS_112 | resource | aws_ssm_document | Ensure Session Manager data is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 188 | CKV_AWS_113 | resource | aws_ssm_document | Ensure Session Manager logs are enabled and encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 189 | CKV_AWS_114 | resource | aws_emr_cluster | Ensure that EMR clusters with Kerberos have Kerberos Realm set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 190 | CKV_AWS_115 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 191 | CKV_AWS_116 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 192 | CKV_AWS_117 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 193 | CKV_AWS_118 | resource | aws_db_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 194 | CKV_AWS_118 | resource | aws_rds_cluster_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 195 | CKV_AWS_119 | resource | aws_dynamodb_table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 196 | CKV_AWS_120 | resource | aws_api_gateway_stage | Ensure API Gateway caching is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 197 | CKV_AWS_121 | resource | aws_config_configuration_aggregator | Ensure AWS Config is enabled in all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 198 | CKV_AWS_122 | resource | aws_sagemaker_notebook_instance | Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 199 | CKV_AWS_123 | resource | aws_vpc_endpoint_service | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 200 | CKV_AWS_124 | resource | aws_cloudformation_stack | Ensure that CloudFormation stacks are sending event notifications to an SNS topic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 201 | CKV_AWS_126 | resource | aws_instance | Ensure that detailed monitoring is enabled for EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 202 | CKV_AWS_127 | resource | aws_elb | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 203 | CKV_AWS_128 | resource | aws_rds_cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 204 | CKV_AWS_129 | resource | aws_db_instance | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 205 | CKV_AWS_130 | resource | aws_subnet | Ensure VPC subnets do not assign public IP by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 206 | CKV_AWS_131 | resource | aws_alb | Ensure that ALB drops HTTP headers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 207 | CKV_AWS_131 | resource | aws_lb | Ensure that ALB drops HTTP headers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 208 | CKV_AWS_133 | resource | aws_db_instance | Ensure that RDS instances has backup policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 209 | CKV_AWS_133 | resource | aws_rds_cluster | Ensure that RDS instances has backup policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 210 | CKV_AWS_134 | resource | aws_elasticache_cluster | Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 211 | CKV_AWS_135 | resource | aws_instance | Ensure that EC2 is EBS optimized | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 212 | CKV_AWS_136 | resource | aws_ecr_repository | Ensure that ECR repositories are encrypted using KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 213 | CKV_AWS_137 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 214 | CKV_AWS_137 | resource | aws_opensearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 215 | CKV_AWS_138 | resource | aws_elb | Ensure that ELB is cross-zone-load-balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 216 | CKV_AWS_139 | resource | aws_rds_cluster | Ensure that RDS clusters have deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 217 | CKV_AWS_140 | resource | aws_rds_global_cluster | Ensure that RDS global clusters are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 218 | CKV_AWS_141 | resource | aws_redshift_cluster | Ensured that redshift cluster allowing version upgrade by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 219 | CKV_AWS_142 | resource | aws_redshift_cluster | Ensure that Redshift cluster is encrypted by KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 220 | CKV_AWS_143 | resource | aws_s3_bucket | Ensure that S3 bucket has lock configuration enabled by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 221 | CKV_AWS_144 | resource | aws_s3_bucket | Ensure that S3 bucket has cross-region replication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 222 | CKV_AWS_144 | resource | aws_s3_bucket_replication_configuration | Ensure that S3 bucket has cross-region replication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 223 | CKV_AWS_145 | resource | aws_s3_bucket | Ensure that S3 buckets are encrypted with KMS by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 224 | CKV_AWS_145 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure that S3 buckets are encrypted with KMS by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 225 | CKV_AWS_146 | resource | aws_db_cluster_snapshot | Ensure that RDS database cluster snapshot is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 226 | CKV_AWS_147 | resource | aws_codebuild_project | Ensure that CodeBuild projects are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 227 | CKV_AWS_148 | resource | aws_default_vpc | Ensure no default VPC is planned to be provisioned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 228 | CKV_AWS_149 | resource | aws_secretsmanager_secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 229 | CKV_AWS_150 | resource | aws_alb | Ensure that Load Balancer has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 230 | CKV_AWS_150 | resource | aws_lb | Ensure that Load Balancer has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 231 | CKV_AWS_152 | resource | aws_alb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 232 | CKV_AWS_152 | resource | aws_lb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 233 | CKV_AWS_153 | resource | aws_autoscaling_group | Autoscaling groups should supply tags to launch configurations | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 234 | CKV_AWS_154 | resource | aws_redshift_cluster | Ensure Redshift is not deployed outside of a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 235 | CKV_AWS_155 | resource | aws_workspaces_workspace | Ensure that Workspace user volumes are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 236 | CKV_AWS_156 | resource | aws_workspaces_workspace | Ensure that Workspace root volumes are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 237 | CKV_AWS_157 | resource | aws_db_instance | Ensure that RDS instances have Multi-AZ enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 238 | CKV_AWS_158 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group is encrypted by KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 239 | CKV_AWS_159 | resource | aws_athena_workgroup | Ensure that Athena Workgroup is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 240 | CKV_AWS_160 | resource | aws_timestreamwrite_database | Ensure that Timestream database is encrypted with KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 241 | CKV_AWS_161 | resource | aws_db_instance | Ensure RDS database has IAM authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 242 | CKV_AWS_162 | resource | aws_rds_cluster | Ensure RDS cluster has IAM authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 243 | CKV_AWS_163 | resource | aws_ecr_repository | Ensure ECR image scanning on push is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 244 | CKV_AWS_164 | resource | aws_transfer_server | Ensure Transfer Server is not exposed publicly. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 245 | CKV_AWS_165 | resource | aws_dynamodb_global_table | Ensure Dynamodb point in time recovery (backup) is enabled for global tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 246 | CKV_AWS_166 | resource | aws_backup_vault | Ensure Backup Vault is encrypted at rest using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 247 | CKV_AWS_167 | resource | aws_glacier_vault | Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 248 | CKV_AWS_168 | resource | aws_sqs_queue | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 249 | CKV_AWS_168 | resource | aws_sqs_queue_policy | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 250 | CKV_AWS_169 | resource | aws_sns_topic_policy | Ensure SNS topic policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 251 | CKV_AWS_170 | resource | aws_qldb_ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 252 | CKV_AWS_171 | resource | aws_emr_security_configuration | Ensure Cluster security configuration encryption is using SSE-KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 253 | CKV_AWS_172 | resource | aws_qldb_ledger | Ensure QLDB ledger has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 254 | CKV_AWS_173 | resource | aws_lambda_function | Check encryption settings for Lambda environmental variable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 255 | CKV_AWS_174 | resource | aws_cloudfront_distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 256 | CKV_AWS_175 | resource | aws_waf_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 257 | CKV_AWS_175 | resource | aws_wafregional_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 258 | CKV_AWS_175 | resource | aws_wafv2_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 259 | CKV_AWS_176 | resource | aws_waf_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 260 | CKV_AWS_176 | resource | aws_wafregional_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 261 | CKV_AWS_177 | resource | aws_kinesis_video_stream | Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 262 | CKV_AWS_178 | resource | aws_fsx_ontap_file_system | Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 263 | CKV_AWS_179 | resource | aws_fsx_windows_file_system | Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 264 | CKV_AWS_180 | resource | aws_imagebuilder_component | Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 265 | CKV_AWS_181 | resource | aws_s3_object_copy | Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 266 | CKV_AWS_182 | resource | aws_docdb_cluster | Ensure Doc DB is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 267 | CKV_AWS_183 | resource | aws_ebs_snapshot_copy | Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 268 | CKV_AWS_184 | resource | aws_efs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 269 | CKV_AWS_185 | resource | aws_kinesis_stream | Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 270 | CKV_AWS_186 | resource | aws_s3_bucket_object | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 271 | CKV_AWS_187 | resource | aws_sagemaker_domain | Ensure Sagemaker domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 272 | CKV_AWS_188 | resource | aws_redshift_cluster | Ensure RedShift Cluster is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 273 | CKV_AWS_189 | resource | aws_ebs_volume | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 274 | CKV_AWS_190 | resource | aws_fsx_lustre_file_system | Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 275 | CKV_AWS_191 | resource | aws_elasticache_replication_group | Ensure Elasticache replication group is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 276 | CKV_AWS_192 | resource | aws_wafv2_web_acl | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 277 | CKV_AWS_193 | resource | aws_appsync_graphql_api | Ensure AppSync has Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 278 | CKV_AWS_194 | resource | aws_appsync_graphql_api | Ensure AppSync has Field-Level logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 279 | CKV_AWS_195 | resource | aws_glue_crawler | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 280 | CKV_AWS_195 | resource | aws_glue_dev_endpoint | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 281 | CKV_AWS_195 | resource | aws_glue_job | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 282 | CKV_AWS_196 | resource | aws_elasticache_security_group | Ensure no aws_elasticache_security_group resources exist | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 283 | CKV_AWS_197 | resource | aws_mq_broker | Ensure MQ Broker Audit logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 284 | CKV_AWS_198 | resource | aws_db_security_group | Ensure no aws_db_security_group resources exist | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 285 | CKV_AWS_199 | resource | aws_imagebuilder_distribution_configuration | Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 286 | CKV_AWS_200 | resource | aws_imagebuilder_image_recipe | Ensure that Image Recipe EBS Disk are encrypted with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 287 | CKV_AWS_201 | resource | aws_memorydb_cluster | Ensure MemoryDB is encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 288 | CKV_AWS_202 | resource | aws_memorydb_cluster | Ensure MemoryDB data is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 289 | CKV_AWS_203 | resource | aws_fsx_openzfs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 290 | CKV_AWS_204 | resource | aws_ami | Ensure AMIs are encrypted using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 291 | CKV_AWS_205 | resource | aws_ami_launch_permission | Ensure to Limit AMI launch Permissions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 292 | CKV_AWS_206 | resource | aws_api_gateway_domain_name | Ensure API Gateway Domain uses a modern security Policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 293 | CKV_AWS_207 | resource | aws_mq_broker | Ensure MQ Broker minor version updates are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 294 | CKV_AWS_208 | resource | aws_mq_broker | Ensure MQBroker version is current | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 295 | CKV_AWS_208 | resource | aws_mq_configuration | Ensure MQBroker version is current | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 296 | CKV_AWS_209 | resource | aws_mq_broker | Ensure MQ broker encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 297 | CKV_AWS_210 | resource | aws_batch_job_definition | Batch job does not define a privileged container | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 298 | CKV_AWS_211 | resource | aws_db_instance | Ensure RDS uses a modern CaCert | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 299 | CKV_AWS_212 | resource | aws_dms_replication_instance | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 300 | CKV_AWS_213 | resource | aws_load_balancer_policy | Ensure ELB Policy uses only secure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 301 | CKV_AWS_214 | resource | aws_appsync_api_cache | Ensure Appsync API Cache is encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 302 | CKV_AWS_215 | resource | aws_appsync_api_cache | Ensure Appsync API Cache is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 303 | CKV_AWS_216 | resource | aws_cloudfront_distribution | Ensure Cloudfront distribution is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 304 | CKV_AWS_217 | resource | aws_api_gateway_deployment | Ensure Create before destroy for API deployments | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 305 | CKV_AWS_218 | resource | aws_cloudsearch_domain | Ensure that Cloudsearch is using latest TLS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 306 | CKV_AWS_219 | resource | aws_codepipeline | Ensure Code Pipeline Artifact store is using a KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 307 | CKV_AWS_220 | resource | aws_cloudsearch_domain | Ensure that Cloudsearch is using https | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 308 | CKV_AWS_221 | resource | aws_codeartifact_domain | Ensure Code artifact Domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 309 | CKV_AWS_222 | resource | aws_dms_replication_instance | Ensure DMS instance gets all minor upgrade automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 310 | CKV_AWS_223 | resource | aws_ecs_cluster | Ensure ECS Cluster enables logging of ECS Exec | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 311 | CKV_AWS_224 | resource | aws_ecs_cluster | Ensure Cluster logging with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 312 | CKV_AWS_225 | resource | aws_api_gateway_method_settings | Ensure API Gateway method setting caching is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 313 | CKV_AWS_226 | resource | aws_db_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 314 | CKV_AWS_226 | resource | aws_rds_cluster_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 315 | CKV_AWS_227 | resource | aws_kms_key | Ensure KMS key is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 316 | CKV_AWS_228 | resource | aws_elasticsearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 317 | CKV_AWS_228 | resource | aws_opensearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 318 | CKV_AWS_229 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 319 | CKV_AWS_229 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 320 | CKV_AWS_230 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 321 | CKV_AWS_230 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 322 | CKV_AWS_231 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 323 | CKV_AWS_231 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 324 | CKV_AWS_232 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 325 | CKV_AWS_232 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 326 | CKV_AWS_233 | resource | aws_acm_certificate | Ensure Create before destroy for ACM certificates | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 327 | CKV_AWS_234 | resource | aws_acm_certificate | Verify logging preference for ACM certificates | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 328 | CKV_AWS_235 | resource | aws_ami_copy | Ensure that copied AMIs are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 329 | CKV_AWS_236 | resource | aws_ami_copy | Ensure AMI copying uses a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 330 | CKV_AWS_237 | resource | aws_api_gateway_rest_api | Ensure Create before destroy for API GATEWAY | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 331 | CKV_AWS_238 | resource | aws_guardduty_detector | Ensure that Guard Duty detector is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 332 | CKV_AWS_239 | resource | aws_dax_cluster | Ensure DAX cluster endpoint is using TLS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 333 | CKV_AWS_240 | resource | aws_kinesis_firehose_delivery_stream | Ensure Kinesis Firehose delivery stream is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 334 | CKV_AWS_241 | resource | aws_kinesis_firehose_delivery_stream | Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 335 | CKV_AWS_242 | resource | aws_mwaa_environment | Ensure MWAA environment has scheduler logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 336 | CKV_AWS_243 | resource | aws_mwaa_environment | Ensure MWAA environment has worker logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 337 | CKV_AWS_244 | resource | aws_mwaa_environment | Ensure MWAA environment has webserver logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 338 | CKV_AWS_245 | resource | aws_db_instance_automated_backups_replication | Ensure replicated backups are encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 339 | CKV_AWS_246 | resource | aws_rds_cluster_activity_stream | Ensure RDS Cluster activity streams are encrypted using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 340 | CKV_AWS_247 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 341 | CKV_AWS_247 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 342 | CKV_AWS_248 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 343 | CKV_AWS_248 | resource | aws_opensearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 344 | CKV_AWS_249 | resource | aws_ecs_task_definition | Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 345 | CKV_AWS_250 | resource | aws_db_instance | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 346 | CKV_AWS_250 | resource | aws_rds_cluster | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 347 | CKV_AWS_251 | resource | aws_cloudtrail | Ensure CloudTrail logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 348 | CKV_AWS_252 | resource | aws_cloudtrail | Ensure CloudTrail defines an SNS Topic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 349 | CKV_AWS_253 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 350 | CKV_AWS_254 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 351 | CKV_AWS_255 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 352 | CKV_AWS_256 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted using a Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 353 | CKV_AWS_257 | resource | aws_codecommit_approval_rule_template | Ensure codecommit branch changes have at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 354 | CKV_AWS_258 | resource | aws_lambda_function_url | Ensure that Lambda function URLs AuthType is not None | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 355 | CKV_AWS_259 | resource | aws_cloudfront_response_headers_policy | Ensure CloudFront response header policy enforces Strict Transport Security | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 356 | CKV_AWS_260 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 357 | CKV_AWS_260 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 358 | CKV_AWS_261 | resource | aws_alb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 359 | CKV_AWS_261 | resource | aws_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 360 | CKV_AWS_262 | resource | aws_kendra_index | Ensure Kendra index Server side encryption uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 361 | CKV_AWS_263 | resource | aws_appflow_flow | Ensure App Flow flow uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 362 | CKV_AWS_264 | resource | aws_appflow_connector_profile | Ensure App Flow connector profile uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 363 | CKV_AWS_265 | resource | aws_keyspaces_table | Ensure Keyspaces Table uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 364 | CKV_AWS_266 | resource | aws_db_snapshot_copy | Ensure App Flow connector profile uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 365 | CKV_AWS_267 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 366 | CKV_AWS_268 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 367 | CKV_AWS_269 | resource | aws_connect_instance_storage_config | Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 368 | CKV_AWS_270 | resource | aws_connect_instance_storage_config | Ensure Connect Instance S3 Storage Config uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 369 | CKV_AWS_271 | resource | aws_dynamodb_table_replica | Ensure DynamoDB table replica KMS encryption uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 370 | CKV_AWS_272 | resource | aws_lambda_function | Ensure AWS Lambda function is configured to validate code-signing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 371 | CKV_AWS_273 | resource | aws_iam_user | Ensure access is controlled through SSO and not AWS IAM defined users | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 372 | CKV_AWS_274 | resource | aws_iam_group_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 373 | CKV_AWS_274 | resource | aws_iam_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 374 | CKV_AWS_274 | resource | aws_iam_role | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 375 | CKV_AWS_274 | resource | aws_iam_role_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 376 | CKV_AWS_274 | resource | aws_iam_user_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 377 | CKV_AWS_275 | data | aws_iam_policy | Disallow policies from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 378 | CKV_AWS_276 | resource | aws_api_gateway_method_settings | Ensure Data Trace is not enabled in API Gateway Method Settings | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 379 | CKV_AWS_277 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 380 | CKV_AWS_277 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 381 | CKV_AWS_278 | resource | aws_memorydb_snapshot | Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 382 | CKV_AWS_279 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 383 | CKV_AWS_280 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 384 | CKV_AWS_281 | resource | aws_redshift_snapshot_copy_grant | Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 385 | CKV_AWS_282 | resource | aws_redshiftserverless_namespace | Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 386 | CKV2_AWS_1 | resource | aws_network_acl | Ensure that all NACL are attached to subnets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 387 | CKV2_AWS_1 | resource | aws_subnet | Ensure that all NACL are attached to subnets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 388 | CKV2_AWS_2 | resource | aws_ebs_volume | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 389 | CKV2_AWS_2 | resource | aws_volume_attachment | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 390 | CKV2_AWS_3 | resource | aws_guardduty_detector | Ensure GuardDuty is enabled to specific org/region | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 391 | CKV2_AWS_3 | resource | aws_guardduty_organization_configuration | Ensure GuardDuty is enabled to specific org/region | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 392 | CKV2_AWS_4 | resource | aws_api_gateway_method_settings | Ensure API Gateway stage have logging level defined as appropriate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 393 | CKV2_AWS_4 | resource | aws_api_gateway_stage | Ensure API Gateway stage have logging level defined as appropriate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 394 | CKV2_AWS_5 | resource | aws_security_group | Ensure that Security Groups are attached to another resource | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 395 | CKV2_AWS_6 | resource | aws_s3_bucket | Ensure that S3 bucket has a Public Access block | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 396 | CKV2_AWS_6 | resource | aws_s3_bucket_public_access_block | Ensure that S3 bucket has a Public Access block | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 397 | CKV2_AWS_7 | resource | aws_emr_cluster | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 398 | CKV2_AWS_7 | resource | aws_security_group | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 399 | CKV2_AWS_8 | resource | aws_rds_cluster | Ensure that RDS clusters has backup plan of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 400 | CKV2_AWS_9 | resource | aws_backup_selection | Ensure that EBS are added in the backup plans of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 401 | CKV2_AWS_10 | resource | aws_cloudtrail | Ensure CloudTrail trails are integrated with CloudWatch Logs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 402 | CKV2_AWS_11 | resource | aws_vpc | Ensure VPC flow logging is enabled in all VPCs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 403 | CKV2_AWS_12 | resource | aws_default_security_group | Ensure the default security group of every VPC restricts all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 404 | CKV2_AWS_12 | resource | aws_vpc | Ensure the default security group of every VPC restricts all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 405 | CKV2_AWS_14 | resource | aws_iam_group | Ensure that IAM groups includes at least one IAM user | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 406 | CKV2_AWS_14 | resource | aws_iam_group_membership | Ensure that IAM groups includes at least one IAM user | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 407 | CKV2_AWS_15 | resource | aws_autoscaling_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 408 | CKV2_AWS_15 | resource | aws_elb | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 409 | CKV2_AWS_15 | resource | aws_lb_target_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 410 | CKV2_AWS_16 | resource | aws_appautoscaling_target | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 411 | CKV2_AWS_16 | resource | aws_dynamodb_table | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 412 | CKV2_AWS_18 | resource | aws_backup_selection | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 413 | CKV2_AWS_19 | resource | aws_eip | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 414 | CKV2_AWS_19 | resource | aws_eip_association | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 415 | CKV2_AWS_20 | resource | aws_alb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 416 | CKV2_AWS_20 | resource | aws_alb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 417 | CKV2_AWS_20 | resource | aws_lb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 418 | CKV2_AWS_20 | resource | aws_lb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 419 | CKV2_AWS_21 | resource | aws_iam_group_membership | Ensure that all IAM users are members of at least one IAM group. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 420 | CKV2_AWS_22 | resource | aws_iam_user | Ensure an IAM User does not have access to the console | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 421 | CKV2_AWS_23 | resource | aws_route53_record | Route53 A Record has Attached Resource | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 422 | CKV2_AWS_27 | resource | aws_rds_cluster | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 423 | CKV2_AWS_27 | resource | aws_rds_cluster_parameter_group | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 424 | CKV2_AWS_28 | resource | aws_alb | Ensure public facing ALB are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 425 | CKV2_AWS_28 | resource | aws_lb | Ensure public facing ALB are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 426 | CKV2_AWS_29 | resource | aws_api_gateway_rest_api | Ensure public API gateway are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 427 | CKV2_AWS_29 | resource | aws_api_gateway_stage | Ensure public API gateway are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 428 | CKV2_AWS_30 | resource | aws_db_instance | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 429 | CKV2_AWS_30 | resource | aws_db_parameter_group | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 430 | CKV2_AWS_31 | resource | aws_wafv2_web_acl | Ensure WAF2 has a Logging Configuration | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 431 | CKV2_AWS_32 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has a response headers policy attached | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 432 | CKV2_AWS_33 | resource | aws_appsync_graphql_api | Ensure AppSync is protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 433 | CKV2_AWS_34 | resource | aws_ssm_parameter | AWS SSM Parameter should be Encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 434 | CKV2_AWS_35 | resource | aws_route | AWS NAT Gateways should be utilized for the default route | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 435 | CKV2_AWS_35 | resource | aws_route_table | AWS NAT Gateways should be utilized for the default route | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 436 | CKV2_AWS_36 | resource | aws_ssm_parameter | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 437 | CKV2_AWS_36 | resource | data.http | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 438 | CKV2_AWS_37 | resource | aws | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 439 | CKV2_AWS_37 | resource | aws_accessanalyzer_analyzer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 440 | CKV2_AWS_37 | resource | aws_acm_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 441 | CKV2_AWS_37 | resource | aws_acm_certificate_validation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 442 | CKV2_AWS_37 | resource | aws_acmpca_certificate_authority | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 443 | CKV2_AWS_37 | resource | aws_ami | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 444 | CKV2_AWS_37 | resource | aws_ami_copy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 445 | CKV2_AWS_37 | resource | aws_ami_from_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 446 | CKV2_AWS_37 | resource | aws_ami_launch_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 447 | CKV2_AWS_37 | resource | aws_api_gateway_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 448 | CKV2_AWS_37 | resource | aws_api_gateway_api_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 449 | CKV2_AWS_37 | resource | aws_api_gateway_authorizer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 450 | CKV2_AWS_37 | resource | aws_api_gateway_base_path_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 451 | CKV2_AWS_37 | resource | aws_api_gateway_client_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 452 | CKV2_AWS_37 | resource | aws_api_gateway_deployment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 453 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_part | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 454 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 455 | CKV2_AWS_37 | resource | aws_api_gateway_domain_name | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 456 | CKV2_AWS_37 | resource | aws_api_gateway_gateway_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 457 | CKV2_AWS_37 | resource | aws_api_gateway_integration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 458 | CKV2_AWS_37 | resource | aws_api_gateway_integration_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 459 | CKV2_AWS_37 | resource | aws_api_gateway_method | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 460 | CKV2_AWS_37 | resource | aws_api_gateway_method_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 461 | CKV2_AWS_37 | resource | aws_api_gateway_method_settings | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 462 | CKV2_AWS_37 | resource | aws_api_gateway_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 463 | CKV2_AWS_37 | resource | aws_api_gateway_request_validator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 464 | CKV2_AWS_37 | resource | aws_api_gateway_resource | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 465 | CKV2_AWS_37 | resource | aws_api_gateway_rest_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 466 | CKV2_AWS_37 | resource | aws_api_gateway_stage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 467 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 468 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 469 | CKV2_AWS_37 | resource | aws_api_gateway_vpc_link | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 470 | CKV2_AWS_37 | resource | aws_apigatewayv2_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 471 | CKV2_AWS_37 | resource | aws_apigatewayv2_api_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 472 | CKV2_AWS_37 | resource | aws_apigatewayv2_authorizer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 473 | CKV2_AWS_37 | resource | aws_apigatewayv2_deployment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 474 | CKV2_AWS_37 | resource | aws_apigatewayv2_domain_name | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 475 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 476 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 477 | CKV2_AWS_37 | resource | aws_apigatewayv2_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 478 | CKV2_AWS_37 | resource | aws_apigatewayv2_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 479 | CKV2_AWS_37 | resource | aws_apigatewayv2_route_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 480 | CKV2_AWS_37 | resource | aws_apigatewayv2_stage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 481 | CKV2_AWS_37 | resource | aws_apigatewayv2_vpc_link | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 482 | CKV2_AWS_37 | resource | aws_app_cookie_stickiness_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 483 | CKV2_AWS_37 | resource | aws_appautoscaling_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 484 | CKV2_AWS_37 | resource | aws_appautoscaling_scheduled_action | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 485 | CKV2_AWS_37 | resource | aws_appautoscaling_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 486 | CKV2_AWS_37 | resource | aws_appmesh_mesh | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 487 | CKV2_AWS_37 | resource | aws_appmesh_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 488 | CKV2_AWS_37 | resource | aws_appmesh_virtual_node | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 489 | CKV2_AWS_37 | resource | aws_appmesh_virtual_router | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 490 | CKV2_AWS_37 | resource | aws_appmesh_virtual_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 491 | CKV2_AWS_37 | resource | aws_appsync_api_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 492 | CKV2_AWS_37 | resource | aws_appsync_datasource | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 493 | CKV2_AWS_37 | resource | aws_appsync_function | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 494 | CKV2_AWS_37 | resource | aws_appsync_graphql_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 495 | CKV2_AWS_37 | resource | aws_appsync_resolver | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 496 | CKV2_AWS_37 | resource | aws_athena_database | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 497 | CKV2_AWS_37 | resource | aws_athena_named_query | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 498 | CKV2_AWS_37 | resource | aws_athena_workgroup | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 499 | CKV2_AWS_37 | resource | aws_autoscaling_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 500 | CKV2_AWS_37 | resource | aws_autoscaling_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 501 | CKV2_AWS_37 | resource | aws_autoscaling_lifecycle_hook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 502 | CKV2_AWS_37 | resource | aws_autoscaling_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 503 | CKV2_AWS_37 | resource | aws_autoscaling_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 504 | CKV2_AWS_37 | resource | aws_autoscaling_schedule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 505 | CKV2_AWS_37 | resource | aws_backup_plan | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 506 | CKV2_AWS_37 | resource | aws_backup_selection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 507 | CKV2_AWS_37 | resource | aws_backup_vault | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 508 | CKV2_AWS_37 | resource | aws_batch_compute_environment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 509 | CKV2_AWS_37 | resource | aws_batch_job_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 510 | CKV2_AWS_37 | resource | aws_batch_job_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 511 | CKV2_AWS_37 | resource | aws_budgets_budget | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 512 | CKV2_AWS_37 | resource | aws_cloud9_environment_ec2 | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 513 | CKV2_AWS_37 | resource | aws_cloudformation_stack | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 514 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 515 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 516 | CKV2_AWS_37 | resource | aws_cloudfront_distribution | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 517 | CKV2_AWS_37 | resource | aws_cloudfront_origin_access_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 518 | CKV2_AWS_37 | resource | aws_cloudfront_public_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 519 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 520 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_hsm | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 521 | CKV2_AWS_37 | resource | aws_cloudtrail | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 522 | CKV2_AWS_37 | resource | aws_cloudwatch_dashboard | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 523 | CKV2_AWS_37 | resource | aws_cloudwatch_event_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 524 | CKV2_AWS_37 | resource | aws_cloudwatch_event_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 525 | CKV2_AWS_37 | resource | aws_cloudwatch_event_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 526 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 527 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 528 | CKV2_AWS_37 | resource | aws_cloudwatch_log_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 529 | CKV2_AWS_37 | resource | aws_cloudwatch_log_metric_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 530 | CKV2_AWS_37 | resource | aws_cloudwatch_log_resource_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 531 | CKV2_AWS_37 | resource | aws_cloudwatch_log_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 532 | CKV2_AWS_37 | resource | aws_cloudwatch_log_subscription_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 533 | CKV2_AWS_37 | resource | aws_cloudwatch_metric_alarm | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 534 | CKV2_AWS_37 | resource | aws_codebuild_project | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 535 | CKV2_AWS_37 | resource | aws_codebuild_source_credential | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 536 | CKV2_AWS_37 | resource | aws_codebuild_webhook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 537 | CKV2_AWS_37 | resource | aws_codecommit_repository | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 538 | CKV2_AWS_37 | resource | aws_codecommit_trigger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 539 | CKV2_AWS_37 | resource | aws_codedeploy_app | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 540 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 541 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 542 | CKV2_AWS_37 | resource | aws_codepipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 543 | CKV2_AWS_37 | resource | aws_codepipeline_webhook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 544 | CKV2_AWS_37 | resource | aws_codestarnotifications_notification_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 545 | CKV2_AWS_37 | resource | aws_cognito_identity_pool | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 546 | CKV2_AWS_37 | resource | aws_cognito_identity_pool_roles_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 547 | CKV2_AWS_37 | resource | aws_cognito_identity_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 548 | CKV2_AWS_37 | resource | aws_cognito_resource_server | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 549 | CKV2_AWS_37 | resource | aws_cognito_user_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 550 | CKV2_AWS_37 | resource | aws_cognito_user_pool | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 551 | CKV2_AWS_37 | resource | aws_cognito_user_pool_client | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 552 | CKV2_AWS_37 | resource | aws_cognito_user_pool_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 553 | CKV2_AWS_37 | resource | aws_config_aggregate_authorization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 554 | CKV2_AWS_37 | resource | aws_config_config_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 555 | CKV2_AWS_37 | resource | aws_config_configuration_aggregator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 556 | CKV2_AWS_37 | resource | aws_config_configuration_recorder | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 557 | CKV2_AWS_37 | resource | aws_config_configuration_recorder_status | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 558 | CKV2_AWS_37 | resource | aws_config_delivery_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 559 | CKV2_AWS_37 | resource | aws_config_organization_custom_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 560 | CKV2_AWS_37 | resource | aws_config_organization_managed_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 561 | CKV2_AWS_37 | resource | aws_cur_report_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 562 | CKV2_AWS_37 | resource | aws_customer_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 563 | CKV2_AWS_37 | resource | aws_datapipeline_pipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 564 | CKV2_AWS_37 | resource | aws_datasync_agent | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 565 | CKV2_AWS_37 | resource | aws_datasync_location_efs | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 566 | CKV2_AWS_37 | resource | aws_datasync_location_nfs | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 567 | CKV2_AWS_37 | resource | aws_datasync_location_s3 | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 568 | CKV2_AWS_37 | resource | aws_datasync_location_smb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 569 | CKV2_AWS_37 | resource | aws_datasync_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 570 | CKV2_AWS_37 | resource | aws_dax_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 571 | CKV2_AWS_37 | resource | aws_dax_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 572 | CKV2_AWS_37 | resource | aws_dax_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 573 | CKV2_AWS_37 | resource | aws_db_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 574 | CKV2_AWS_37 | resource | aws_db_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 575 | CKV2_AWS_37 | resource | aws_db_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 576 | CKV2_AWS_37 | resource | aws_db_instance_role_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 577 | CKV2_AWS_37 | resource | aws_db_option_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 578 | CKV2_AWS_37 | resource | aws_db_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 579 | CKV2_AWS_37 | resource | aws_db_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 580 | CKV2_AWS_37 | resource | aws_db_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 581 | CKV2_AWS_37 | resource | aws_db_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 582 | CKV2_AWS_37 | resource | aws_default_network_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 583 | CKV2_AWS_37 | resource | aws_default_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 584 | CKV2_AWS_37 | resource | aws_default_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 585 | CKV2_AWS_37 | resource | aws_default_subnet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 586 | CKV2_AWS_37 | resource | aws_default_vpc | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 587 | CKV2_AWS_37 | resource | aws_default_vpc_dhcp_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 588 | CKV2_AWS_37 | resource | aws_devicefarm_project | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 589 | CKV2_AWS_37 | resource | aws_directory_service_conditional_forwarder | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 590 | CKV2_AWS_37 | resource | aws_directory_service_directory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 591 | CKV2_AWS_37 | resource | aws_directory_service_log_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 592 | CKV2_AWS_37 | resource | aws_dlm_lifecycle_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 593 | CKV2_AWS_37 | resource | aws_dms_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 594 | CKV2_AWS_37 | resource | aws_dms_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 595 | CKV2_AWS_37 | resource | aws_dms_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 596 | CKV2_AWS_37 | resource | aws_dms_replication_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 597 | CKV2_AWS_37 | resource | aws_dms_replication_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 598 | CKV2_AWS_37 | resource | aws_dms_replication_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 599 | CKV2_AWS_37 | resource | aws_docdb_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 600 | CKV2_AWS_37 | resource | aws_docdb_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 601 | CKV2_AWS_37 | resource | aws_docdb_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 602 | CKV2_AWS_37 | resource | aws_docdb_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 603 | CKV2_AWS_37 | resource | aws_docdb_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 604 | CKV2_AWS_37 | resource | aws_dx_bgp_peer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 605 | CKV2_AWS_37 | resource | aws_dx_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 606 | CKV2_AWS_37 | resource | aws_dx_connection_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 607 | CKV2_AWS_37 | resource | aws_dx_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 608 | CKV2_AWS_37 | resource | aws_dx_gateway_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 609 | CKV2_AWS_37 | resource | aws_dx_gateway_association_proposal | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 610 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 611 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 612 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 613 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 614 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 615 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 616 | CKV2_AWS_37 | resource | aws_dx_lag | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 617 | CKV2_AWS_37 | resource | aws_dx_private_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 618 | CKV2_AWS_37 | resource | aws_dx_public_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 619 | CKV2_AWS_37 | resource | aws_dx_transit_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 620 | CKV2_AWS_37 | resource | aws_dynamodb_global_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 621 | CKV2_AWS_37 | resource | aws_dynamodb_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 622 | CKV2_AWS_37 | resource | aws_dynamodb_table_item | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 623 | CKV2_AWS_37 | resource | aws_ebs_default_kms_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 624 | CKV2_AWS_37 | resource | aws_ebs_encryption_by_default | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 625 | CKV2_AWS_37 | resource | aws_ebs_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 626 | CKV2_AWS_37 | resource | aws_ebs_snapshot_copy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 627 | CKV2_AWS_37 | resource | aws_ebs_volume | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 628 | CKV2_AWS_37 | resource | aws_ec2_availability_zone_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 629 | CKV2_AWS_37 | resource | aws_ec2_capacity_reservation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 630 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_authorization_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 631 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 632 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_network_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 633 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 634 | CKV2_AWS_37 | resource | aws_ec2_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 635 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 636 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 637 | CKV2_AWS_37 | resource | aws_ec2_tag | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 638 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 639 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 640 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_session | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 641 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 642 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 643 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 644 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 645 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 646 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 647 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 648 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 649 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 650 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 651 | CKV2_AWS_37 | resource | aws_ecr_lifecycle_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 652 | CKV2_AWS_37 | resource | aws_ecr_repository | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 653 | CKV2_AWS_37 | resource | aws_ecr_repository_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 654 | CKV2_AWS_37 | resource | aws_ecs_capacity_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 655 | CKV2_AWS_37 | resource | aws_ecs_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 656 | CKV2_AWS_37 | resource | aws_ecs_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 657 | CKV2_AWS_37 | resource | aws_ecs_task_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 658 | CKV2_AWS_37 | resource | aws_efs_access_point | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 659 | CKV2_AWS_37 | resource | aws_efs_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 660 | CKV2_AWS_37 | resource | aws_efs_file_system_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 661 | CKV2_AWS_37 | resource | aws_efs_mount_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 662 | CKV2_AWS_37 | resource | aws_egress_only_internet_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 663 | CKV2_AWS_37 | resource | aws_eip | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 664 | CKV2_AWS_37 | resource | aws_eip_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 665 | CKV2_AWS_37 | resource | aws_eks_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 666 | CKV2_AWS_37 | resource | aws_eks_fargate_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 667 | CKV2_AWS_37 | resource | aws_eks_node_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 668 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 669 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 670 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_configuration_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 671 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_environment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 672 | CKV2_AWS_37 | resource | aws_elasticache_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 673 | CKV2_AWS_37 | resource | aws_elasticache_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 674 | CKV2_AWS_37 | resource | aws_elasticache_replication_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 675 | CKV2_AWS_37 | resource | aws_elasticache_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 676 | CKV2_AWS_37 | resource | aws_elasticache_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 677 | CKV2_AWS_37 | resource | aws_elasticsearch_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 678 | CKV2_AWS_37 | resource | aws_elasticsearch_domain_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 679 | CKV2_AWS_37 | resource | aws_elastictranscoder_pipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 680 | CKV2_AWS_37 | resource | aws_elastictranscoder_preset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 681 | CKV2_AWS_37 | resource | aws_elb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 682 | CKV2_AWS_37 | resource | aws_elb_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 683 | CKV2_AWS_37 | resource | aws_emr_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 684 | CKV2_AWS_37 | resource | aws_emr_instance_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 685 | CKV2_AWS_37 | resource | aws_emr_security_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 686 | CKV2_AWS_37 | resource | aws_flow_log | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 687 | CKV2_AWS_37 | resource | aws_fms_admin_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 688 | CKV2_AWS_37 | resource | aws_fsx_lustre_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 689 | CKV2_AWS_37 | resource | aws_fsx_windows_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 690 | CKV2_AWS_37 | resource | aws_gamelift_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 691 | CKV2_AWS_37 | resource | aws_gamelift_build | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 692 | CKV2_AWS_37 | resource | aws_gamelift_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 693 | CKV2_AWS_37 | resource | aws_gamelift_game_session_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 694 | CKV2_AWS_37 | resource | aws_glacier_vault | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 695 | CKV2_AWS_37 | resource | aws_glacier_vault_lock | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 696 | CKV2_AWS_37 | resource | aws_globalaccelerator_accelerator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 697 | CKV2_AWS_37 | resource | aws_globalaccelerator_endpoint_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 698 | CKV2_AWS_37 | resource | aws_globalaccelerator_listener | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 699 | CKV2_AWS_37 | resource | aws_glue_catalog_database | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 700 | CKV2_AWS_37 | resource | aws_glue_catalog_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 701 | CKV2_AWS_37 | resource | aws_glue_classifier | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 702 | CKV2_AWS_37 | resource | aws_glue_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 703 | CKV2_AWS_37 | resource | aws_glue_crawler | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 704 | CKV2_AWS_37 | resource | aws_glue_job | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 705 | CKV2_AWS_37 | resource | aws_glue_security_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 706 | CKV2_AWS_37 | resource | aws_glue_trigger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 707 | CKV2_AWS_37 | resource | aws_glue_workflow | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 708 | CKV2_AWS_37 | resource | aws_guardduty_detector | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 709 | CKV2_AWS_37 | resource | aws_guardduty_invite_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 710 | CKV2_AWS_37 | resource | aws_guardduty_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 711 | CKV2_AWS_37 | resource | aws_guardduty_member | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 712 | CKV2_AWS_37 | resource | aws_guardduty_organization_admin_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 713 | CKV2_AWS_37 | resource | aws_guardduty_organization_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 714 | CKV2_AWS_37 | resource | aws_guardduty_threatintelset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 715 | CKV2_AWS_37 | resource | aws_iam_access_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 716 | CKV2_AWS_37 | resource | aws_iam_account_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 717 | CKV2_AWS_37 | resource | aws_iam_account_password_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 718 | CKV2_AWS_37 | resource | aws_iam_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 719 | CKV2_AWS_37 | resource | aws_iam_group_membership | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 720 | CKV2_AWS_37 | resource | aws_iam_group_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 721 | CKV2_AWS_37 | resource | aws_iam_group_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 722 | CKV2_AWS_37 | resource | aws_iam_instance_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 723 | CKV2_AWS_37 | resource | aws_iam_openid_connect_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 724 | CKV2_AWS_37 | resource | aws_iam_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 725 | CKV2_AWS_37 | resource | aws_iam_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 726 | CKV2_AWS_37 | resource | aws_iam_policy_document | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 727 | CKV2_AWS_37 | resource | aws_iam_role | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 728 | CKV2_AWS_37 | resource | aws_iam_role_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 729 | CKV2_AWS_37 | resource | aws_iam_role_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 730 | CKV2_AWS_37 | resource | aws_iam_saml_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 731 | CKV2_AWS_37 | resource | aws_iam_server_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 732 | CKV2_AWS_37 | resource | aws_iam_service_linked_role | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 733 | CKV2_AWS_37 | resource | aws_iam_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 734 | CKV2_AWS_37 | resource | aws_iam_user_group_membership | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 735 | CKV2_AWS_37 | resource | aws_iam_user_login_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 736 | CKV2_AWS_37 | resource | aws_iam_user_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 737 | CKV2_AWS_37 | resource | aws_iam_user_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 738 | CKV2_AWS_37 | resource | aws_iam_user_ssh_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 739 | CKV2_AWS_37 | resource | aws_inspector_assessment_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 740 | CKV2_AWS_37 | resource | aws_inspector_assessment_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 741 | CKV2_AWS_37 | resource | aws_inspector_resource_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 742 | CKV2_AWS_37 | resource | aws_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 743 | CKV2_AWS_37 | resource | aws_internet_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 744 | CKV2_AWS_37 | resource | aws_iot_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 745 | CKV2_AWS_37 | resource | aws_iot_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 746 | CKV2_AWS_37 | resource | aws_iot_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 747 | CKV2_AWS_37 | resource | aws_iot_role_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 748 | CKV2_AWS_37 | resource | aws_iot_thing | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 749 | CKV2_AWS_37 | resource | aws_iot_thing_principal_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 750 | CKV2_AWS_37 | resource | aws_iot_thing_type | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 751 | CKV2_AWS_37 | resource | aws_iot_topic_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 752 | CKV2_AWS_37 | resource | aws_key_pair | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 753 | CKV2_AWS_37 | resource | aws_kinesis_analytics_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 754 | CKV2_AWS_37 | resource | aws_kinesis_firehose_delivery_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 755 | CKV2_AWS_37 | resource | aws_kinesis_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 756 | CKV2_AWS_37 | resource | aws_kinesis_video_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 757 | CKV2_AWS_37 | resource | aws_kms_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 758 | CKV2_AWS_37 | resource | aws_kms_ciphertext | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 759 | CKV2_AWS_37 | resource | aws_kms_external_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 760 | CKV2_AWS_37 | resource | aws_kms_grant | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 761 | CKV2_AWS_37 | resource | aws_kms_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 762 | CKV2_AWS_37 | resource | aws_lambda_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 763 | CKV2_AWS_37 | resource | aws_lambda_event_source_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 764 | CKV2_AWS_37 | resource | aws_lambda_function | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 765 | CKV2_AWS_37 | resource | aws_lambda_function_event_invoke_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 766 | CKV2_AWS_37 | resource | aws_lambda_layer_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 767 | CKV2_AWS_37 | resource | aws_lambda_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 768 | CKV2_AWS_37 | resource | aws_lambda_provisioned_concurrency_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 769 | CKV2_AWS_37 | resource | aws_launch_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 770 | CKV2_AWS_37 | resource | aws_launch_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 771 | CKV2_AWS_37 | resource | aws_lb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 772 | CKV2_AWS_37 | resource | aws_lb_cookie_stickiness_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 773 | CKV2_AWS_37 | resource | aws_lb_listener | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 774 | CKV2_AWS_37 | resource | aws_lb_listener_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 775 | CKV2_AWS_37 | resource | aws_lb_listener_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 776 | CKV2_AWS_37 | resource | aws_lb_ssl_negotiation_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 777 | CKV2_AWS_37 | resource | aws_lb_target_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 778 | CKV2_AWS_37 | resource | aws_lb_target_group_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 779 | CKV2_AWS_37 | resource | aws_licensemanager_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 780 | CKV2_AWS_37 | resource | aws_licensemanager_license_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 781 | CKV2_AWS_37 | resource | aws_lightsail_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 782 | CKV2_AWS_37 | resource | aws_lightsail_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 783 | CKV2_AWS_37 | resource | aws_lightsail_key_pair | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 784 | CKV2_AWS_37 | resource | aws_lightsail_static_ip | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 785 | CKV2_AWS_37 | resource | aws_lightsail_static_ip_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 786 | CKV2_AWS_37 | resource | aws_load_balancer_backend_server_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 787 | CKV2_AWS_37 | resource | aws_load_balancer_listener_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 788 | CKV2_AWS_37 | resource | aws_load_balancer_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 789 | CKV2_AWS_37 | resource | aws_macie_member_account_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 790 | CKV2_AWS_37 | resource | aws_macie_s3_bucket_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 791 | CKV2_AWS_37 | resource | aws_main_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 792 | CKV2_AWS_37 | resource | aws_media_convert_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 793 | CKV2_AWS_37 | resource | aws_media_package_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 794 | CKV2_AWS_37 | resource | aws_media_store_container | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 795 | CKV2_AWS_37 | resource | aws_media_store_container_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 796 | CKV2_AWS_37 | resource | aws_mq_broker | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 797 | CKV2_AWS_37 | resource | aws_mq_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 798 | CKV2_AWS_37 | resource | aws_msk_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 799 | CKV2_AWS_37 | resource | aws_msk_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 800 | CKV2_AWS_37 | resource | aws_nat_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 801 | CKV2_AWS_37 | resource | aws_neptune_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 802 | CKV2_AWS_37 | resource | aws_neptune_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 803 | CKV2_AWS_37 | resource | aws_neptune_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 804 | CKV2_AWS_37 | resource | aws_neptune_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 805 | CKV2_AWS_37 | resource | aws_neptune_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 806 | CKV2_AWS_37 | resource | aws_neptune_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 807 | CKV2_AWS_37 | resource | aws_neptune_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 808 | CKV2_AWS_37 | resource | aws_network_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 809 | CKV2_AWS_37 | resource | aws_network_acl_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 810 | CKV2_AWS_37 | resource | aws_network_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 811 | CKV2_AWS_37 | resource | aws_network_interface_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 812 | CKV2_AWS_37 | resource | aws_network_interface_sg_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 813 | CKV2_AWS_37 | resource | aws_opsworks_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 814 | CKV2_AWS_37 | resource | aws_opsworks_custom_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 815 | CKV2_AWS_37 | resource | aws_opsworks_ganglia_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 816 | CKV2_AWS_37 | resource | aws_opsworks_haproxy_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 817 | CKV2_AWS_37 | resource | aws_opsworks_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 818 | CKV2_AWS_37 | resource | aws_opsworks_java_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 819 | CKV2_AWS_37 | resource | aws_opsworks_memcached_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 820 | CKV2_AWS_37 | resource | aws_opsworks_mysql_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 821 | CKV2_AWS_37 | resource | aws_opsworks_nodejs_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 822 | CKV2_AWS_37 | resource | aws_opsworks_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 823 | CKV2_AWS_37 | resource | aws_opsworks_php_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 824 | CKV2_AWS_37 | resource | aws_opsworks_rails_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 825 | CKV2_AWS_37 | resource | aws_opsworks_rds_db_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 826 | CKV2_AWS_37 | resource | aws_opsworks_stack | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 827 | CKV2_AWS_37 | resource | aws_opsworks_static_web_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 828 | CKV2_AWS_37 | resource | aws_opsworks_user_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 829 | CKV2_AWS_37 | resource | aws_organizations_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 830 | CKV2_AWS_37 | resource | aws_organizations_organization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 831 | CKV2_AWS_37 | resource | aws_organizations_organizational_unit | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 832 | CKV2_AWS_37 | resource | aws_organizations_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 833 | CKV2_AWS_37 | resource | aws_organizations_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 834 | CKV2_AWS_37 | resource | aws_pinpoint_adm_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 835 | CKV2_AWS_37 | resource | aws_pinpoint_apns_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 836 | CKV2_AWS_37 | resource | aws_pinpoint_apns_sandbox_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 837 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 838 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 839 | CKV2_AWS_37 | resource | aws_pinpoint_app | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 840 | CKV2_AWS_37 | resource | aws_pinpoint_baidu_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 841 | CKV2_AWS_37 | resource | aws_pinpoint_email_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 842 | CKV2_AWS_37 | resource | aws_pinpoint_event_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 843 | CKV2_AWS_37 | resource | aws_pinpoint_gcm_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 844 | CKV2_AWS_37 | resource | aws_pinpoint_sms_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 845 | CKV2_AWS_37 | resource | aws_placement_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 846 | CKV2_AWS_37 | resource | aws_proxy_protocol_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 847 | CKV2_AWS_37 | resource | aws_qldb_ledger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 848 | CKV2_AWS_37 | resource | aws_quicksight_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 849 | CKV2_AWS_37 | resource | aws_quicksight_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 850 | CKV2_AWS_37 | resource | aws_ram_principal_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 851 | CKV2_AWS_37 | resource | aws_ram_resource_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 852 | CKV2_AWS_37 | resource | aws_ram_resource_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 853 | CKV2_AWS_37 | resource | aws_ram_resource_share_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 854 | CKV2_AWS_37 | resource | aws_rds_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 855 | CKV2_AWS_37 | resource | aws_rds_cluster_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 856 | CKV2_AWS_37 | resource | aws_rds_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 857 | CKV2_AWS_37 | resource | aws_rds_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 858 | CKV2_AWS_37 | resource | aws_rds_global_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 859 | CKV2_AWS_37 | resource | aws_redshift_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 860 | CKV2_AWS_37 | resource | aws_redshift_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 861 | CKV2_AWS_37 | resource | aws_redshift_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 862 | CKV2_AWS_37 | resource | aws_redshift_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 863 | CKV2_AWS_37 | resource | aws_redshift_snapshot_copy_grant | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 864 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 865 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 866 | CKV2_AWS_37 | resource | aws_redshift_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 867 | CKV2_AWS_37 | resource | aws_resourcegroups_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 868 | CKV2_AWS_37 | resource | aws_root | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 869 | CKV2_AWS_37 | resource | aws_root_access_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 870 | CKV2_AWS_37 | resource | aws_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 871 | CKV2_AWS_37 | resource | aws_route53_delegation_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 872 | CKV2_AWS_37 | resource | aws_route53_health_check | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 873 | CKV2_AWS_37 | resource | aws_route53_query_log | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 874 | CKV2_AWS_37 | resource | aws_route53_record | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 875 | CKV2_AWS_37 | resource | aws_route53_resolver_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 876 | CKV2_AWS_37 | resource | aws_route53_resolver_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 877 | CKV2_AWS_37 | resource | aws_route53_resolver_rule_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 878 | CKV2_AWS_37 | resource | aws_route53_vpc_association_authorization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 879 | CKV2_AWS_37 | resource | aws_route53_zone | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 880 | CKV2_AWS_37 | resource | aws_route53_zone_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 881 | CKV2_AWS_37 | resource | aws_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 882 | CKV2_AWS_37 | resource | aws_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 883 | CKV2_AWS_37 | resource | aws_s3_access_point | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 884 | CKV2_AWS_37 | resource | aws_s3_account_public_access_block | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 885 | CKV2_AWS_37 | resource | aws_s3_bucket | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 886 | CKV2_AWS_37 | resource | aws_s3_bucket_analytics_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 887 | CKV2_AWS_37 | resource | aws_s3_bucket_inventory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 888 | CKV2_AWS_37 | resource | aws_s3_bucket_metric | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 889 | CKV2_AWS_37 | resource | aws_s3_bucket_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 890 | CKV2_AWS_37 | resource | aws_s3_bucket_object | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 891 | CKV2_AWS_37 | resource | aws_s3_bucket_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 892 | CKV2_AWS_37 | resource | aws_s3_bucket_public_access_block | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 893 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 894 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 895 | CKV2_AWS_37 | resource | aws_sagemaker_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 896 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 897 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 898 | CKV2_AWS_37 | resource | aws_secretsmanager_secret | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 899 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_rotation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 900 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 901 | CKV2_AWS_37 | resource | aws_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 902 | CKV2_AWS_37 | resource | aws_security_group_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 903 | CKV2_AWS_37 | resource | aws_securityhub_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 904 | CKV2_AWS_37 | resource | aws_securityhub_member | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 905 | CKV2_AWS_37 | resource | aws_securityhub_product_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 906 | CKV2_AWS_37 | resource | aws_securityhub_standards_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 907 | CKV2_AWS_37 | resource | aws_service_discovery_http_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 908 | CKV2_AWS_37 | resource | aws_service_discovery_private_dns_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 909 | CKV2_AWS_37 | resource | aws_service_discovery_public_dns_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 910 | CKV2_AWS_37 | resource | aws_service_discovery_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 911 | CKV2_AWS_37 | resource | aws_servicecatalog_portfolio | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 912 | CKV2_AWS_37 | resource | aws_servicequotas_service_quota | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 913 | CKV2_AWS_37 | resource | aws_ses_active_receipt_rule_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 914 | CKV2_AWS_37 | resource | aws_ses_configuration_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 915 | CKV2_AWS_37 | resource | aws_ses_domain_dkim | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 916 | CKV2_AWS_37 | resource | aws_ses_domain_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 917 | CKV2_AWS_37 | resource | aws_ses_domain_identity_verification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 918 | CKV2_AWS_37 | resource | aws_ses_domain_mail_from | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 919 | CKV2_AWS_37 | resource | aws_ses_email_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 920 | CKV2_AWS_37 | resource | aws_ses_event_destination | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 921 | CKV2_AWS_37 | resource | aws_ses_identity_notification_topic | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 922 | CKV2_AWS_37 | resource | aws_ses_identity_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 923 | CKV2_AWS_37 | resource | aws_ses_receipt_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 924 | CKV2_AWS_37 | resource | aws_ses_receipt_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 925 | CKV2_AWS_37 | resource | aws_ses_receipt_rule_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 926 | CKV2_AWS_37 | resource | aws_ses_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 927 | CKV2_AWS_37 | resource | aws_sfn_activity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 928 | CKV2_AWS_37 | resource | aws_sfn_state_machine | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 929 | CKV2_AWS_37 | resource | aws_shield_protection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 930 | CKV2_AWS_37 | resource | aws_simpledb_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 931 | CKV2_AWS_37 | resource | aws_snapshot_create_volume_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 932 | CKV2_AWS_37 | resource | aws_sns_platform_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 933 | CKV2_AWS_37 | resource | aws_sns_sms_preferences | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 934 | CKV2_AWS_37 | resource | aws_sns_topic | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 935 | CKV2_AWS_37 | resource | aws_sns_topic_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 936 | CKV2_AWS_37 | resource | aws_sns_topic_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 937 | CKV2_AWS_37 | resource | aws_spot_datafeed_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 938 | CKV2_AWS_37 | resource | aws_spot_fleet_request | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 939 | CKV2_AWS_37 | resource | aws_spot_instance_request | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 940 | CKV2_AWS_37 | resource | aws_sqs_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 941 | CKV2_AWS_37 | resource | aws_sqs_queue_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 942 | CKV2_AWS_37 | resource | aws_ssm_activation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 943 | CKV2_AWS_37 | resource | aws_ssm_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 944 | CKV2_AWS_37 | resource | aws_ssm_document | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 945 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 946 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 947 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 948 | CKV2_AWS_37 | resource | aws_ssm_parameter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 949 | CKV2_AWS_37 | resource | aws_ssm_patch_baseline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 950 | CKV2_AWS_37 | resource | aws_ssm_patch_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 951 | CKV2_AWS_37 | resource | aws_ssm_resource_data_sync | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 952 | CKV2_AWS_37 | resource | aws_storagegateway_cache | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 953 | CKV2_AWS_37 | resource | aws_storagegateway_cached_iscsi_volume | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 954 | CKV2_AWS_37 | resource | aws_storagegateway_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 955 | CKV2_AWS_37 | resource | aws_storagegateway_nfs_file_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 956 | CKV2_AWS_37 | resource | aws_storagegateway_smb_file_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 957 | CKV2_AWS_37 | resource | aws_storagegateway_upload_buffer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 958 | CKV2_AWS_37 | resource | aws_storagegateway_working_storage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 959 | CKV2_AWS_37 | resource | aws_subnet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 960 | CKV2_AWS_37 | resource | aws_swf_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 961 | CKV2_AWS_37 | resource | aws_transfer_server | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 962 | CKV2_AWS_37 | resource | aws_transfer_ssh_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 963 | CKV2_AWS_37 | resource | aws_transfer_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 964 | CKV2_AWS_37 | resource | aws_volume_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 965 | CKV2_AWS_37 | resource | aws_vpc | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 966 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 967 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 968 | CKV2_AWS_37 | resource | aws_vpc_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 969 | CKV2_AWS_37 | resource | aws_vpc_endpoint_connection_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 970 | CKV2_AWS_37 | resource | aws_vpc_endpoint_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 971 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 972 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 973 | CKV2_AWS_37 | resource | aws_vpc_endpoint_subnet_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 974 | CKV2_AWS_37 | resource | aws_vpc_ipv4_cidr_block_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 975 | CKV2_AWS_37 | resource | aws_vpc_peering_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 976 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 977 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 978 | CKV2_AWS_37 | resource | aws_vpn_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 979 | CKV2_AWS_37 | resource | aws_vpn_connection_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 980 | CKV2_AWS_37 | resource | aws_vpn_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 981 | CKV2_AWS_37 | resource | aws_vpn_gateway_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 982 | CKV2_AWS_37 | resource | aws_vpn_gateway_route_propagation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 983 | CKV2_AWS_37 | resource | aws_waf_byte_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 984 | CKV2_AWS_37 | resource | aws_waf_geo_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 985 | CKV2_AWS_37 | resource | aws_waf_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 986 | CKV2_AWS_37 | resource | aws_waf_rate_based_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 987 | CKV2_AWS_37 | resource | aws_waf_regex_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 988 | CKV2_AWS_37 | resource | aws_waf_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 989 | CKV2_AWS_37 | resource | aws_waf_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 990 | CKV2_AWS_37 | resource | aws_waf_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 991 | CKV2_AWS_37 | resource | aws_waf_size_constraint_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 992 | CKV2_AWS_37 | resource | aws_waf_sql_injection_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 993 | CKV2_AWS_37 | resource | aws_waf_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 994 | CKV2_AWS_37 | resource | aws_waf_xss_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 995 | CKV2_AWS_37 | resource | aws_wafregional_byte_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 996 | CKV2_AWS_37 | resource | aws_wafregional_geo_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 997 | CKV2_AWS_37 | resource | aws_wafregional_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 998 | CKV2_AWS_37 | resource | aws_wafregional_rate_based_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 999 | CKV2_AWS_37 | resource | aws_wafregional_regex_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1000 | CKV2_AWS_37 | resource | aws_wafregional_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1001 | CKV2_AWS_37 | resource | aws_wafregional_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1002 | CKV2_AWS_37 | resource | aws_wafregional_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1003 | CKV2_AWS_37 | resource | aws_wafregional_size_constraint_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1004 | CKV2_AWS_37 | resource | aws_wafregional_sql_injection_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1005 | CKV2_AWS_37 | resource | aws_wafregional_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1006 | CKV2_AWS_37 | resource | aws_wafregional_web_acl_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1007 | CKV2_AWS_37 | resource | aws_wafregional_xss_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1008 | CKV2_AWS_37 | resource | aws_wafv2_ip_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1009 | CKV2_AWS_37 | resource | aws_wafv2_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1010 | CKV2_AWS_37 | resource | aws_wafv2_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1011 | CKV2_AWS_37 | resource | aws_wafv2_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1012 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1013 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_logging_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1014 | CKV2_AWS_37 | resource | aws_worklink_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1015 | CKV2_AWS_37 | resource | aws_worklink_website_certificate_authority_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1016 | CKV2_AWS_37 | resource | aws_workspaces_directory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1017 | CKV2_AWS_37 | resource | aws_workspaces_ip_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1018 | CKV2_AWS_37 | resource | aws_workspaces_workspace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1019 | CKV2_AWS_37 | resource | aws_xray_sampling_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1020 | CKV2_AWS_38 | resource | aws_route53_zone | Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1021 | CKV2_AWS_39 | resource | aws_route53_zone | Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1022 | CKV2_AWS_40 | resource | aws_iam_group_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1023 | CKV2_AWS_40 | resource | aws_iam_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1024 | CKV2_AWS_40 | resource | aws_iam_role_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1025 | CKV2_AWS_40 | resource | aws_iam_user_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1026 | CKV2_AWS_40 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1027 | CKV2_AWS_40 | resource | data.aws_iam_policy_document | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1028 | CKV2_AWS_41 | resource | aws_instance | Ensure an IAM role is attached to EC2 instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1029 | CKV2_AWS_42 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront distribution uses custom SSL certificate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1030 | CKV2_AWS_43 | resource | aws_s3_bucket_acl | Ensure S3 Bucket does not allow access to all Authenticated users | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1031 | CKV2_AWS_44 | resource | aws_route | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1032 | CKV2_AWS_44 | resource | aws_route_table | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1033 | CKV_AZURE_1 | resource | azurerm_linux_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1034 | CKV_AZURE_1 | resource | azurerm_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1035 | CKV_AZURE_2 | resource | azurerm_managed_disk | Ensure Azure managed disk has encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1036 | CKV_AZURE_3 | resource | azurerm_storage_account | Ensure that 'Secure transfer required' is set to 'Enabled' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1037 | CKV_AZURE_4 | resource | azurerm_kubernetes_cluster | Ensure AKS logging to Azure Monitoring is Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1038 | CKV_AZURE_5 | resource | azurerm_kubernetes_cluster | Ensure RBAC is enabled on AKS clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1039 | CKV_AZURE_6 | resource | azurerm_kubernetes_cluster | Ensure AKS has an API Server Authorized IP Ranges enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1040 | CKV_AZURE_7 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster has Network Policy configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1041 | CKV_AZURE_8 | resource | azurerm_kubernetes_cluster | Ensure Kubernetes Dashboard is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1042 | CKV_AZURE_9 | resource | azurerm_network_security_group | Ensure that RDP access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1043 | CKV_AZURE_9 | resource | azurerm_network_security_rule | Ensure that RDP access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1044 | CKV_AZURE_10 | resource | azurerm_network_security_group | Ensure that SSH access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1045 | CKV_AZURE_10 | resource | azurerm_network_security_rule | Ensure that SSH access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1046 | CKV_AZURE_11 | resource | azurerm_mariadb_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1047 | CKV_AZURE_11 | resource | azurerm_mysql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1048 | CKV_AZURE_11 | resource | azurerm_postgresql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1049 | CKV_AZURE_11 | resource | azurerm_sql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1050 | CKV_AZURE_12 | resource | azurerm_network_watcher_flow_log | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1051 | CKV_AZURE_13 | resource | azurerm_app_service | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1052 | CKV_AZURE_13 | resource | azurerm_linux_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1053 | CKV_AZURE_13 | resource | azurerm_windows_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1054 | CKV_AZURE_14 | resource | azurerm_app_service | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1055 | CKV_AZURE_14 | resource | azurerm_linux_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1056 | CKV_AZURE_14 | resource | azurerm_windows_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1057 | CKV_AZURE_15 | resource | azurerm_app_service | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1058 | CKV_AZURE_15 | resource | azurerm_linux_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1059 | CKV_AZURE_15 | resource | azurerm_windows_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1060 | CKV_AZURE_16 | resource | azurerm_app_service | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1061 | CKV_AZURE_16 | resource | azurerm_linux_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1062 | CKV_AZURE_16 | resource | azurerm_windows_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1063 | CKV_AZURE_17 | resource | azurerm_app_service | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1064 | CKV_AZURE_17 | resource | azurerm_linux_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1065 | CKV_AZURE_17 | resource | azurerm_windows_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1066 | CKV_AZURE_18 | resource | azurerm_app_service | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1067 | CKV_AZURE_18 | resource | azurerm_linux_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1068 | CKV_AZURE_18 | resource | azurerm_windows_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1069 | CKV_AZURE_19 | resource | azurerm_security_center_subscription_pricing | Ensure that standard pricing tier is selected | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1070 | CKV_AZURE_20 | resource | azurerm_security_center_contact | Ensure that security contact 'Phone number' is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1071 | CKV_AZURE_21 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1072 | CKV_AZURE_22 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1073 | CKV_AZURE_23 | resource | azurerm_mssql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1074 | CKV_AZURE_23 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1075 | CKV_AZURE_23 | resource | azurerm_sql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1076 | CKV_AZURE_24 | resource | azurerm_mssql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1077 | CKV_AZURE_24 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1078 | CKV_AZURE_24 | resource | azurerm_sql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1079 | CKV_AZURE_25 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Threat Detection types' is set to 'All' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1080 | CKV_AZURE_26 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1081 | CKV_AZURE_27 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1082 | CKV_AZURE_28 | resource | azurerm_mysql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1083 | CKV_AZURE_29 | resource | azurerm_postgresql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1084 | CKV_AZURE_30 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1085 | CKV_AZURE_31 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1086 | CKV_AZURE_32 | resource | azurerm_postgresql_configuration | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1087 | CKV_AZURE_33 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1088 | CKV_AZURE_34 | resource | azurerm_storage_container | Ensure that 'Public access level' is set to Private for blob containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1089 | CKV_AZURE_35 | resource | azurerm_storage_account | Ensure default network access rule for Storage Accounts is set to deny | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1090 | CKV_AZURE_35 | resource | azurerm_storage_account_network_rules | Ensure default network access rule for Storage Accounts is set to deny | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1091 | CKV_AZURE_36 | resource | azurerm_storage_account | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1092 | CKV_AZURE_36 | resource | azurerm_storage_account_network_rules | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1093 | CKV_AZURE_37 | resource | azurerm_monitor_log_profile | Ensure that Activity Log Retention is set 365 days or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1094 | CKV_AZURE_38 | resource | azurerm_monitor_log_profile | Ensure audit profile captures all the activities | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1095 | CKV_AZURE_39 | resource | azurerm_role_definition | Ensure that no custom subscription owner roles are created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1096 | CKV_AZURE_40 | resource | azurerm_key_vault_key | Ensure that the expiration date is set on all keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1097 | CKV_AZURE_41 | resource | azurerm_key_vault_secret | Ensure that the expiration date is set on all secrets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1098 | CKV_AZURE_42 | resource | azurerm_key_vault | Ensure the key vault is recoverable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1099 | CKV_AZURE_43 | resource | azurerm_storage_account | Ensure Storage Accounts adhere to the naming rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1100 | CKV_AZURE_44 | resource | azurerm_storage_account | Ensure Storage Account is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1101 | CKV_AZURE_45 | resource | azurerm_virtual_machine | Ensure that no sensitive credentials are exposed in VM custom_data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1102 | CKV_AZURE_47 | resource | azurerm_mariadb_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1103 | CKV_AZURE_48 | resource | azurerm_mariadb_server | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1104 | CKV_AZURE_49 | resource | azurerm_linux_virtual_machine_scale_set | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1105 | CKV_AZURE_50 | resource | azurerm_linux_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1106 | CKV_AZURE_50 | resource | azurerm_windows_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1107 | CKV_AZURE_52 | resource | azurerm_mssql_server | Ensure MSSQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1108 | CKV_AZURE_53 | resource | azurerm_mysql_server | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1109 | CKV_AZURE_54 | resource | azurerm_mysql_server | Ensure MySQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1110 | CKV_AZURE_55 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1111 | CKV_AZURE_56 | resource | azurerm_function_app | Ensure that function apps enables Authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1112 | CKV_AZURE_57 | resource | azurerm_app_service | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1113 | CKV_AZURE_57 | resource | azurerm_linux_web_app | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1114 | CKV_AZURE_57 | resource | azurerm_windows_web_app | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1115 | CKV_AZURE_58 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces enables managed virtual networks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1116 | CKV_AZURE_59 | resource | azurerm_storage_account | Ensure that Storage accounts disallow public access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1117 | CKV_AZURE_61 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1118 | CKV_AZURE_62 | resource | azurerm_function_app | Ensure function apps are not accessible from all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1119 | CKV_AZURE_63 | resource | azurerm_app_service | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1120 | CKV_AZURE_63 | resource | azurerm_linux_web_app | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1121 | CKV_AZURE_63 | resource | azurerm_windows_web_app | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1122 | CKV_AZURE_64 | resource | azurerm_storage_sync | Ensure that Azure File Sync disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1123 | CKV_AZURE_65 | resource | azurerm_app_service | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1124 | CKV_AZURE_65 | resource | azurerm_linux_web_app | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1125 | CKV_AZURE_65 | resource | azurerm_windows_web_app | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1126 | CKV_AZURE_66 | resource | azurerm_app_service | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1127 | CKV_AZURE_66 | resource | azurerm_linux_web_app | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1128 | CKV_AZURE_66 | resource | azurerm_windows_web_app | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1129 | CKV_AZURE_67 | resource | azurerm_function_app | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1130 | CKV_AZURE_67 | resource | azurerm_function_app_slot | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1131 | CKV_AZURE_68 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1132 | CKV_AZURE_69 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Azure SQL database servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1133 | CKV_AZURE_70 | resource | azurerm_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1134 | CKV_AZURE_71 | resource | azurerm_app_service | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1135 | CKV_AZURE_71 | resource | azurerm_linux_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1136 | CKV_AZURE_71 | resource | azurerm_windows_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1137 | CKV_AZURE_72 | resource | azurerm_app_service | Ensure that remote debugging is not enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1138 | CKV_AZURE_73 | resource | azurerm_automation_variable_bool | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1139 | CKV_AZURE_73 | resource | azurerm_automation_variable_datetime | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1140 | CKV_AZURE_73 | resource | azurerm_automation_variable_int | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1141 | CKV_AZURE_73 | resource | azurerm_automation_variable_string | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1142 | CKV_AZURE_74 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses disk encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1143 | CKV_AZURE_75 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses double encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1144 | CKV_AZURE_76 | resource | azurerm_batch_account | Ensure that Azure Batch account uses key vault to encrypt data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1145 | CKV_AZURE_77 | resource | azurerm_network_security_group | Ensure that UDP Services are restricted from the Internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1146 | CKV_AZURE_77 | resource | azurerm_network_security_rule | Ensure that UDP Services are restricted from the Internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1147 | CKV_AZURE_78 | resource | azurerm_app_service | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1148 | CKV_AZURE_78 | resource | azurerm_linux_web_app | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1149 | CKV_AZURE_78 | resource | azurerm_windows_web_app | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1150 | CKV_AZURE_79 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for SQL servers on machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1151 | CKV_AZURE_80 | resource | azurerm_app_service | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1152 | CKV_AZURE_81 | resource | azurerm_app_service | Ensure that 'PHP version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1153 | CKV_AZURE_82 | resource | azurerm_app_service | Ensure that 'Python version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1154 | CKV_AZURE_83 | resource | azurerm_app_service | Ensure that 'Java version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1155 | CKV_AZURE_84 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Storage | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1156 | CKV_AZURE_85 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Kubernetes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1157 | CKV_AZURE_86 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Container Registries | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1158 | CKV_AZURE_87 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Key Vault | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1159 | CKV_AZURE_88 | resource | azurerm_app_service | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1160 | CKV_AZURE_88 | resource | azurerm_linux_web_app | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1161 | CKV_AZURE_88 | resource | azurerm_windows_web_app | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1162 | CKV_AZURE_89 | resource | azurerm_redis_cache | Ensure that Azure Cache for Redis disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1163 | CKV_AZURE_91 | resource | azurerm_redis_cache | Ensure that only SSL are enabled for Cache for Redis | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1164 | CKV_AZURE_92 | resource | azurerm_linux_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1165 | CKV_AZURE_92 | resource | azurerm_windows_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1166 | CKV_AZURE_93 | resource | azurerm_managed_disk | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1167 | CKV_AZURE_94 | resource | azurerm_mysql_server | Ensure that My SQL server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1168 | CKV_AZURE_95 | resource | azurerm_virtual_machine_scale_set | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1169 | CKV_AZURE_96 | resource | azurerm_mysql_server | Ensure that MySQL server enables infrastructure encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1170 | CKV_AZURE_97 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1171 | CKV_AZURE_97 | resource | azurerm_windows_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1172 | CKV_AZURE_98 | resource | azurerm_container_group | Ensure that Azure Container group is deployed into virtual network | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1173 | CKV_AZURE_99 | resource | azurerm_cosmosdb_account | Ensure Cosmos DB accounts have restricted access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1174 | CKV_AZURE_100 | resource | azurerm_cosmosdb_account | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1175 | CKV_AZURE_101 | resource | azurerm_cosmosdb_account | Ensure that Azure Cosmos DB disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1176 | CKV_AZURE_102 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1177 | CKV_AZURE_103 | resource | azurerm_data_factory | Ensure that Azure Data Factory uses Git repository for source control | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1178 | CKV_AZURE_104 | resource | azurerm_data_factory | Ensure that Azure Data factory public network access is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1179 | CKV_AZURE_105 | resource | azurerm_data_lake_store | Ensure that Data Lake Store accounts enables encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1180 | CKV_AZURE_106 | resource | azurerm_eventgrid_domain | Ensure that Azure Event Grid Domain public network access is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1181 | CKV_AZURE_107 | resource | azurerm_api_management | Ensure that API management services use virtual networks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1182 | CKV_AZURE_108 | resource | azurerm_iothub | Ensure that Azure IoT Hub disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1183 | CKV_AZURE_109 | resource | azurerm_key_vault | Ensure that key vault allows firewall rules settings | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1184 | CKV_AZURE_110 | resource | azurerm_key_vault | Ensure that key vault enables purge protection | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1185 | CKV_AZURE_111 | resource | azurerm_key_vault | Ensure that key vault enables soft delete | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1186 | CKV_AZURE_112 | resource | azurerm_key_vault_key | Ensure that key vault key is backed by HSM | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1187 | CKV_AZURE_113 | resource | azurerm_mssql_server | Ensure that SQL server disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1188 | CKV_AZURE_114 | resource | azurerm_key_vault_secret | Ensure that key vault secrets have "content_type" set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1189 | CKV_AZURE_115 | resource | azurerm_kubernetes_cluster | Ensure that AKS enables private clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1190 | CKV_AZURE_116 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses Azure Policies Add-on | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1191 | CKV_AZURE_117 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses disk encryption set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1192 | CKV_AZURE_118 | resource | azurerm_network_interface | Ensure that Network Interfaces disable IP forwarding | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1193 | CKV_AZURE_119 | resource | azurerm_network_interface | Ensure that Network Interfaces don't use public IPs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1194 | CKV_AZURE_120 | resource | azurerm_application_gateway | Ensure that Application Gateway enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1195 | CKV_AZURE_120 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1196 | CKV_AZURE_121 | resource | azurerm_frontdoor | Ensure that Azure Front Door enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1197 | CKV_AZURE_122 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway uses WAF in "Detection" or "Prevention" modes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1198 | CKV_AZURE_123 | resource | azurerm_frontdoor_firewall_policy | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1199 | CKV_AZURE_124 | resource | azurerm_search_service | Ensure that Azure Cognitive Search disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1200 | CKV_AZURE_125 | resource | azurerm_service_fabric_cluster | Ensures that Service Fabric use three levels of protection available | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1201 | CKV_AZURE_126 | resource | azurerm_service_fabric_cluster | Ensures that Active Directory is used for authentication for Service Fabric | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1202 | CKV_AZURE_127 | resource | azurerm_mysql_server | Ensure that My SQL server enables Threat detection policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1203 | CKV_AZURE_128 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables Threat detection policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1204 | CKV_AZURE_129 | resource | azurerm_mariadb_server | Ensure that MariaDB server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1205 | CKV_AZURE_130 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables infrastructure encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1206 | CKV_AZURE_131 | resource | azurerm_security_center_contact | Ensure that 'Security contact emails' is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1207 | CKV_AZURE_132 | resource | azurerm_cosmosdb_account | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1208 | CKV_AZURE_133 | resource | azurerm_frontdoor_firewall_policy | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1209 | CKV_AZURE_134 | resource | azurerm_cognitive_account | Ensure that Cognitive Services accounts disable public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1210 | CKV_AZURE_135 | resource | azurerm_web_application_firewall_policy | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1211 | CKV_AZURE_136 | resource | azurerm_postgresql_flexible_server | Ensure that PostgreSQL Flexible server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1212 | CKV_AZURE_137 | resource | azurerm_container_registry | Ensure ACR admin account is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1213 | CKV_AZURE_138 | resource | azurerm_container_registry | Ensures that ACR disables anonymous pulling of images | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1214 | CKV_AZURE_139 | resource | azurerm_container_registry | Ensure ACR set to disable public networking | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1215 | CKV_AZURE_140 | resource | azurerm_cosmosdb_account | Ensure that Local Authentication is disabled on CosmosDB | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1216 | CKV_AZURE_141 | resource | azurerm_kubernetes_cluster | Ensure AKS local admin account is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1217 | CKV_AZURE_142 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Local Authentication is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1218 | CKV_AZURE_143 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster nodes do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1219 | CKV_AZURE_144 | resource | azurerm_machine_learning_workspace | Ensure that Public Access is disabled for Machine Learning Workspace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1220 | CKV_AZURE_145 | resource | azurerm_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1221 | CKV_AZURE_146 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1222 | CKV_AZURE_147 | resource | azurerm_postgresql_server | Ensure PostgreSQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1223 | CKV_AZURE_148 | resource | azurerm_redis_cache | Ensure Redis Cache is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1224 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine | Ensure that Virtual machine does not enable password authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1225 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine does not enable password authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1226 | CKV_AZURE_150 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1227 | CKV_AZURE_151 | resource | azurerm_windows_virtual_machine | Ensure Windows VM enables encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1228 | CKV_AZURE_152 | resource | azurerm_api_management | Ensure Client Certificates are enforced for API management | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1229 | CKV_AZURE_153 | resource | azurerm_app_service_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1230 | CKV_AZURE_154 | resource | azurerm_app_service_slot | Ensure the App service slot is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1231 | CKV_AZURE_155 | resource | azurerm_app_service_slot | Ensure debugging is disabled for the App service slot | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1232 | CKV_AZURE_156 | resource | azurerm_mssql_database_extended_auditing_policy | Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1233 | CKV_AZURE_157 | resource | azurerm_synapse_workspace | Ensure that Synapse workspace has data_exfiltration_protection_enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1234 | CKV_AZURE_158 | resource | azurerm_databricks_workspace | Ensure that databricks workspace has not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1235 | CKV_AZURE_159 | resource | azurerm_function_app | Ensure function app builtin logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1236 | CKV_AZURE_159 | resource | azurerm_function_app_slot | Ensure function app builtin logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1237 | CKV_AZURE_160 | resource | azurerm_network_security_group | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1238 | CKV_AZURE_160 | resource | azurerm_network_security_rule | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1239 | CKV_AZURE_161 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal is enabled on for HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1240 | CKV_AZURE_162 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal Public Access Is Disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1241 | CKV_AZURE_163 | resource | azurerm_container_registry | Enable vulnerability scanning for container images. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1242 | CKV_AZURE_164 | resource | azurerm_container_registry | Ensures that ACR uses signed/trusted images | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1243 | CKV_AZURE_165 | resource | azurerm_container_registry | Ensure geo-replicated container registries to match multi-region container deployments. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1244 | CKV_AZURE_166 | resource | azurerm_container_registry | Ensure container image quarantine, scan, and mark images verified | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1245 | CKV_AZURE_167 | resource | azurerm_container_registry | Ensure a retention policy is set to cleanup untagged manifests. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1246 | CKV2_AZURE_1 | resource | azurerm_storage_account | Ensure storage for critical data are encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1247 | CKV2_AZURE_2 | resource | azurerm_mssql_server_security_alert_policy | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1248 | CKV2_AZURE_2 | resource | azurerm_sql_server | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1249 | CKV2_AZURE_3 | resource | azurerm_mssql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1250 | CKV2_AZURE_3 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1251 | CKV2_AZURE_3 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1252 | CKV2_AZURE_3 | resource | azurerm_sql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1253 | CKV2_AZURE_4 | resource | azurerm_mssql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1254 | CKV2_AZURE_4 | resource | azurerm_mssql_server_security_alert_policy | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1255 | CKV2_AZURE_4 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1256 | CKV2_AZURE_4 | resource | azurerm_sql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1257 | CKV2_AZURE_5 | resource | azurerm_mssql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1258 | CKV2_AZURE_5 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1259 | CKV2_AZURE_5 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1260 | CKV2_AZURE_5 | resource | azurerm_sql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1261 | CKV2_AZURE_6 | resource | azurerm_sql_firewall_rule | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1262 | CKV2_AZURE_6 | resource | azurerm_sql_server | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1263 | CKV2_AZURE_7 | resource | azurerm_sql_server | Ensure that Azure Active Directory Admin is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1264 | CKV2_AZURE_8 | resource | azurerm_monitor_activity_log_alert | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1265 | CKV2_AZURE_8 | resource | azurerm_storage_account | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1266 | CKV2_AZURE_8 | resource | azurerm_storage_container | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1267 | CKV2_AZURE_9 | resource | azurerm_virtual_machine | Ensure Virtual Machines are utilizing Managed Disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1268 | CKV2_AZURE_10 | resource | azurerm_virtual_machine | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1269 | CKV2_AZURE_10 | resource | azurerm_virtual_machine_extension | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1270 | CKV2_AZURE_11 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer encryption at rest uses a customer-managed key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1271 | CKV2_AZURE_12 | resource | azurerm_virtual_machine | Ensure that virtual machines are backed up using Azure Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1272 | CKV2_AZURE_13 | resource | azurerm_mssql_server_security_alert_policy | Ensure that sql servers enables data security policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1273 | CKV2_AZURE_13 | resource | azurerm_sql_server | Ensure that sql servers enables data security policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1274 | CKV2_AZURE_14 | resource | azurerm_managed_disk | Ensure that Unattached disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1275 | CKV2_AZURE_14 | resource | azurerm_virtual_machine | Ensure that Unattached disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1276 | CKV2_AZURE_15 | resource | azurerm_data_factory | Ensure that Azure data factories are encrypted with a customer-managed key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1277 | CKV2_AZURE_16 | resource | azurerm_mysql_server | Ensure that MySQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1278 | CKV2_AZURE_16 | resource | azurerm_mysql_server_key | Ensure that MySQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1279 | CKV2_AZURE_17 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1280 | CKV2_AZURE_17 | resource | azurerm_postgresql_server_key | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1281 | CKV2_AZURE_18 | resource | azurerm_storage_account | Ensure that Storage Accounts use customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1282 | CKV2_AZURE_18 | resource | azurerm_storage_account_customer_managed_key | Ensure that Storage Accounts use customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1283 | CKV2_AZURE_19 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1284 | CKV2_AZURE_20 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1285 | CKV2_AZURE_20 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1286 | CKV2_AZURE_20 | resource | azurerm_storage_table | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1287 | CKV2_AZURE_21 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1288 | CKV2_AZURE_21 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1289 | CKV2_AZURE_21 | resource | azurerm_storage_container | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1290 | CKV2_AZURE_22 | resource | azurerm_cognitive_account | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1291 | CKV2_AZURE_22 | resource | azurerm_cognitive_account_customer_managed_key | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1292 | CKV_BCW_1 | provider | bridgecrew | Ensure no hard coded API token exist in the provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1293 | CKV_DIO_1 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1294 | CKV_DIO_2 | resource | digitalocean_droplet | Ensure the droplet specifies an SSH key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1295 | CKV_DIO_3 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket is private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1296 | CKV_DIO_4 | resource | digitalocean_firewall | Ensure the firewall ingress is not wide open | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1297 | CKV_GCP_1 | resource | google_container_cluster | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1298 | CKV_GCP_2 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted ssh access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1299 | CKV_GCP_3 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted rdp access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1300 | CKV_GCP_4 | resource | google_compute_ssl_policy | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1301 | CKV_GCP_6 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance requires all incoming connections to use SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1302 | CKV_GCP_7 | resource | google_container_cluster | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1303 | CKV_GCP_8 | resource | google_container_cluster | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1304 | CKV_GCP_9 | resource | google_container_node_pool | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1305 | CKV_GCP_10 | resource | google_container_node_pool | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1306 | CKV_GCP_11 | resource | google_sql_database_instance | Ensure that Cloud SQL database Instances are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1307 | CKV_GCP_12 | resource | google_container_cluster | Ensure Network Policy is enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1308 | CKV_GCP_13 | resource | google_container_cluster | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1309 | CKV_GCP_14 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance have backup configuration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1310 | CKV_GCP_15 | resource | google_bigquery_dataset | Ensure that BigQuery datasets are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1311 | CKV_GCP_16 | resource | google_dns_managed_zone | Ensure that DNSSEC is enabled for Cloud DNS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1312 | CKV_GCP_17 | resource | google_dns_managed_zone | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1313 | CKV_GCP_18 | resource | google_container_cluster | Ensure GKE Control Plane is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1314 | CKV_GCP_19 | resource | google_container_cluster | Ensure GKE basic auth is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1315 | CKV_GCP_20 | resource | google_container_cluster | Ensure master authorized networks is set to enabled in GKE clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1316 | CKV_GCP_21 | resource | google_container_cluster | Ensure Kubernetes Clusters are configured with Labels | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1317 | CKV_GCP_22 | resource | google_container_node_pool | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1318 | CKV_GCP_23 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1319 | CKV_GCP_24 | resource | google_container_cluster | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1320 | CKV_GCP_25 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Private cluster enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1321 | CKV_GCP_26 | resource | google_compute_subnetwork | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1322 | CKV_GCP_27 | resource | google_project | Ensure that the default network does not exist in a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1323 | CKV_GCP_28 | resource | google_storage_bucket_iam_binding | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1324 | CKV_GCP_28 | resource | google_storage_bucket_iam_member | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1325 | CKV_GCP_29 | resource | google_storage_bucket | Ensure that Cloud Storage buckets have uniform bucket-level access enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1326 | CKV_GCP_30 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1327 | CKV_GCP_30 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1328 | CKV_GCP_30 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1329 | CKV_GCP_31 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1330 | CKV_GCP_31 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1331 | CKV_GCP_31 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1332 | CKV_GCP_32 | resource | google_compute_instance | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1333 | CKV_GCP_32 | resource | google_compute_instance_from_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1334 | CKV_GCP_32 | resource | google_compute_instance_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1335 | CKV_GCP_33 | resource | google_compute_project_metadata | Ensure oslogin is enabled for a Project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1336 | CKV_GCP_34 | resource | google_compute_instance | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1337 | CKV_GCP_34 | resource | google_compute_instance_from_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1338 | CKV_GCP_34 | resource | google_compute_instance_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1339 | CKV_GCP_35 | resource | google_compute_instance | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1340 | CKV_GCP_35 | resource | google_compute_instance_from_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1341 | CKV_GCP_35 | resource | google_compute_instance_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1342 | CKV_GCP_36 | resource | google_compute_instance | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1343 | CKV_GCP_36 | resource | google_compute_instance_from_template | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1344 | CKV_GCP_36 | resource | google_compute_instance_template | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1345 | CKV_GCP_37 | resource | google_compute_disk | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1346 | CKV_GCP_38 | resource | google_compute_instance | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1347 | CKV_GCP_39 | resource | google_compute_instance | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1348 | CKV_GCP_39 | resource | google_compute_instance_from_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1349 | CKV_GCP_39 | resource | google_compute_instance_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1350 | CKV_GCP_40 | resource | google_compute_instance | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1351 | CKV_GCP_40 | resource | google_compute_instance_from_template | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1352 | CKV_GCP_40 | resource | google_compute_instance_template | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1353 | CKV_GCP_41 | resource | google_project_iam_binding | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1354 | CKV_GCP_41 | resource | google_project_iam_member | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1355 | CKV_GCP_42 | resource | google_project_iam_member | Ensure that Service Account has no Admin privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1356 | CKV_GCP_43 | resource | google_kms_crypto_key | Ensure KMS encryption keys are rotated within a period of 90 days | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1357 | CKV_GCP_44 | resource | google_folder_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1358 | CKV_GCP_44 | resource | google_folder_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1359 | CKV_GCP_45 | resource | google_organization_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1360 | CKV_GCP_45 | resource | google_organization_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1361 | CKV_GCP_46 | resource | google_project_iam_binding | Ensure Default Service account is not used at a project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1362 | CKV_GCP_46 | resource | google_project_iam_member | Ensure Default Service account is not used at a project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1363 | CKV_GCP_47 | resource | google_organization_iam_binding | Ensure default service account is not used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1364 | CKV_GCP_47 | resource | google_organization_iam_member | Ensure default service account is not used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1365 | CKV_GCP_48 | resource | google_folder_iam_binding | Ensure Default Service account is not used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1366 | CKV_GCP_48 | resource | google_folder_iam_member | Ensure Default Service account is not used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1367 | CKV_GCP_49 | resource | google_project_iam_binding | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1368 | CKV_GCP_49 | resource | google_project_iam_member | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1369 | CKV_GCP_50 | resource | google_sql_database_instance | Ensure MySQL database 'local_infile' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1370 | CKV_GCP_51 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1371 | CKV_GCP_52 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_connections' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1372 | CKV_GCP_53 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_disconnections' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1373 | CKV_GCP_54 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1374 | CKV_GCP_55 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1375 | CKV_GCP_56 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_temp_files flag is set to '0' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1376 | CKV_GCP_57 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1377 | CKV_GCP_58 | resource | google_sql_database_instance | Ensure SQL database 'cross db ownership chaining' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1378 | CKV_GCP_59 | resource | google_sql_database_instance | Ensure SQL database 'contained database authentication' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1379 | CKV_GCP_60 | resource | google_sql_database_instance | Ensure Cloud SQL database does not have public IP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1380 | CKV_GCP_61 | resource | google_container_cluster | Enable VPC Flow Logs and Intranode Visibility | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1381 | CKV_GCP_62 | resource | google_storage_bucket | Bucket should log access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1382 | CKV_GCP_63 | resource | google_storage_bucket | Bucket should not log to itself | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1383 | CKV_GCP_64 | resource | google_container_cluster | Ensure clusters are created with Private Nodes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1384 | CKV_GCP_65 | resource | google_container_cluster | Manage Kubernetes RBAC users with Google Groups for GKE | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1385 | CKV_GCP_66 | resource | google_container_cluster | Ensure use of Binary Authorization | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1386 | CKV_GCP_67 | resource | google_container_cluster | Ensure legacy Compute Engine instance metadata APIs are Disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1387 | CKV_GCP_68 | resource | google_container_cluster | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1388 | CKV_GCP_68 | resource | google_container_node_pool | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1389 | CKV_GCP_69 | resource | google_container_cluster | Ensure the GKE Metadata Server is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1390 | CKV_GCP_69 | resource | google_container_node_pool | Ensure the GKE Metadata Server is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1391 | CKV_GCP_70 | resource | google_container_cluster | Ensure the GKE Release Channel is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1392 | CKV_GCP_71 | resource | google_container_cluster | Ensure Shielded GKE Nodes are Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1393 | CKV_GCP_72 | resource | google_container_cluster | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1394 | CKV_GCP_72 | resource | google_container_node_pool | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1395 | CKV_GCP_73 | resource | google_compute_security_policy | Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1396 | CKV_GCP_74 | resource | google_compute_subnetwork | Ensure that private_ip_google_access is enabled for Subnet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1397 | CKV_GCP_75 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted FTP access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1398 | CKV_GCP_76 | resource | google_compute_subnetwork | Ensure that Private google access is enabled for IPV6 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1399 | CKV_GCP_77 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow on ftp port | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1400 | CKV_GCP_78 | resource | google_storage_bucket | Ensure Cloud storage has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1401 | CKV_GCP_79 | resource | google_sql_database_instance | Ensure SQL database is using latest Major version | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1402 | CKV_GCP_80 | resource | google_bigquery_table | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1403 | CKV_GCP_81 | resource | google_bigquery_dataset | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1404 | CKV_GCP_82 | resource | google_kms_crypto_key | Ensure KMS keys are protected from deletion | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1405 | CKV_GCP_83 | resource | google_pubsub_topic | Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1406 | CKV_GCP_84 | resource | google_artifact_registry_repository | Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1407 | CKV_GCP_85 | resource | google_bigtable_instance | Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1408 | CKV_GCP_86 | resource | google_cloudbuild_worker_pool | Ensure Cloud build workers are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1409 | CKV_GCP_87 | resource | google_data_fusion_instance | Ensure Data fusion instances are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1410 | CKV_GCP_88 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted mysql access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1411 | CKV_GCP_89 | resource | google_notebooks_instance | Ensure Vertex AI instances are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1412 | CKV_GCP_90 | resource | google_dataflow_job | Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1413 | CKV_GCP_91 | resource | google_dataproc_cluster | Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1414 | CKV_GCP_92 | resource | google_vertex_ai_dataset | Ensure Vertex AI datasets uses a CMK (Customer Manager Key) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1415 | CKV_GCP_93 | resource | google_spanner_database | Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1416 | CKV_GCP_94 | resource | google_dataflow_job | Ensure Dataflow jobs are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1417 | CKV_GCP_95 | resource | google_redis_instance | Ensure Memorystore for Redis has AUTH enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1418 | CKV_GCP_96 | resource | google_vertex_ai_metadata_store | Ensure Vertex AI Metadata Store uses a CMK (Customer Manager Key) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1419 | CKV_GCP_97 | resource | google_redis_instance | Ensure Memorystore for Redis uses intransit encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1420 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_binding | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1421 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_member | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1422 | CKV_GCP_99 | resource | google_pubsub_topic_iam_binding | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1423 | CKV_GCP_99 | resource | google_pubsub_topic_iam_member | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1424 | CKV_GCP_100 | resource | google_bigquery_table_iam_binding | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1425 | CKV_GCP_100 | resource | google_bigquery_table_iam_member | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1426 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_binding | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1427 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_member | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1428 | CKV_GCP_102 | resource | google_cloud_run_service_iam_binding | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1429 | CKV_GCP_102 | resource | google_cloud_run_service_iam_member | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1430 | CKV_GCP_103 | resource | google_dataproc_cluster | Ensure Dataproc Clusters do not have public IPs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1431 | CKV_GCP_104 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1432 | CKV_GCP_105 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver monitoring enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1433 | CKV_GCP_106 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1434 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_binding | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1435 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_member | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1436 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_binding | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1437 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_member | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1438 | CKV_GCP_108 | resource | google_sql_database_instance | Ensure hostnames are logged for GCP PostgreSQL databases | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1439 | CKV_GCP_109 | resource | google_sql_database_instance | Ensure the GCP PostgreSQL database log levels are set to ERROR or lower | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1440 | CKV_GCP_110 | resource | google_sql_database_instance | Ensure pgAudit is enabled for your GCP PostgreSQL database | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1441 | CKV_GCP_111 | resource | google_sql_database_instance | Ensure GCP PostgreSQL logs SQL statements | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1442 | CKV2_GCP_1 | resource | google_project_default_service_accounts | Ensure GKE clusters are not running using the Compute Engine default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1443 | CKV2_GCP_2 | resource | google_compute_network | Ensure legacy networks do not exist for a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1444 | CKV2_GCP_3 | resource | google_service_account_key | Ensure that there are only GCP-managed service account keys for each service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1445 | CKV2_GCP_4 | resource | google_logging_folder_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1446 | CKV2_GCP_4 | resource | google_logging_organization_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1447 | CKV2_GCP_4 | resource | google_logging_project_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1448 | CKV2_GCP_4 | resource | google_storage_bucket | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1449 | CKV2_GCP_5 | resource | google_project | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1450 | CKV2_GCP_5 | resource | google_project_iam_audit_config | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1451 | CKV2_GCP_6 | resource | google_kms_crypto_key | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1452 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_binding | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1453 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_member | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1454 | CKV2_GCP_7 | resource | google_sql_database_instance | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1455 | CKV2_GCP_7 | resource | google_sql_user | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1456 | CKV2_GCP_8 | resource | google_kms_key_ring | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1457 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_binding | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1458 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_member | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1459 | CKV2_GCP_9 | resource | google_container_registry | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1460 | CKV2_GCP_9 | resource | google_storage_bucket_iam_binding | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1461 | CKV2_GCP_9 | resource | google_storage_bucket_iam_member | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1462 | CKV2_GCP_10 | resource | google_cloudfunctions_function | Ensure GCP Cloud Function HTTP trigger is secured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1463 | CKV2_GCP_11 | resource | google_project_services | Ensure GCP GCR Container Vulnerability Scanning is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1464 | CKV2_GCP_12 | resource | google_compute_firewall | Ensure GCP compute firewall ingress does not allow unrestricted access to all ports | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1465 | CKV_GIT_1 | resource | github_repository | Ensure GitHub repository is Private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1466 | CKV_GIT_2 | resource | github_repository_webhook | Ensure GitHub repository webhooks are using HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1467 | CKV_GIT_3 | resource | github_repository | Ensure GitHub repository has vulnerability alerts enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1468 | CKV_GIT_4 | resource | github_actions_environment_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1469 | CKV_GIT_4 | resource | github_actions_organization_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1470 | CKV_GIT_4 | resource | github_actions_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1471 | CKV_GIT_5 | resource | github_branch_protection | GitHub pull requests should require at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1472 | CKV_GIT_5 | resource | github_branch_protection_v3 | GitHub pull requests should require at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1473 | CKV_GIT_6 | resource | github_branch_protection | Ensure GitHub branch protection rules requires signed commits | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1474 | CKV_GIT_6 | resource | github_branch_protection_v3 | Ensure GitHub branch protection rules requires signed commits | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1475 | CKV2_GIT_1 | resource | github_repository | Ensure each Repository has branch protection associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1476 | CKV_GLB_1 | resource | gitlab_project | Ensure at least two approving reviews are required to merge a GitLab MR | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1477 | CKV_GLB_2 | resource | gitlab_branch_protection | Ensure GitLab branch protection rules does not allow force pushes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1478 | CKV_GLB_3 | resource | gitlab_project | Ensure GitLab prevent secrets is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1479 | CKV_GLB_4 | resource | gitlab_project | Ensure GitLab commits are signed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1480 | CKV_K8S_1 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1481 | CKV_K8S_2 | resource | kubernetes_pod_security_policy | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1482 | CKV_K8S_3 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1483 | CKV_K8S_4 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1484 | CKV_K8S_5 | resource | kubernetes_pod_security_policy | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1485 | CKV_K8S_6 | resource | kubernetes_pod_security_policy | Do not admit root containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1486 | CKV_K8S_7 | resource | kubernetes_pod_security_policy | Do not admit containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1487 | CKV_K8S_8 | resource | kubernetes_deployment | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1488 | CKV_K8S_8 | resource | kubernetes_deployment_v1 | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1489 | CKV_K8S_8 | resource | kubernetes_pod | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1490 | CKV_K8S_8 | resource | kubernetes_pod_v1 | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1491 | CKV_K8S_9 | resource | kubernetes_deployment | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1492 | CKV_K8S_9 | resource | kubernetes_deployment_v1 | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1493 | CKV_K8S_9 | resource | kubernetes_pod | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1494 | CKV_K8S_9 | resource | kubernetes_pod_v1 | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1495 | CKV_K8S_10 | resource | kubernetes_deployment | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1496 | CKV_K8S_10 | resource | kubernetes_deployment_v1 | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1497 | CKV_K8S_10 | resource | kubernetes_pod | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1498 | CKV_K8S_10 | resource | kubernetes_pod_v1 | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1499 | CKV_K8S_11 | resource | kubernetes_deployment | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1500 | CKV_K8S_11 | resource | kubernetes_deployment_v1 | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1501 | CKV_K8S_11 | resource | kubernetes_pod | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1502 | CKV_K8S_11 | resource | kubernetes_pod_v1 | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1503 | CKV_K8S_12 | resource | kubernetes_deployment | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1504 | CKV_K8S_12 | resource | kubernetes_deployment_v1 | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1505 | CKV_K8S_12 | resource | kubernetes_pod | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1506 | CKV_K8S_12 | resource | kubernetes_pod_v1 | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1507 | CKV_K8S_13 | resource | kubernetes_deployment | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1508 | CKV_K8S_13 | resource | kubernetes_deployment_v1 | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1509 | CKV_K8S_13 | resource | kubernetes_pod | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1510 | CKV_K8S_13 | resource | kubernetes_pod_v1 | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1511 | CKV_K8S_14 | resource | kubernetes_deployment | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1512 | CKV_K8S_14 | resource | kubernetes_deployment_v1 | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1513 | CKV_K8S_14 | resource | kubernetes_pod | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1514 | CKV_K8S_14 | resource | kubernetes_pod_v1 | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1515 | CKV_K8S_15 | resource | kubernetes_deployment | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1516 | CKV_K8S_15 | resource | kubernetes_deployment_v1 | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1517 | CKV_K8S_15 | resource | kubernetes_pod | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1518 | CKV_K8S_15 | resource | kubernetes_pod_v1 | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1519 | CKV_K8S_16 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1520 | CKV_K8S_16 | resource | kubernetes_deployment_v1 | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1521 | CKV_K8S_16 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1522 | CKV_K8S_16 | resource | kubernetes_pod_v1 | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1523 | CKV_K8S_17 | resource | kubernetes_deployment | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1524 | CKV_K8S_17 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1525 | CKV_K8S_17 | resource | kubernetes_pod | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1526 | CKV_K8S_17 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1527 | CKV_K8S_18 | resource | kubernetes_deployment | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1528 | CKV_K8S_18 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1529 | CKV_K8S_18 | resource | kubernetes_pod | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1530 | CKV_K8S_18 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1531 | CKV_K8S_19 | resource | kubernetes_deployment | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1532 | CKV_K8S_19 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1533 | CKV_K8S_19 | resource | kubernetes_pod | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1534 | CKV_K8S_19 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1535 | CKV_K8S_20 | resource | kubernetes_deployment | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1536 | CKV_K8S_20 | resource | kubernetes_deployment_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1537 | CKV_K8S_20 | resource | kubernetes_pod | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1538 | CKV_K8S_20 | resource | kubernetes_pod_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1539 | CKV_K8S_21 | resource | kubernetes_config_map | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1540 | CKV_K8S_21 | resource | kubernetes_config_map_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1541 | CKV_K8S_21 | resource | kubernetes_cron_job | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1542 | CKV_K8S_21 | resource | kubernetes_cron_job_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1543 | CKV_K8S_21 | resource | kubernetes_daemon_set_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1544 | CKV_K8S_21 | resource | kubernetes_daemonset | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1545 | CKV_K8S_21 | resource | kubernetes_deployment | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1546 | CKV_K8S_21 | resource | kubernetes_deployment_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1547 | CKV_K8S_21 | resource | kubernetes_ingress | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1548 | CKV_K8S_21 | resource | kubernetes_ingress_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1549 | CKV_K8S_21 | resource | kubernetes_job | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1550 | CKV_K8S_21 | resource | kubernetes_job_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1551 | CKV_K8S_21 | resource | kubernetes_pod | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1552 | CKV_K8S_21 | resource | kubernetes_pod_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1553 | CKV_K8S_21 | resource | kubernetes_replication_controller | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1554 | CKV_K8S_21 | resource | kubernetes_replication_controller_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1555 | CKV_K8S_21 | resource | kubernetes_role_binding | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1556 | CKV_K8S_21 | resource | kubernetes_role_binding_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1557 | CKV_K8S_21 | resource | kubernetes_secret | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1558 | CKV_K8S_21 | resource | kubernetes_secret_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1559 | CKV_K8S_21 | resource | kubernetes_service | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1560 | CKV_K8S_21 | resource | kubernetes_service_account | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1561 | CKV_K8S_21 | resource | kubernetes_service_account_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1562 | CKV_K8S_21 | resource | kubernetes_service_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1563 | CKV_K8S_21 | resource | kubernetes_stateful_set | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1564 | CKV_K8S_21 | resource | kubernetes_stateful_set_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1565 | CKV_K8S_22 | resource | kubernetes_deployment | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1566 | CKV_K8S_22 | resource | kubernetes_deployment_v1 | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1567 | CKV_K8S_22 | resource | kubernetes_pod | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1568 | CKV_K8S_22 | resource | kubernetes_pod_v1 | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1569 | CKV_K8S_24 | resource | kubernetes_pod_security_policy | Do not allow containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1570 | CKV_K8S_25 | resource | kubernetes_deployment | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1571 | CKV_K8S_25 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1572 | CKV_K8S_25 | resource | kubernetes_pod | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1573 | CKV_K8S_25 | resource | kubernetes_pod_v1 | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1574 | CKV_K8S_26 | resource | kubernetes_deployment | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1575 | CKV_K8S_26 | resource | kubernetes_deployment_v1 | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1576 | CKV_K8S_26 | resource | kubernetes_pod | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1577 | CKV_K8S_26 | resource | kubernetes_pod_v1 | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1578 | CKV_K8S_27 | resource | kubernetes_daemon_set_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1579 | CKV_K8S_27 | resource | kubernetes_daemonset | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1580 | CKV_K8S_27 | resource | kubernetes_deployment | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1581 | CKV_K8S_27 | resource | kubernetes_deployment_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1582 | CKV_K8S_27 | resource | kubernetes_pod | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1583 | CKV_K8S_27 | resource | kubernetes_pod_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1584 | CKV_K8S_28 | resource | kubernetes_deployment | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1585 | CKV_K8S_28 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1586 | CKV_K8S_28 | resource | kubernetes_pod | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1587 | CKV_K8S_28 | resource | kubernetes_pod_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1588 | CKV_K8S_29 | resource | kubernetes_daemon_set_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1589 | CKV_K8S_29 | resource | kubernetes_daemonset | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1590 | CKV_K8S_29 | resource | kubernetes_deployment | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1591 | CKV_K8S_29 | resource | kubernetes_deployment_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1592 | CKV_K8S_29 | resource | kubernetes_pod | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1593 | CKV_K8S_29 | resource | kubernetes_pod_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1594 | CKV_K8S_30 | resource | kubernetes_deployment | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1595 | CKV_K8S_30 | resource | kubernetes_deployment_v1 | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1596 | CKV_K8S_30 | resource | kubernetes_pod | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1597 | CKV_K8S_30 | resource | kubernetes_pod_v1 | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1598 | CKV_K8S_32 | resource | kubernetes_pod_security_policy | Ensure default seccomp profile set to docker/default or runtime/default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1599 | CKV_K8S_34 | resource | kubernetes_deployment | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1600 | CKV_K8S_34 | resource | kubernetes_deployment_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1601 | CKV_K8S_34 | resource | kubernetes_pod | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1602 | CKV_K8S_34 | resource | kubernetes_pod_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1603 | CKV_K8S_35 | resource | kubernetes_deployment | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1604 | CKV_K8S_35 | resource | kubernetes_deployment_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1605 | CKV_K8S_35 | resource | kubernetes_pod | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1606 | CKV_K8S_35 | resource | kubernetes_pod_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1607 | CKV_K8S_36 | resource | kubernetes_pod_security_policy | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1608 | CKV_K8S_37 | resource | kubernetes_deployment | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1609 | CKV_K8S_37 | resource | kubernetes_deployment_v1 | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1610 | CKV_K8S_37 | resource | kubernetes_pod | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1611 | CKV_K8S_37 | resource | kubernetes_pod_v1 | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1612 | CKV_K8S_39 | resource | kubernetes_deployment | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1613 | CKV_K8S_39 | resource | kubernetes_deployment_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1614 | CKV_K8S_39 | resource | kubernetes_pod | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1615 | CKV_K8S_39 | resource | kubernetes_pod_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1616 | CKV_K8S_41 | resource | kubernetes_service_account | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1617 | CKV_K8S_41 | resource | kubernetes_service_account_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1618 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1619 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1620 | CKV_K8S_42 | resource | kubernetes_role_binding | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1621 | CKV_K8S_42 | resource | kubernetes_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1622 | CKV_K8S_43 | resource | kubernetes_deployment | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1623 | CKV_K8S_43 | resource | kubernetes_deployment_v1 | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1624 | CKV_K8S_43 | resource | kubernetes_pod | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1625 | CKV_K8S_43 | resource | kubernetes_pod_v1 | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1626 | CKV_K8S_44 | resource | kubernetes_service | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1627 | CKV_K8S_44 | resource | kubernetes_service_v1 | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1628 | CKV_K8S_49 | resource | kubernetes_cluster_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1629 | CKV_K8S_49 | resource | kubernetes_cluster_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1630 | CKV_K8S_49 | resource | kubernetes_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1631 | CKV_K8S_49 | resource | kubernetes_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1632 | CKV_LIN_1 | provider | linode | Ensure no hard coded Linode tokens exist in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1633 | CKV_LIN_2 | resource | linode_instance | Ensure SSH key set in authorized_keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1634 | CKV_LIN_3 | resource | linode_user | Ensure email is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1635 | CKV_LIN_4 | resource | linode_user | Ensure username is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1636 | CKV_LIN_5 | resource | linode_firewall | Ensure Inbound Firewall Policy is not set to ACCEPT | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1637 | CKV_LIN_6 | resource | linode_firewall | Ensure Outbound Firewall Policy is not set to ACCEPT | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1638 | CKV_NCP_1 | resource | ncloud_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1639 | CKV_NCP_2 | resource | ncloud_access_control_group | Ensure every access control groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1640 | CKV_NCP_2 | resource | ncloud_access_control_group_rule | Ensure every access control groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1641 | CKV_NCP_3 | resource | ncloud_access_control_group_rule | Ensure no security group rules allow outbound traffic to 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1642 | CKV_NCP_4 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1643 | CKV_NCP_5 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1644 | CKV_NCP_6 | resource | ncloud_server | Ensure Server instance is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1645 | CKV_NCP_7 | resource | ncloud_launch_configuration | Ensure Basic Block storage is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1646 | CKV_NCP_8 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1647 | CKV_NCP_9 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1648 | CKV_NCP_10 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1649 | CKV_NCP_11 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1650 | CKV_NCP_12 | resource | ncloud_network_acl_rule | An inbound Network ACL rule should not allow ALL ports. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1651 | CKV_NCP_13 | resource | ncloud_lb_listener | Ensure LB Listener uses only secure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1652 | CKV_NCP_14 | resource | ncloud_nas_volume | Ensure NAS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1653 | CKV_NCP_15 | resource | ncloud_lb_target_group | Ensure Load Balancer Target Group is not using HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1654 | CKV_NCP_16 | resource | ncloud_lb | Ensure Load Balancer isn't exposed to the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1655 | CKV_NCP_19 | resource | ncloud_nks_cluster | Ensure Naver Kubernetes Service public endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1656 | CKV_NCP_22 | resource | ncloud_nks_cluster | Ensure NKS control plane logging enabled for all log types | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1657 | CKV_NCP_23 | resource | ncloud_public_ip | Ensure Server instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1658 | CKV_NCP_24 | resource | ncloud_lb_listener | Ensure Load Balancer Listener Using HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1659 | CKV_NCP_25 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1660 | CKV_OCI_1 | provider | oci | Ensure no hard coded OCI private key in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1661 | CKV_OCI_2 | resource | oci_core_volume | Ensure OCI Block Storage Block Volume has backup enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1662 | CKV_OCI_3 | resource | oci_core_volume | OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1663 | CKV_OCI_4 | resource | oci_core_instance | Ensure OCI Compute Instance boot volume has in-transit data encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1664 | CKV_OCI_5 | resource | oci_core_instance | Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1665 | CKV_OCI_6 | resource | oci_core_instance | Ensure OCI Compute Instance has monitoring enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1666 | CKV_OCI_7 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage bucket can emit object events | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1667 | CKV_OCI_8 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1668 | CKV_OCI_9 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1669 | CKV_OCI_10 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is not Public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1670 | CKV_OCI_11 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain lower case | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1671 | CKV_OCI_12 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Numeric characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1672 | CKV_OCI_13 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Special characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1673 | CKV_OCI_14 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Uppercase characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1674 | CKV_OCI_15 | resource | oci_file_storage_file_system | Ensure OCI File System is Encrypted with a customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1675 | CKV_OCI_16 | resource | oci_core_security_list | Ensure VCN has an inbound security list | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1676 | CKV_OCI_17 | resource | oci_core_security_list | Ensure VCN inbound security lists are stateless | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1677 | CKV_OCI_18 | resource | oci_identity_authentication_policy | OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1678 | CKV_OCI_19 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 22. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1679 | CKV_OCI_20 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 3389. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1680 | CKV_OCI_21 | resource | oci_core_network_security_group_security_rule | Ensure security group has stateless ingress security rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1681 | CKV_OCI_22 | resource | oci_core_network_security_group_security_rule | Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1682 | CKV2_OCI_1 | resource | oci_identity_group | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1683 | CKV2_OCI_1 | resource | oci_identity_user | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1684 | CKV2_OCI_1 | resource | oci_identity_user_group_membership | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1685 | CKV_OPENSTACK_1 | provider | openstack | Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1686 | CKV_OPENSTACK_2 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1687 | CKV_OPENSTACK_2 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1688 | CKV_OPENSTACK_3 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1689 | CKV_OPENSTACK_3 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1690 | CKV_OPENSTACK_4 | resource | openstack_compute_instance_v2 | Ensure that instance does not use basic credentials | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1691 | CKV_OPENSTACK_5 | resource | openstack_fw_rule_v1 | Ensure firewall rule set a destination IP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1692 | CKV_PAN_1 | provider | panos | Ensure no hard coded PAN-OS credentials exist in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1693 | CKV_PAN_2 | resource | panos_management_profile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1694 | CKV_PAN_3 | resource | panos_management_profile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1695 | CKV_PAN_4 | resource | panos_security_policy | Ensure DSRI is not enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1696 | CKV_PAN_4 | resource | panos_security_rule_group | Ensure DSRI is not enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1697 | CKV_PAN_5 | resource | panos_security_policy | Ensure security rules do not have 'applications' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1698 | CKV_PAN_5 | resource | panos_security_rule_group | Ensure security rules do not have 'applications' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1699 | CKV_PAN_6 | resource | panos_security_policy | Ensure security rules do not have 'services' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1700 | CKV_PAN_6 | resource | panos_security_rule_group | Ensure security rules do not have 'services' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1701 | CKV_PAN_7 | resource | panos_security_policy | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1702 | CKV_PAN_7 | resource | panos_security_rule_group | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1703 | CKV_PAN_8 | resource | panos_security_policy | Ensure description is populated within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1704 | CKV_PAN_8 | resource | panos_security_rule_group | Ensure description is populated within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1705 | CKV_PAN_9 | resource | panos_security_policy | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1706 | CKV_PAN_9 | resource | panos_security_rule_group | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1707 | CKV_PAN_10 | resource | panos_security_policy | Ensure logging at session end is enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1708 | CKV_PAN_10 | resource | panos_security_rule_group | Ensure logging at session end is enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1709 | CKV_PAN_11 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1710 | CKV_PAN_11 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1711 | CKV_PAN_12 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1712 | CKV_PAN_12 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1713 | CKV_PAN_13 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1714 | CKV_PAN_13 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1715 | CKV_PAN_14 | resource | panos_panorama_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1716 | CKV_PAN_14 | resource | panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1717 | CKV_PAN_14 | resource | panos_zone_entry | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1718 | CKV_PAN_15 | resource | panos_panorama_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1719 | CKV_PAN_15 | resource | panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1720 | CKV_YC_1 | resource | yandex_mdb_clickhouse_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1721 | CKV_YC_1 | resource | yandex_mdb_elasticsearch_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1722 | CKV_YC_1 | resource | yandex_mdb_greenplum_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1723 | CKV_YC_1 | resource | yandex_mdb_kafka_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1724 | CKV_YC_1 | resource | yandex_mdb_mongodb_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1725 | CKV_YC_1 | resource | yandex_mdb_mysql_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1726 | CKV_YC_1 | resource | yandex_mdb_postgresql_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1727 | CKV_YC_1 | resource | yandex_mdb_redis_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1728 | CKV_YC_1 | resource | yandex_mdb_sqlserver_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1729 | CKV_YC_2 | resource | yandex_compute_instance | Ensure compute instance does not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1730 | CKV_YC_3 | resource | yandex_storage_bucket | Ensure storage bucket is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1731 | CKV_YC_4 | resource | yandex_compute_instance | Ensure compute instance does not have serial console enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1732 | CKV_YC_5 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster does not have public IP address. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1733 | CKV_YC_6 | resource | yandex_kubernetes_node_group | Ensure Kubernetes cluster node group does not have public IP addresses. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1734 | CKV_YC_7 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster auto-upgrade is enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1735 | CKV_YC_8 | resource | yandex_kubernetes_node_group | Ensure Kubernetes node group auto-upgrade is enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1736 | CKV_YC_9 | resource | yandex_kms_symmetric_key | Ensure KMS symmetric key is rotated. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1737 | CKV_YC_10 | resource | yandex_kubernetes_cluster | Ensure etcd database is encrypted with KMS key. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1738 | CKV_YC_11 | resource | yandex_compute_instance | Ensure security group is assigned to network interface. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1739 | CKV_YC_12 | resource | yandex_mdb_clickhouse_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1740 | CKV_YC_12 | resource | yandex_mdb_elasticsearch_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1741 | CKV_YC_12 | resource | yandex_mdb_greenplum_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1742 | CKV_YC_12 | resource | yandex_mdb_kafka_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1743 | CKV_YC_12 | resource | yandex_mdb_mongodb_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1744 | CKV_YC_12 | resource | yandex_mdb_mysql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1745 | CKV_YC_12 | resource | yandex_mdb_postgresql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1746 | CKV_YC_12 | resource | yandex_mdb_sqlserver_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1747 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure cloud member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1748 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_member | Ensure cloud member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1749 | CKV_YC_14 | resource | yandex_kubernetes_cluster | Ensure security group is assigned to Kubernetes cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1750 | CKV_YC_15 | resource | yandex_kubernetes_node_group | Ensure security group is assigned to Kubernetes node group. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1751 | CKV_YC_16 | resource | yandex_kubernetes_cluster | Ensure network policy is assigned to Kubernetes cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1752 | CKV_YC_17 | resource | yandex_storage_bucket | Ensure storage bucket does not have public access permissions. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1753 | CKV_YC_18 | resource | yandex_compute_instance_group | Ensure compute instance group does not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1754 | CKV_YC_19 | resource | yandex_vpc_security_group | Ensure security group does not contain allow-all rules. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1755 | CKV_YC_20 | resource | yandex_vpc_security_group_rule | Ensure security group rule is not allow-all. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1756 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_binding | Ensure organization member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1757 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_member | Ensure organization member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1758 | CKV_YC_22 | resource | yandex_compute_instance_group | Ensure compute instance group has security group assigned. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1759 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_binding | Ensure folder member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1760 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_member | Ensure folder member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1761 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1762 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1763 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1764 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1765 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | -| 1766 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov | +| | | Id | Type | Entity | Policy | IaC | +|------|-----------------|----------|---------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0 | CKV2_ADO_1 | resource | azuredevops_branch_policy_min_reviewers | Ensure at least two approving reviews for PRs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1 | CKV2_ADO_1 | resource | azuredevops_git_repository | Ensure at least two approving reviews for PRs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 2 | CKV_ALI_1 | resource | alicloud_oss_bucket | Alibaba Cloud OSS bucket accessible to public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketPublic.py | +| 3 | CKV_ALI_2 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress22.py | +| 4 | CKV_ALI_3 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress3389.py | +| 5 | CKV_ALI_4 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/ActionTrailLogAllRegions.py | +| 6 | CKV_ALI_5 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all events | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/ActionTrailLogAllEvents.py | +| 7 | CKV_ALI_6 | resource | alicloud_oss_bucket | Ensure OSS bucket is encrypted with Customer Master Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketEncryptedWithCMK.py | +| 8 | CKV_ALI_7 | resource | alicloud_disk | Ensure disk is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/DiskIsEncrypted.py | +| 9 | CKV_ALI_8 | resource | alicloud_disk | Ensure Disk is encrypted with Customer Master Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/DiskEncryptedWithCMK.py | +| 10 | CKV_ALI_9 | resource | alicloud_db_instance | Ensure database instance is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSIsPublic.py | +| 11 | CKV_ALI_10 | resource | alicloud_oss_bucket | Ensure OSS bucket has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketVersioning.py | +| 12 | CKV_ALI_11 | resource | alicloud_oss_bucket | Ensure OSS bucket has transfer Acceleration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketTransferAcceleration.py | +| 13 | CKV_ALI_12 | resource | alicloud_oss_bucket | Ensure the OSS bucket has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/OSSBucketAccessLogs.py | +| 14 | CKV_ALI_13 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires minimum length of 14 or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLength.py | +| 15 | CKV_ALI_14 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one number | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyNumber.py | +| 16 | CKV_ALI_15 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one symbol | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicySymbol.py | +| 17 | CKV_ALI_16 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy expires passwords within 90 days or less | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyExpiration.py | +| 18 | CKV_ALI_17 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one lowercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLowercaseLetter.py | +| 19 | CKV_ALI_18 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy prevents password reuse | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyReuse.py | +| 20 | CKV_ALI_19 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one uppercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyUppcaseLetter.py | +| 21 | CKV_ALI_20 | resource | alicloud_db_instance | Ensure RDS instance uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceSSL.py | +| 22 | CKV_ALI_21 | resource | alicloud_api_gateway_api | Ensure API Gateway API Protocol HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/APIGatewayProtocolHTTPS.py | +| 23 | CKV_ALI_22 | resource | alicloud_db_instance | Ensure Transparent Data Encryption is Enabled on instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSTransparentDataEncryptionEnabled.py | +| 24 | CKV_ALI_23 | resource | alicloud_ram_account_password_policy | Ensure Ram Account Password Policy Max Login Attempts not > 5 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyMaxLogin.py | +| 25 | CKV_ALI_24 | resource | alicloud_ram_security_preference | Ensure RAM enforces MFA | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RAMSecurityEnforceMFA.py | +| 26 | CKV_ALI_25 | resource | alicloud_db_instance | Ensure RDS Instance SQL Collector Retention Period should be greater than 180 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSRetention.py | +| 27 | CKV_ALI_26 | resource | alicloud_cs_kubernetes | Ensure Kubernetes installs plugin Terway or Flannel to support standard policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/K8sEnableNetworkPolicies.py | +| 28 | CKV_ALI_27 | resource | alicloud_kms_key | Ensure KMS Key Rotation is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/KMSKeyRotationIsEnabled.py | +| 29 | CKV_ALI_28 | resource | alicloud_kms_key | Ensure KMS Keys are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/KMSKeyIsEnabled.py | +| 30 | CKV_ALI_29 | resource | alicloud_alb_acl_entry_attachment | Alibaba ALB ACL does not restrict Access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/ALBACLIsUnrestricted.py | +| 31 | CKV_ALI_30 | resource | alicloud_db_instance | Ensure RDS instance auto upgrades for minor versions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceAutoUpgrade.py | +| 32 | CKV_ALI_31 | resource | alicloud_cs_kubernetes_node_pool | Ensure K8s nodepools are set to auto repair | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/K8sNodePoolAutoRepair.py | +| 33 | CKV_ALI_32 | resource | alicloud_ecs_launch_template | Ensure launch template data disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/LaunchTemplateDisksAreEncrypted.py | +| 34 | CKV_ALI_33 | resource | alicloud_slb_tls_cipher_policy | Alibaba Cloud Cypher Policy are secure | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/TLSPoliciesAreSecure.py | +| 35 | CKV_ALI_35 | resource | alicloud_db_instance | Ensure RDS instance has log_duration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceLogsEnabled.py | +| 36 | CKV_ALI_36 | resource | alicloud_db_instance | Ensure RDS instance has log_disconnections enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceLogDisconnections.py | +| 37 | CKV_ALI_37 | resource | alicloud_db_instance | Ensure RDS instance has log_connections enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/RDSInstanceLogConnections.py | +| 38 | CKV_ALI_38 | resource | alicloud_log_audit | Ensure log audit is enabled for RDS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/LogAuditRDSEnabled.py | +| 39 | CKV_ALI_41 | resource | alicloud_mongodb_instance | Ensure MongoDB is deployed inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/MongoDBInsideVPC.py | +| 40 | CKV_ALI_42 | resource | alicloud_mongodb_instance | Ensure Mongodb instance uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/MongoDBInstanceSSL.py | +| 41 | CKV_ALI_43 | resource | alicloud_mongodb_instance | Ensure MongoDB instance is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/MongoDBIsPublic.py | +| 42 | CKV_ALI_44 | resource | alicloud_mongodb_instance | Ensure MongoDB has Transparent Data Encryption Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/alicloud/MongoDBTransparentDataEncryptionEnabled.py | +| 43 | CKV_AWS_1 | data | aws_iam_policy_document | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py | +| 44 | CKV_AWS_2 | resource | aws_alb_listener | Ensure ALB protocol is HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py | +| 45 | CKV_AWS_2 | resource | aws_lb_listener | Ensure ALB protocol is HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py | +| 46 | CKV_AWS_3 | resource | aws_ebs_volume | Ensure all data stored in the EBS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EBSEncryption.py | +| 47 | CKV_AWS_5 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py | +| 48 | CKV_AWS_5 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py | +| 49 | CKV_AWS_6 | resource | aws_elasticsearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py | +| 50 | CKV_AWS_6 | resource | aws_opensearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py | +| 51 | CKV_AWS_7 | resource | aws_kms_key | Ensure rotation for customer created CMKs is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KMSRotation.py | +| 52 | CKV_AWS_8 | resource | aws_instance | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py | +| 53 | CKV_AWS_8 | resource | aws_launch_configuration | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py | +| 54 | CKV_AWS_9 | resource | aws_iam_account_password_policy | Ensure IAM password policy expires passwords within 90 days or less | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyExpiration.py | +| 55 | CKV_AWS_10 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires minimum length of 14 or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyLength.py | +| 56 | CKV_AWS_11 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one lowercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyLowercaseLetter.py | +| 57 | CKV_AWS_12 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one number | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyNumber.py | +| 58 | CKV_AWS_13 | resource | aws_iam_account_password_policy | Ensure IAM password policy prevents password reuse | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyReuse.py | +| 59 | CKV_AWS_14 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one symbol | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicySymbol.py | +| 60 | CKV_AWS_15 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one uppercase letter | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/PasswordPolicyUppercaseLetter.py | +| 61 | CKV_AWS_16 | resource | aws_db_instance | Ensure all data stored in the RDS is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSEncryption.py | +| 62 | CKV_AWS_17 | resource | aws_db_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py | +| 63 | CKV_AWS_17 | resource | aws_rds_cluster_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py | +| 64 | CKV_AWS_18 | resource | aws_s3_bucket | Ensure the S3 bucket has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 65 | CKV_AWS_19 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 66 | CKV_AWS_19 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 67 | CKV_AWS_20 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public READ access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 68 | CKV_AWS_20 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public READ access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 69 | CKV_AWS_21 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 70 | CKV_AWS_21 | resource | aws_s3_bucket_versioning | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 71 | CKV_AWS_22 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker Notebook is encrypted at rest using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SagemakerNotebookEncryption.py | +| 72 | CKV_AWS_23 | resource | aws_db_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 73 | CKV_AWS_23 | resource | aws_elasticache_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 74 | CKV_AWS_23 | resource | aws_redshift_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 75 | CKV_AWS_23 | resource | aws_security_group | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 76 | CKV_AWS_23 | resource | aws_security_group_rule | Ensure every security groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py | +| 77 | CKV_AWS_24 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 78 | CKV_AWS_24 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py | +| 79 | CKV_AWS_25 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 80 | CKV_AWS_25 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py | +| 81 | CKV_AWS_26 | resource | aws_sns_topic | Ensure all data stored in the SNS topic is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SNSTopicEncryption.py | +| 82 | CKV_AWS_27 | resource | aws_sqs_queue | Ensure all data stored in the SQS queue is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SQSQueueEncryption.py | +| 83 | CKV_AWS_28 | resource | aws_dynamodb_table | Ensure Dynamodb point in time recovery (backup) is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DynamodbRecovery.py | +| 84 | CKV_AWS_29 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py | +| 85 | CKV_AWS_30 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py | +| 86 | CKV_AWS_31 | resource | aws_elasticache_replication_group | Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py | +| 87 | CKV_AWS_32 | resource | aws_ecr_repository_policy | Ensure ECR policy is not set to public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECRPolicy.py | +| 88 | CKV_AWS_33 | resource | aws_kms_key | Ensure KMS key policy does not contain wildcard (*) principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KMSKeyWildcardPrincipal.py | +| 89 | CKV_AWS_34 | resource | aws_cloudfront_distribution | Ensure cloudfront distribution ViewerProtocolPolicy is set to HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudfrontDistributionEncryption.py | +| 90 | CKV_AWS_35 | resource | aws_cloudtrail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailEncryptionWithCMK.py | +| 91 | CKV_AWS_36 | resource | aws_cloudtrail | Ensure CloudTrail log file validation is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailLogValidation.py | +| 92 | CKV_AWS_37 | resource | aws_eks_cluster | Ensure Amazon EKS control plane logging enabled for all log types | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSControlPlaneLogging.py | +| 93 | CKV_AWS_38 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSPublicAccessCIDR.py | +| 94 | CKV_AWS_39 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSPublicAccess.py | +| 95 | CKV_AWS_40 | resource | aws_iam_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 96 | CKV_AWS_40 | resource | aws_iam_user_policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 97 | CKV_AWS_40 | resource | aws_iam_user_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py | +| 98 | CKV_AWS_41 | provider | aws | Ensure no hard coded AWS access key and secret key exists in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/aws/credentials.py | +| 99 | CKV_AWS_42 | resource | aws_efs_file_system | Ensure EFS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EFSEncryptionEnabled.py | +| 100 | CKV_AWS_43 | resource | aws_kinesis_stream | Ensure Kinesis Stream is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisStreamEncryptionType.py | +| 101 | CKV_AWS_44 | resource | aws_neptune_cluster | Ensure Neptune storage is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterStorageEncrypted.py | +| 102 | CKV_AWS_45 | resource | aws_lambda_function | Ensure no hard-coded secrets exist in lambda environment | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaEnvironmentCredentials.py | +| 103 | CKV_AWS_46 | resource | aws_instance | Ensure no hard-coded secrets exist in EC2 user data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2Credentials.py | +| 104 | CKV_AWS_47 | resource | aws_dax_cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DAXEncryption.py | +| 105 | CKV_AWS_48 | resource | aws_mq_broker | Ensure MQ Broker logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerLogging.py | +| 106 | CKV_AWS_49 | data | aws_iam_policy_document | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py | +| 107 | CKV_AWS_50 | resource | aws_lambda_function | X-ray tracing is enabled for Lambda | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py | +| 108 | CKV_AWS_51 | resource | aws_ecr_repository | Ensure ECR Image Tags are immutable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECRImmutableTags.py | +| 109 | CKV_AWS_53 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public ACLS enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3BlockPublicACLs.py | +| 110 | CKV_AWS_54 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public policy enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3BlockPublicPolicy.py | +| 111 | CKV_AWS_55 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has ignore public ACLs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3IgnorePublicACLs.py | +| 112 | CKV_AWS_56 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has 'restrict_public_bucket' enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3RestrictPublicBuckets.py | +| 113 | CKV_AWS_57 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 114 | CKV_AWS_57 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 115 | CKV_AWS_58 | resource | aws_eks_cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSSecretsEncryption.py | +| 116 | CKV_AWS_59 | resource | aws_api_gateway_method | Ensure there is no open access to back-end resources through API | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py | +| 117 | CKV_AWS_60 | resource | aws_iam_role | Ensure IAM role allows only specific services or principals to assume it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py | +| 118 | CKV_AWS_61 | resource | aws_iam_role | Ensure AWS IAM policy does not allow assume role permission across all services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py | +| 119 | CKV_AWS_62 | resource | aws_iam_group_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 120 | CKV_AWS_62 | resource | aws_iam_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 121 | CKV_AWS_62 | resource | aws_iam_role_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 122 | CKV_AWS_62 | resource | aws_iam_user_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 123 | CKV_AWS_62 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py | +| 124 | CKV_AWS_63 | resource | aws_iam_group_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 125 | CKV_AWS_63 | resource | aws_iam_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 126 | CKV_AWS_63 | resource | aws_iam_role_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 127 | CKV_AWS_63 | resource | aws_iam_user_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 128 | CKV_AWS_63 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py | +| 129 | CKV_AWS_64 | resource | aws_redshift_cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterEncryption.py | +| 130 | CKV_AWS_65 | resource | aws_ecs_cluster | Ensure container insights are enabled on ECS cluster | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py | +| 131 | CKV_AWS_66 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group specifies retention days | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetention.py | +| 132 | CKV_AWS_67 | resource | aws_cloudtrail | Ensure CloudTrail is enabled in all Regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailMultiRegion.py | +| 133 | CKV_AWS_68 | resource | aws_cloudfront_distribution | CloudFront Distribution should have WAF enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFEnabled.py | +| 134 | CKV_AWS_69 | resource | aws_mq_broker | Ensure MQ Broker is not publicly exposed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerNotPubliclyExposed.py | +| 135 | CKV_AWS_70 | resource | aws_s3_bucket | Ensure S3 bucket does not allow an action with any Principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py | +| 136 | CKV_AWS_70 | resource | aws_s3_bucket_policy | Ensure S3 bucket does not allow an action with any Principal | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py | +| 137 | CKV_AWS_71 | resource | aws_redshift_cluster | Ensure Redshift Cluster logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterLogging.py | +| 138 | CKV_AWS_72 | resource | aws_sqs_queue_policy | Ensure SQS policy does not allow ALL (*) actions. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SQSPolicy.py | +| 139 | CKV_AWS_73 | resource | aws_api_gateway_stage | Ensure API Gateway has X-Ray Tracing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayXray.py | +| 140 | CKV_AWS_74 | resource | aws_docdb_cluster | Ensure DocDB is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBEncryption.py | +| 141 | CKV_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure Global Accelerator accelerator has flow logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlobalAcceleratorAcceleratorFlowLogs.py | +| 142 | CKV_AWS_76 | resource | aws_api_gateway_stage | Ensure API Gateway has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py | +| 143 | CKV_AWS_76 | resource | aws_apigatewayv2_stage | Ensure API Gateway has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py | +| 144 | CKV_AWS_77 | resource | aws_athena_database | Ensure Athena Database is encrypted at rest (default is unencrypted) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AthenaDatabaseEncryption.py | +| 145 | CKV_AWS_78 | resource | aws_codebuild_project | Ensure that CodeBuild Project encryption is not disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py | +| 146 | CKV_AWS_79 | resource | aws_instance | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py | +| 147 | CKV_AWS_79 | resource | aws_launch_configuration | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py | +| 148 | CKV_AWS_79 | resource | aws_launch_template | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py | +| 149 | CKV_AWS_80 | resource | aws_msk_cluster | Ensure MSK Cluster logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MSKClusterLogging.py | +| 150 | CKV_AWS_81 | resource | aws_msk_cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py | +| 151 | CKV_AWS_82 | resource | aws_athena_workgroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AthenaWorkgroupConfiguration.py | +| 152 | CKV_AWS_83 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py | +| 153 | CKV_AWS_83 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py | +| 154 | CKV_AWS_84 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py | +| 155 | CKV_AWS_84 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py | +| 156 | CKV_AWS_85 | resource | aws_docdb_cluster | Ensure DocDB Logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBLogging.py | +| 157 | CKV_AWS_86 | resource | aws_cloudfront_distribution | Ensure Cloudfront distribution has Access Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudfrontDistributionLogging.py | +| 158 | CKV_AWS_87 | resource | aws_redshift_cluster | Redshift cluster should not be publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshitClusterPubliclyAvailable.py | +| 159 | CKV_AWS_88 | resource | aws_instance | EC2 instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2PublicIP.py | +| 160 | CKV_AWS_88 | resource | aws_launch_template | EC2 instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2PublicIP.py | +| 161 | CKV_AWS_89 | resource | aws_dms_replication_instance | DMS replication instance should not be publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py | +| 162 | CKV_AWS_90 | resource | aws_docdb_cluster_parameter_group | Ensure DocDB TLS is not disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBTLS.py | +| 163 | CKV_AWS_91 | resource | aws_alb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py | +| 164 | CKV_AWS_91 | resource | aws_lb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py | +| 165 | CKV_AWS_92 | resource | aws_elb | Ensure the ELB has access logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBAccessLogs.py | +| 166 | CKV_AWS_93 | resource | aws_s3_bucket | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py | +| 167 | CKV_AWS_93 | resource | aws_s3_bucket_policy | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py | +| 168 | CKV_AWS_94 | resource | aws_glue_data_catalog_encryption_settings | Ensure Glue Data Catalog Encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueDataCatalogEncryption.py | +| 169 | CKV_AWS_96 | resource | aws_rds_cluster | Ensure all data stored in Aurora is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AuroraEncryption.py | +| 170 | CKV_AWS_97 | resource | aws_ecs_task_definition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py | +| 171 | CKV_AWS_98 | resource | aws_sagemaker_endpoint_configuration | Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SagemakerEndpointConfigurationEncryption.py | +| 172 | CKV_AWS_99 | resource | aws_glue_security_configuration | Ensure Glue Security Configuration Encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueSecurityConfiguration.py | +| 173 | CKV_AWS_100 | resource | aws_eks_node_group | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EKSNodeGroupRemoteAccess.py | +| 174 | CKV_AWS_101 | resource | aws_neptune_cluster | Ensure Neptune logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterLogging.py | +| 175 | CKV_AWS_102 | resource | aws_neptune_cluster_instance | Ensure Neptune Cluster instance is not publicly available | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterInstancePublic.py | +| 176 | CKV_AWS_103 | resource | aws_alb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 177 | CKV_AWS_103 | resource | aws_lb | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 178 | CKV_AWS_103 | resource | aws_lb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 179 | CKV_AWS_104 | resource | aws_docdb_cluster_parameter_group | Ensure DocDB has audit logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBAuditLogs.py | +| 180 | CKV_AWS_105 | resource | aws_redshift_parameter_group | Ensure Redshift uses SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedShiftSSL.py | +| 181 | CKV_AWS_106 | resource | aws_ebs_encryption_by_default | Ensure EBS default encryption is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EBSDefaultEncryption.py | +| 182 | CKV_AWS_107 | data | aws_iam_policy_document | Ensure IAM policies does not allow credentials exposure | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py | +| 183 | CKV_AWS_108 | data | aws_iam_policy_document | Ensure IAM policies does not allow data exfiltration | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMDataExfiltration.py | +| 184 | CKV_AWS_109 | data | aws_iam_policy_document | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py | +| 185 | CKV_AWS_110 | data | aws_iam_policy_document | Ensure IAM policies does not allow privilege escalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py | +| 186 | CKV_AWS_111 | data | aws_iam_policy_document | Ensure IAM policies does not allow write access without constraints | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMWriteAccess.py | +| 187 | CKV_AWS_112 | resource | aws_ssm_document | Ensure Session Manager data is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentEncryption.py | +| 188 | CKV_AWS_113 | resource | aws_ssm_document | Ensure Session Manager logs are enabled and encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentLogging.py | +| 189 | CKV_AWS_114 | resource | aws_emr_cluster | Ensure that EMR clusters with Kerberos have Kerberos Realm set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py | +| 190 | CKV_AWS_115 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py | +| 191 | CKV_AWS_116 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaDLQConfigured.py | +| 192 | CKV_AWS_117 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaInVPC.py | +| 193 | CKV_AWS_118 | resource | aws_db_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py | +| 194 | CKV_AWS_118 | resource | aws_rds_cluster_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py | +| 195 | CKV_AWS_119 | resource | aws_dynamodb_table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py | +| 196 | CKV_AWS_120 | resource | aws_api_gateway_stage | Ensure API Gateway caching is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayCacheEnable.py | +| 197 | CKV_AWS_121 | resource | aws_config_configuration_aggregator | Ensure AWS Config is enabled in all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ConfigConfgurationAggregatorAllRegions.py | +| 198 | CKV_AWS_122 | resource | aws_sagemaker_notebook_instance | Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SageMakerInternetAccessDisabled.py | +| 199 | CKV_AWS_123 | resource | aws_vpc_endpoint_service | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/VPCEndpointAcceptanceConfigured.py | +| 200 | CKV_AWS_124 | resource | aws_cloudformation_stack | Ensure that CloudFormation stacks are sending event notifications to an SNS topic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudformationStackNotificationArns.py | +| 201 | CKV_AWS_126 | resource | aws_instance | Ensure that detailed monitoring is enabled for EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2DetailedMonitoringEnabled.py | +| 202 | CKV_AWS_127 | resource | aws_elb | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBUsesSSL.py | +| 203 | CKV_AWS_128 | resource | aws_rds_cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSEnableIAMAuthentication.py | +| 204 | CKV_AWS_129 | resource | aws_db_instance | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceLogging.py | +| 205 | CKV_AWS_130 | resource | aws_subnet | Ensure VPC subnets do not assign public IP by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SubnetPublicIP.py | +| 206 | CKV_AWS_131 | resource | aws_alb | Ensure that ALB drops HTTP headers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py | +| 207 | CKV_AWS_131 | resource | aws_lb | Ensure that ALB drops HTTP headers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py | +| 208 | CKV_AWS_133 | resource | aws_db_instance | Ensure that RDS instances has backup policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py | +| 209 | CKV_AWS_133 | resource | aws_rds_cluster | Ensure that RDS instances has backup policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py | +| 210 | CKV_AWS_134 | resource | aws_elasticache_cluster | Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticCacheAutomaticBackup.py | +| 211 | CKV_AWS_135 | resource | aws_instance | Ensure that EC2 is EBS optimized | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EC2EBSOptimized.py | +| 212 | CKV_AWS_136 | resource | aws_ecr_repository | Ensure that ECR repositories are encrypted using KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECRRepositoryEncrypted.py | +| 213 | CKV_AWS_137 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py | +| 214 | CKV_AWS_137 | resource | aws_opensearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py | +| 215 | CKV_AWS_138 | resource | aws_elb | Ensure that ELB is cross-zone-load-balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBCrossZoneEnable.py | +| 216 | CKV_AWS_139 | resource | aws_rds_cluster | Ensure that RDS clusters have deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSDeletionProtection.py | +| 217 | CKV_AWS_140 | resource | aws_rds_global_cluster | Ensure that RDS global clusters are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSClusterEncrypted.py | +| 218 | CKV_AWS_141 | resource | aws_redshift_cluster | Ensured that redshift cluster allowing version upgrade by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterAllowVersionUpgrade.py | +| 219 | CKV_AWS_142 | resource | aws_redshift_cluster | Ensure that Redshift cluster is encrypted by KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterKMSKey.py | +| 220 | CKV_AWS_143 | resource | aws_s3_bucket | Ensure that S3 bucket has lock configuration enabled by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3BucketObjectLock.py | +| 221 | CKV_AWS_144 | resource | aws_s3_bucket | Ensure that S3 bucket has cross-region replication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 222 | CKV_AWS_144 | resource | aws_s3_bucket_replication_configuration | Ensure that S3 bucket has cross-region replication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 223 | CKV_AWS_145 | resource | aws_s3_bucket | Ensure that S3 buckets are encrypted with KMS by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 224 | CKV_AWS_145 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure that S3 buckets are encrypted with KMS by default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 225 | CKV_AWS_146 | resource | aws_db_cluster_snapshot | Ensure that RDS database cluster snapshot is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSClusterSnapshotEncrypted.py | +| 226 | CKV_AWS_147 | resource | aws_codebuild_project | Ensure that CodeBuild projects are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodeBuildEncrypted.py | +| 227 | CKV_AWS_148 | resource | aws_default_vpc | Ensure no default VPC is planned to be provisioned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/VPCDefaultNetwork.py | +| 228 | CKV_AWS_149 | resource | aws_secretsmanager_secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecretManagerSecretEncrypted.py | +| 229 | CKV_AWS_150 | resource | aws_alb | Ensure that Load Balancer has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBDeletionProtection.py | +| 230 | CKV_AWS_150 | resource | aws_lb | Ensure that Load Balancer has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBDeletionProtection.py | +| 231 | CKV_AWS_152 | resource | aws_alb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBCrossZone.py | +| 232 | CKV_AWS_152 | resource | aws_lb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBCrossZone.py | +| 233 | CKV_AWS_153 | resource | aws_autoscaling_group | Autoscaling groups should supply tags to launch configurations | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AutoScalingTagging.py | +| 234 | CKV_AWS_154 | resource | aws_redshift_cluster | Ensure Redshift is not deployed outside of a VPC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftInEc2ClassicMode.py | +| 235 | CKV_AWS_155 | resource | aws_workspaces_workspace | Ensure that Workspace user volumes are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WorkspaceUserVolumeEncrypted.py | +| 236 | CKV_AWS_156 | resource | aws_workspaces_workspace | Ensure that Workspace root volumes are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WorkspaceRootVolumeEncrypted.py | +| 237 | CKV_AWS_157 | resource | aws_db_instance | Ensure that RDS instances have Multi-AZ enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSMultiAZEnabled.py | +| 238 | CKV_AWS_158 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group is encrypted by KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudWatchLogGroupKMSKey.py | +| 239 | CKV_AWS_159 | resource | aws_athena_workgroup | Ensure that Athena Workgroup is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AthenaWorkgroupEncryption.py | +| 240 | CKV_AWS_160 | resource | aws_timestreamwrite_database | Ensure that Timestream database is encrypted with KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/TimestreamDatabaseKMSKey.py | +| 241 | CKV_AWS_161 | resource | aws_db_instance | Ensure RDS database has IAM authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSIAMAuthentication.py | +| 242 | CKV_AWS_162 | resource | aws_rds_cluster | Ensure RDS cluster has IAM authentication enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSClusterIAMAuthentication.py | +| 243 | CKV_AWS_163 | resource | aws_ecr_repository | Ensure ECR image scanning on push is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECRImageScanning.py | +| 244 | CKV_AWS_164 | resource | aws_transfer_server | Ensure Transfer Server is not exposed publicly. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/TransferServerIsPublic.py | +| 245 | CKV_AWS_165 | resource | aws_dynamodb_global_table | Ensure Dynamodb point in time recovery (backup) is enabled for global tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DynamoDBGlobalTableRecovery.py | +| 246 | CKV_AWS_166 | resource | aws_backup_vault | Ensure Backup Vault is encrypted at rest using KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/BackupVaultEncrypted.py | +| 247 | CKV_AWS_167 | resource | aws_glacier_vault | Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlacierVaultAnyPrincipal.py | +| 248 | CKV_AWS_168 | resource | aws_sqs_queue | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py | +| 249 | CKV_AWS_168 | resource | aws_sqs_queue_policy | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py | +| 250 | CKV_AWS_169 | resource | aws_sns_topic_policy | Ensure SNS topic policy is not public by only allowing specific services or principals to access it | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SNSTopicPolicyAnyPrincipal.py | +| 251 | CKV_AWS_170 | resource | aws_qldb_ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/QLDBLedgerPermissionsMode.py | +| 252 | CKV_AWS_171 | resource | aws_emr_security_configuration | Ensure Cluster security configuration encryption is using SSE-KMS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EMRClusterIsEncryptedKMS.py | +| 253 | CKV_AWS_172 | resource | aws_qldb_ledger | Ensure QLDB ledger has deletion protection enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/QLDBLedgerDeletionProtection.py | +| 254 | CKV_AWS_173 | resource | aws_lambda_function | Check encryption settings for Lambda environmental variable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py | +| 255 | CKV_AWS_174 | resource | aws_cloudfront_distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py | +| 256 | CKV_AWS_175 | resource | aws_waf_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py | +| 257 | CKV_AWS_175 | resource | aws_wafregional_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py | +| 258 | CKV_AWS_175 | resource | aws_wafv2_web_acl | Ensure WAF has associated rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py | +| 259 | CKV_AWS_176 | resource | aws_waf_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasLogs.py | +| 260 | CKV_AWS_176 | resource | aws_wafregional_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFHasLogs.py | +| 261 | CKV_AWS_177 | resource | aws_kinesis_video_stream | Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisVideoEncryptedWithCMK.py | +| 262 | CKV_AWS_178 | resource | aws_fsx_ontap_file_system | Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/FSXOntapFSEncryptedWithCMK.py | +| 263 | CKV_AWS_179 | resource | aws_fsx_windows_file_system | Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/FSXWindowsFSEncryptedWithCMK.py | +| 264 | CKV_AWS_180 | resource | aws_imagebuilder_component | Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ImagebuilderComponentEncryptedWithCMK.py | +| 265 | CKV_AWS_181 | resource | aws_s3_object_copy | Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3ObjectCopyEncryptedWithCMK.py | +| 266 | CKV_AWS_182 | resource | aws_docdb_cluster | Ensure Doc DB is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DocDBEncryptedWithCMK.py | +| 267 | CKV_AWS_183 | resource | aws_ebs_snapshot_copy | Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EBSSnapshotCopyEncryptedWithCMK.py | +| 268 | CKV_AWS_184 | resource | aws_efs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EFSFileSystemEncryptedWithCMK.py | +| 269 | CKV_AWS_185 | resource | aws_kinesis_stream | Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisStreamEncryptedWithCMK.py | +| 270 | CKV_AWS_186 | resource | aws_s3_bucket_object | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/S3BucketObjectEncryptedWithCMK.py | +| 271 | CKV_AWS_187 | resource | aws_sagemaker_domain | Ensure Sagemaker domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SagemakerDomainEncryptedWithCMK.py | +| 272 | CKV_AWS_188 | resource | aws_redshift_cluster | Ensure RedShift Cluster is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterEncryptedWithCMK.py | +| 273 | CKV_AWS_189 | resource | aws_ebs_volume | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/EBSVolumeEncryptedWithCMK.py | +| 274 | CKV_AWS_190 | resource | aws_fsx_lustre_file_system | Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LustreFSEncryptedWithCMK.py | +| 275 | CKV_AWS_191 | resource | aws_elasticache_replication_group | Ensure Elasticache replication group is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptedWithCMK.py | +| 276 | CKV_AWS_192 | resource | aws_wafv2_web_acl | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py | +| 277 | CKV_AWS_193 | resource | aws_appsync_graphql_api | Ensure AppSync has Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppSyncLogging.py | +| 278 | CKV_AWS_194 | resource | aws_appsync_graphql_api | Ensure AppSync has Field-Level logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppSyncFieldLevelLogs.py | +| 279 | CKV_AWS_195 | resource | aws_glue_crawler | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 280 | CKV_AWS_195 | resource | aws_glue_dev_endpoint | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 281 | CKV_AWS_195 | resource | aws_glue_job | Ensure Glue component has a security configuration associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py | +| 282 | CKV_AWS_196 | resource | aws_elasticache_security_group | Ensure no aws_elasticache_security_group resources exist | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticacheHasSecurityGroup.py | +| 283 | CKV_AWS_197 | resource | aws_mq_broker | Ensure MQ Broker Audit logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerAuditLogging.py | +| 284 | CKV_AWS_198 | resource | aws_db_security_group | Ensure no aws_db_security_group resources exist | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSHasSecurityGroup.py | +| 285 | CKV_AWS_199 | resource | aws_imagebuilder_distribution_configuration | Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ImagebuilderDistributionConfigurationEncryptedWithCMK.py | +| 286 | CKV_AWS_200 | resource | aws_imagebuilder_image_recipe | Ensure that Image Recipe EBS Disk are encrypted with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ImagebuilderImageRecipeEBSEncrypted.py | +| 287 | CKV_AWS_201 | resource | aws_memorydb_cluster | Ensure MemoryDB is encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MemoryDBEncryptionWithCMK.py | +| 288 | CKV_AWS_202 | resource | aws_memorydb_cluster | Ensure MemoryDB data is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MemoryDBClusterIntransitEncryption.py | +| 289 | CKV_AWS_203 | resource | aws_fsx_openzfs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/FSXOpenZFSFileSystemEncryptedWithCMK.py | +| 290 | CKV_AWS_204 | resource | aws_ami | Ensure AMIs are encrypted using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AMIEncryption.py | +| 291 | CKV_AWS_205 | resource | aws_ami_launch_permission | Ensure to Limit AMI launch Permissions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AMILaunchIsShared.py | +| 292 | CKV_AWS_206 | resource | aws_api_gateway_domain_name | Ensure API Gateway Domain uses a modern security Policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayDomainNameTLS.py | +| 293 | CKV_AWS_207 | resource | aws_mq_broker | Ensure MQ Broker minor version updates are enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerMinorAutoUpgrade.py | +| 294 | CKV_AWS_208 | resource | aws_mq_broker | Ensure MQBroker version is current | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerVersion.py | +| 295 | CKV_AWS_208 | resource | aws_mq_configuration | Ensure MQBroker version is current | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerVersion.py | +| 296 | CKV_AWS_209 | resource | aws_mq_broker | Ensure MQ broker encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MQBrokerEncryptedWithCMK.py | +| 297 | CKV_AWS_210 | resource | aws_batch_job_definition | Batch job does not define a privileged container | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/BatchJobIsNotPrivileged.py | +| 298 | CKV_AWS_211 | resource | aws_db_instance | Ensure RDS uses a modern CaCert | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py | +| 299 | CKV_AWS_212 | resource | aws_dms_replication_instance | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DMSReplicationInstanceEncryptedWithCMK.py | +| 300 | CKV_AWS_213 | resource | aws_load_balancer_policy | Ensure ELB Policy uses only secure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ELBPolicyUsesSecureProtocols.py | +| 301 | CKV_AWS_214 | resource | aws_appsync_api_cache | Ensure Appsync API Cache is encrypted at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionAtRest.py | +| 302 | CKV_AWS_215 | resource | aws_appsync_api_cache | Ensure Appsync API Cache is encrypted in transit | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionInTransit.py | +| 303 | CKV_AWS_216 | resource | aws_cloudfront_distribution | Ensure Cloudfront distribution is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudfrontDistributionEnabled.py | +| 304 | CKV_AWS_217 | resource | aws_api_gateway_deployment | Ensure Create before destroy for API deployments | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayDeploymentCreateBeforeDestroy.py | +| 305 | CKV_AWS_218 | resource | aws_cloudsearch_domain | Ensure that Cloudsearch is using latest TLS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudsearchDomainTLS.py | +| 306 | CKV_AWS_219 | resource | aws_codepipeline | Ensure Code Pipeline Artifact store is using a KMS CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodePipelineArtifactsEncrypted.py | +| 307 | CKV_AWS_220 | resource | aws_cloudsearch_domain | Ensure that Cloudsearch is using https | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudsearchDomainEnforceHttps.py | +| 308 | CKV_AWS_221 | resource | aws_codeartifact_domain | Ensure Code artifact Domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodeArtifactDomainEncryptedWithCMK.py | +| 309 | CKV_AWS_222 | resource | aws_dms_replication_instance | Ensure DMS instance gets all minor upgrade automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DMSReplicationInstanceMinorUpgrade.py | +| 310 | CKV_AWS_223 | resource | aws_ecs_cluster | Ensure ECS Cluster enables logging of ECS Exec | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSClusterLoggingEnabled.py | +| 311 | CKV_AWS_224 | resource | aws_ecs_cluster | Ensure Cluster logging with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py | +| 312 | CKV_AWS_225 | resource | aws_api_gateway_method_settings | Ensure API Gateway method setting caching is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsCacheEnabled.py | +| 313 | CKV_AWS_226 | resource | aws_db_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py | +| 314 | CKV_AWS_226 | resource | aws_rds_cluster_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py | +| 315 | CKV_AWS_227 | resource | aws_kms_key | Ensure KMS key is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KMSKeyIsEnabled.py | +| 316 | CKV_AWS_228 | resource | aws_elasticsearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py | +| 317 | CKV_AWS_228 | resource | aws_opensearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py | +| 318 | CKV_AWS_229 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py | +| 319 | CKV_AWS_229 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py | +| 320 | CKV_AWS_230 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py | +| 321 | CKV_AWS_230 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py | +| 322 | CKV_AWS_231 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py | +| 323 | CKV_AWS_231 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py | +| 324 | CKV_AWS_232 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py | +| 325 | CKV_AWS_232 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py | +| 326 | CKV_AWS_233 | resource | aws_acm_certificate | Ensure Create before destroy for ACM certificates | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ACMCertCreateBeforeDestroy.py | +| 327 | CKV_AWS_234 | resource | aws_acm_certificate | Verify logging preference for ACM certificates | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ACMCertSetLoggingPreference.py | +| 328 | CKV_AWS_235 | resource | aws_ami_copy | Ensure that copied AMIs are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AMICopyIsEncrypted.py | +| 329 | CKV_AWS_236 | resource | aws_ami_copy | Ensure AMI copying uses a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AMICopyUsesCMK.py | +| 330 | CKV_AWS_237 | resource | aws_api_gateway_rest_api | Ensure Create before destroy for API GATEWAY | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayCreateBeforeDestroy.py | +| 331 | CKV_AWS_238 | resource | aws_guardduty_detector | Ensure that Guard Duty detector is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/GuarddutyDetectorEnabled.py | +| 332 | CKV_AWS_239 | resource | aws_dax_cluster | Ensure DAX cluster endpoint is using TLS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DAXEndpointTLS.py | +| 333 | CKV_AWS_240 | resource | aws_kinesis_firehose_delivery_stream | Ensure Kinesis Firehose delivery stream is encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamSSE.py | +| 334 | CKV_AWS_241 | resource | aws_kinesis_firehose_delivery_stream | Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamUsesCMK.py | +| 335 | CKV_AWS_242 | resource | aws_mwaa_environment | Ensure MWAA environment has scheduler logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MWAASchedulerLogsEnabled.py | +| 336 | CKV_AWS_243 | resource | aws_mwaa_environment | Ensure MWAA environment has worker logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MWAAWorkerLogsEnabled.py | +| 337 | CKV_AWS_244 | resource | aws_mwaa_environment | Ensure MWAA environment has webserver logs enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MWAAWebserverLogsEnabled.py | +| 338 | CKV_AWS_245 | resource | aws_db_instance_automated_backups_replication | Ensure replicated backups are encrypted at rest using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSInstanceAutoBackupEncryptionWithCMK.py | +| 339 | CKV_AWS_246 | resource | aws_rds_cluster_activity_stream | Ensure RDS Cluster activity streams are encrypted using KMS CMKs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSClusterActivityStreamEncryptedWithCMK.py | +| 340 | CKV_AWS_247 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py | +| 341 | CKV_AWS_247 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py | +| 342 | CKV_AWS_248 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py | +| 343 | CKV_AWS_248 | resource | aws_opensearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py | +| 344 | CKV_AWS_249 | resource | aws_ecs_task_definition | Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ECSTaskDefinitionRoleCheck.py | +| 345 | CKV_AWS_250 | resource | aws_db_instance | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py | +| 346 | CKV_AWS_250 | resource | aws_rds_cluster | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py | +| 347 | CKV_AWS_251 | resource | aws_cloudtrail | Ensure CloudTrail logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailEnableLogging.py | +| 348 | CKV_AWS_252 | resource | aws_cloudtrail | Ensure CloudTrail defines an SNS Topic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudtrailDefinesSNSTopic.py | +| 349 | CKV_AWS_253 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryption.py | +| 350 | CKV_AWS_254 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryptionWithCMK.py | +| 351 | CKV_AWS_255 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryption.py | +| 352 | CKV_AWS_256 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted using a Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryptionWithCMK.py | +| 353 | CKV_AWS_257 | resource | aws_codecommit_approval_rule_template | Ensure codecommit branch changes have at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CodecommitApprovalsRulesRequireMin2.py | +| 354 | CKV_AWS_258 | resource | aws_lambda_function_url | Ensure that Lambda function URLs AuthType is not None | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaFunctionURLAuth.py | +| 355 | CKV_AWS_259 | resource | aws_cloudfront_response_headers_policy | Ensure CloudFront response header policy enforces Strict Transport Security | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/CloudFrontResponseHeaderStrictTransportSecurity.py | +| 356 | CKV_AWS_260 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 357 | CKV_AWS_260 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py | +| 358 | CKV_AWS_261 | resource | aws_alb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py | +| 359 | CKV_AWS_261 | resource | aws_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py | +| 360 | CKV_AWS_262 | resource | aws_kendra_index | Ensure Kendra index Server side encryption uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KendraIndexSSEUsesCMK.py | +| 361 | CKV_AWS_263 | resource | aws_appflow_flow | Ensure App Flow flow uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppFlowUsesCMK.py | +| 362 | CKV_AWS_264 | resource | aws_appflow_connector_profile | Ensure App Flow connector profile uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/AppFlowConnectorProfileUsesCMK.py | +| 363 | CKV_AWS_265 | resource | aws_keyspaces_table | Ensure Keyspaces Table uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py | +| 364 | CKV_AWS_266 | resource | aws_db_snapshot_copy | Ensure App Flow connector profile uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DBSnapshotCopyUsesCMK.py | +| 365 | CKV_AWS_267 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerModelUsesCMK.py | +| 366 | CKV_AWS_268 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerVolumeUsesCMK.py | +| 367 | CKV_AWS_269 | resource | aws_connect_instance_storage_config | Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py | +| 368 | CKV_AWS_270 | resource | aws_connect_instance_storage_config | Ensure Connect Instance S3 Storage Config uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/ConnectInstanceS3StorageConfigUsesCMK.py | +| 369 | CKV_AWS_271 | resource | aws_dynamodb_table_replica | Ensure DynamoDB table replica KMS encryption uses CMK | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/DynamoDBTableReplicaKMSUsesCMK.py | +| 370 | CKV_AWS_272 | resource | aws_lambda_function | Ensure AWS Lambda function is configured to validate code-signing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/LambdaCodeSigningConfigured.py | +| 371 | CKV_AWS_273 | resource | aws_iam_user | Ensure access is controlled through SSO and not AWS IAM defined users | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMUserNotUsedForAccess.py | +| 372 | CKV_AWS_274 | resource | aws_iam_group_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 373 | CKV_AWS_274 | resource | aws_iam_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 374 | CKV_AWS_274 | resource | aws_iam_role | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 375 | CKV_AWS_274 | resource | aws_iam_role_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 376 | CKV_AWS_274 | resource | aws_iam_user_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py | +| 377 | CKV_AWS_275 | data | aws_iam_policy | Disallow policies from using the AWS AdministratorAccess policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/data/aws/IAMManagedAdminPolicy.py | +| 378 | CKV_AWS_276 | resource | aws_api_gateway_method_settings | Ensure Data Trace is not enabled in API Gateway Method Settings | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsDataTrace.py | +| 379 | CKV_AWS_277 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py | +| 380 | CKV_AWS_277 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py | +| 381 | CKV_AWS_278 | resource | aws_memorydb_snapshot | Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/MemoryDBSnapshotEncryptionWithCMK.py | +| 382 | CKV_AWS_279 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncrypted.py | +| 383 | CKV_AWS_280 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncryptedWithCMK.py | +| 384 | CKV_AWS_281 | resource | aws_redshift_snapshot_copy_grant | Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftClusterSnapshotCopyGrantEncryptedWithCMK.py | +| 385 | CKV_AWS_282 | resource | aws_redshiftserverless_namespace | Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/aws/RedshiftServerlessNamespaceKMSKey.py | +| 386 | CKV2_AWS_1 | resource | aws_network_acl | Ensure that all NACL are attached to subnets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 387 | CKV2_AWS_1 | resource | aws_subnet | Ensure that all NACL are attached to subnets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 388 | CKV2_AWS_2 | resource | aws_ebs_volume | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 389 | CKV2_AWS_2 | resource | aws_volume_attachment | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 390 | CKV2_AWS_3 | resource | aws_guardduty_detector | Ensure GuardDuty is enabled to specific org/region | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 391 | CKV2_AWS_3 | resource | aws_guardduty_organization_configuration | Ensure GuardDuty is enabled to specific org/region | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 392 | CKV2_AWS_4 | resource | aws_api_gateway_method_settings | Ensure API Gateway stage have logging level defined as appropriate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 393 | CKV2_AWS_4 | resource | aws_api_gateway_stage | Ensure API Gateway stage have logging level defined as appropriate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 394 | CKV2_AWS_5 | resource | aws_security_group | Ensure that Security Groups are attached to another resource | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 395 | CKV2_AWS_6 | resource | aws_s3_bucket | Ensure that S3 bucket has a Public Access block | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 396 | CKV2_AWS_6 | resource | aws_s3_bucket_public_access_block | Ensure that S3 bucket has a Public Access block | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 397 | CKV2_AWS_7 | resource | aws_emr_cluster | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 398 | CKV2_AWS_7 | resource | aws_security_group | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 399 | CKV2_AWS_8 | resource | aws_rds_cluster | Ensure that RDS clusters has backup plan of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 400 | CKV2_AWS_9 | resource | aws_backup_selection | Ensure that EBS are added in the backup plans of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 401 | CKV2_AWS_10 | resource | aws_cloudtrail | Ensure CloudTrail trails are integrated with CloudWatch Logs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 402 | CKV2_AWS_11 | resource | aws_vpc | Ensure VPC flow logging is enabled in all VPCs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 403 | CKV2_AWS_12 | resource | aws_default_security_group | Ensure the default security group of every VPC restricts all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 404 | CKV2_AWS_12 | resource | aws_vpc | Ensure the default security group of every VPC restricts all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 405 | CKV2_AWS_14 | resource | aws_iam_group | Ensure that IAM groups includes at least one IAM user | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 406 | CKV2_AWS_14 | resource | aws_iam_group_membership | Ensure that IAM groups includes at least one IAM user | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 407 | CKV2_AWS_15 | resource | aws_autoscaling_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 408 | CKV2_AWS_15 | resource | aws_elb | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 409 | CKV2_AWS_15 | resource | aws_lb_target_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 410 | CKV2_AWS_16 | resource | aws_appautoscaling_target | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 411 | CKV2_AWS_16 | resource | aws_dynamodb_table | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 412 | CKV2_AWS_18 | resource | aws_backup_selection | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 413 | CKV2_AWS_19 | resource | aws_eip | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 414 | CKV2_AWS_19 | resource | aws_eip_association | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 415 | CKV2_AWS_20 | resource | aws_alb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 416 | CKV2_AWS_20 | resource | aws_alb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 417 | CKV2_AWS_20 | resource | aws_lb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 418 | CKV2_AWS_20 | resource | aws_lb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 419 | CKV2_AWS_21 | resource | aws_iam_group_membership | Ensure that all IAM users are members of at least one IAM group. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 420 | CKV2_AWS_22 | resource | aws_iam_user | Ensure an IAM User does not have access to the console | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 421 | CKV2_AWS_23 | resource | aws_route53_record | Route53 A Record has Attached Resource | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 422 | CKV2_AWS_27 | resource | aws_rds_cluster | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 423 | CKV2_AWS_27 | resource | aws_rds_cluster_parameter_group | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 424 | CKV2_AWS_28 | resource | aws_alb | Ensure public facing ALB are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 425 | CKV2_AWS_28 | resource | aws_lb | Ensure public facing ALB are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 426 | CKV2_AWS_29 | resource | aws_api_gateway_rest_api | Ensure public API gateway are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 427 | CKV2_AWS_29 | resource | aws_api_gateway_stage | Ensure public API gateway are protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 428 | CKV2_AWS_30 | resource | aws_db_instance | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 429 | CKV2_AWS_30 | resource | aws_db_parameter_group | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 430 | CKV2_AWS_31 | resource | aws_wafv2_web_acl | Ensure WAF2 has a Logging Configuration | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 431 | CKV2_AWS_32 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has a response headers policy attached | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 432 | CKV2_AWS_33 | resource | aws_appsync_graphql_api | Ensure AppSync is protected by WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 433 | CKV2_AWS_34 | resource | aws_ssm_parameter | AWS SSM Parameter should be Encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 434 | CKV2_AWS_35 | resource | aws_route | AWS NAT Gateways should be utilized for the default route | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 435 | CKV2_AWS_35 | resource | aws_route_table | AWS NAT Gateways should be utilized for the default route | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 436 | CKV2_AWS_36 | resource | aws_ssm_parameter | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 437 | CKV2_AWS_36 | resource | data.http | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 438 | CKV2_AWS_37 | resource | aws | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 439 | CKV2_AWS_37 | resource | aws_accessanalyzer_analyzer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 440 | CKV2_AWS_37 | resource | aws_acm_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 441 | CKV2_AWS_37 | resource | aws_acm_certificate_validation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 442 | CKV2_AWS_37 | resource | aws_acmpca_certificate_authority | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 443 | CKV2_AWS_37 | resource | aws_ami | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 444 | CKV2_AWS_37 | resource | aws_ami_copy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 445 | CKV2_AWS_37 | resource | aws_ami_from_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 446 | CKV2_AWS_37 | resource | aws_ami_launch_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 447 | CKV2_AWS_37 | resource | aws_api_gateway_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 448 | CKV2_AWS_37 | resource | aws_api_gateway_api_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 449 | CKV2_AWS_37 | resource | aws_api_gateway_authorizer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 450 | CKV2_AWS_37 | resource | aws_api_gateway_base_path_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 451 | CKV2_AWS_37 | resource | aws_api_gateway_client_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 452 | CKV2_AWS_37 | resource | aws_api_gateway_deployment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 453 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_part | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 454 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 455 | CKV2_AWS_37 | resource | aws_api_gateway_domain_name | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 456 | CKV2_AWS_37 | resource | aws_api_gateway_gateway_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 457 | CKV2_AWS_37 | resource | aws_api_gateway_integration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 458 | CKV2_AWS_37 | resource | aws_api_gateway_integration_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 459 | CKV2_AWS_37 | resource | aws_api_gateway_method | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 460 | CKV2_AWS_37 | resource | aws_api_gateway_method_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 461 | CKV2_AWS_37 | resource | aws_api_gateway_method_settings | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 462 | CKV2_AWS_37 | resource | aws_api_gateway_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 463 | CKV2_AWS_37 | resource | aws_api_gateway_request_validator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 464 | CKV2_AWS_37 | resource | aws_api_gateway_resource | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 465 | CKV2_AWS_37 | resource | aws_api_gateway_rest_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 466 | CKV2_AWS_37 | resource | aws_api_gateway_stage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 467 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 468 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 469 | CKV2_AWS_37 | resource | aws_api_gateway_vpc_link | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 470 | CKV2_AWS_37 | resource | aws_apigatewayv2_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 471 | CKV2_AWS_37 | resource | aws_apigatewayv2_api_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 472 | CKV2_AWS_37 | resource | aws_apigatewayv2_authorizer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 473 | CKV2_AWS_37 | resource | aws_apigatewayv2_deployment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 474 | CKV2_AWS_37 | resource | aws_apigatewayv2_domain_name | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 475 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 476 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 477 | CKV2_AWS_37 | resource | aws_apigatewayv2_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 478 | CKV2_AWS_37 | resource | aws_apigatewayv2_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 479 | CKV2_AWS_37 | resource | aws_apigatewayv2_route_response | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 480 | CKV2_AWS_37 | resource | aws_apigatewayv2_stage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 481 | CKV2_AWS_37 | resource | aws_apigatewayv2_vpc_link | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 482 | CKV2_AWS_37 | resource | aws_app_cookie_stickiness_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 483 | CKV2_AWS_37 | resource | aws_appautoscaling_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 484 | CKV2_AWS_37 | resource | aws_appautoscaling_scheduled_action | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 485 | CKV2_AWS_37 | resource | aws_appautoscaling_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 486 | CKV2_AWS_37 | resource | aws_appmesh_mesh | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 487 | CKV2_AWS_37 | resource | aws_appmesh_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 488 | CKV2_AWS_37 | resource | aws_appmesh_virtual_node | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 489 | CKV2_AWS_37 | resource | aws_appmesh_virtual_router | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 490 | CKV2_AWS_37 | resource | aws_appmesh_virtual_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 491 | CKV2_AWS_37 | resource | aws_appsync_api_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 492 | CKV2_AWS_37 | resource | aws_appsync_datasource | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 493 | CKV2_AWS_37 | resource | aws_appsync_function | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 494 | CKV2_AWS_37 | resource | aws_appsync_graphql_api | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 495 | CKV2_AWS_37 | resource | aws_appsync_resolver | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 496 | CKV2_AWS_37 | resource | aws_athena_database | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 497 | CKV2_AWS_37 | resource | aws_athena_named_query | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 498 | CKV2_AWS_37 | resource | aws_athena_workgroup | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 499 | CKV2_AWS_37 | resource | aws_autoscaling_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 500 | CKV2_AWS_37 | resource | aws_autoscaling_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 501 | CKV2_AWS_37 | resource | aws_autoscaling_lifecycle_hook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 502 | CKV2_AWS_37 | resource | aws_autoscaling_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 503 | CKV2_AWS_37 | resource | aws_autoscaling_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 504 | CKV2_AWS_37 | resource | aws_autoscaling_schedule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 505 | CKV2_AWS_37 | resource | aws_backup_plan | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 506 | CKV2_AWS_37 | resource | aws_backup_selection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 507 | CKV2_AWS_37 | resource | aws_backup_vault | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 508 | CKV2_AWS_37 | resource | aws_batch_compute_environment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 509 | CKV2_AWS_37 | resource | aws_batch_job_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 510 | CKV2_AWS_37 | resource | aws_batch_job_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 511 | CKV2_AWS_37 | resource | aws_budgets_budget | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 512 | CKV2_AWS_37 | resource | aws_cloud9_environment_ec2 | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 513 | CKV2_AWS_37 | resource | aws_cloudformation_stack | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 514 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 515 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 516 | CKV2_AWS_37 | resource | aws_cloudfront_distribution | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 517 | CKV2_AWS_37 | resource | aws_cloudfront_origin_access_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 518 | CKV2_AWS_37 | resource | aws_cloudfront_public_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 519 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 520 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_hsm | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 521 | CKV2_AWS_37 | resource | aws_cloudtrail | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 522 | CKV2_AWS_37 | resource | aws_cloudwatch_dashboard | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 523 | CKV2_AWS_37 | resource | aws_cloudwatch_event_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 524 | CKV2_AWS_37 | resource | aws_cloudwatch_event_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 525 | CKV2_AWS_37 | resource | aws_cloudwatch_event_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 526 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 527 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 528 | CKV2_AWS_37 | resource | aws_cloudwatch_log_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 529 | CKV2_AWS_37 | resource | aws_cloudwatch_log_metric_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 530 | CKV2_AWS_37 | resource | aws_cloudwatch_log_resource_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 531 | CKV2_AWS_37 | resource | aws_cloudwatch_log_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 532 | CKV2_AWS_37 | resource | aws_cloudwatch_log_subscription_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 533 | CKV2_AWS_37 | resource | aws_cloudwatch_metric_alarm | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 534 | CKV2_AWS_37 | resource | aws_codebuild_project | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 535 | CKV2_AWS_37 | resource | aws_codebuild_source_credential | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 536 | CKV2_AWS_37 | resource | aws_codebuild_webhook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 537 | CKV2_AWS_37 | resource | aws_codecommit_repository | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 538 | CKV2_AWS_37 | resource | aws_codecommit_trigger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 539 | CKV2_AWS_37 | resource | aws_codedeploy_app | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 540 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 541 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 542 | CKV2_AWS_37 | resource | aws_codepipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 543 | CKV2_AWS_37 | resource | aws_codepipeline_webhook | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 544 | CKV2_AWS_37 | resource | aws_codestarnotifications_notification_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 545 | CKV2_AWS_37 | resource | aws_cognito_identity_pool | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 546 | CKV2_AWS_37 | resource | aws_cognito_identity_pool_roles_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 547 | CKV2_AWS_37 | resource | aws_cognito_identity_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 548 | CKV2_AWS_37 | resource | aws_cognito_resource_server | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 549 | CKV2_AWS_37 | resource | aws_cognito_user_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 550 | CKV2_AWS_37 | resource | aws_cognito_user_pool | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 551 | CKV2_AWS_37 | resource | aws_cognito_user_pool_client | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 552 | CKV2_AWS_37 | resource | aws_cognito_user_pool_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 553 | CKV2_AWS_37 | resource | aws_config_aggregate_authorization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 554 | CKV2_AWS_37 | resource | aws_config_config_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 555 | CKV2_AWS_37 | resource | aws_config_configuration_aggregator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 556 | CKV2_AWS_37 | resource | aws_config_configuration_recorder | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 557 | CKV2_AWS_37 | resource | aws_config_configuration_recorder_status | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 558 | CKV2_AWS_37 | resource | aws_config_delivery_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 559 | CKV2_AWS_37 | resource | aws_config_organization_custom_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 560 | CKV2_AWS_37 | resource | aws_config_organization_managed_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 561 | CKV2_AWS_37 | resource | aws_cur_report_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 562 | CKV2_AWS_37 | resource | aws_customer_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 563 | CKV2_AWS_37 | resource | aws_datapipeline_pipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 564 | CKV2_AWS_37 | resource | aws_datasync_agent | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 565 | CKV2_AWS_37 | resource | aws_datasync_location_efs | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 566 | CKV2_AWS_37 | resource | aws_datasync_location_nfs | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 567 | CKV2_AWS_37 | resource | aws_datasync_location_s3 | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 568 | CKV2_AWS_37 | resource | aws_datasync_location_smb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 569 | CKV2_AWS_37 | resource | aws_datasync_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 570 | CKV2_AWS_37 | resource | aws_dax_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 571 | CKV2_AWS_37 | resource | aws_dax_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 572 | CKV2_AWS_37 | resource | aws_dax_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 573 | CKV2_AWS_37 | resource | aws_db_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 574 | CKV2_AWS_37 | resource | aws_db_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 575 | CKV2_AWS_37 | resource | aws_db_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 576 | CKV2_AWS_37 | resource | aws_db_instance_role_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 577 | CKV2_AWS_37 | resource | aws_db_option_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 578 | CKV2_AWS_37 | resource | aws_db_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 579 | CKV2_AWS_37 | resource | aws_db_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 580 | CKV2_AWS_37 | resource | aws_db_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 581 | CKV2_AWS_37 | resource | aws_db_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 582 | CKV2_AWS_37 | resource | aws_default_network_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 583 | CKV2_AWS_37 | resource | aws_default_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 584 | CKV2_AWS_37 | resource | aws_default_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 585 | CKV2_AWS_37 | resource | aws_default_subnet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 586 | CKV2_AWS_37 | resource | aws_default_vpc | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 587 | CKV2_AWS_37 | resource | aws_default_vpc_dhcp_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 588 | CKV2_AWS_37 | resource | aws_devicefarm_project | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 589 | CKV2_AWS_37 | resource | aws_directory_service_conditional_forwarder | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 590 | CKV2_AWS_37 | resource | aws_directory_service_directory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 591 | CKV2_AWS_37 | resource | aws_directory_service_log_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 592 | CKV2_AWS_37 | resource | aws_dlm_lifecycle_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 593 | CKV2_AWS_37 | resource | aws_dms_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 594 | CKV2_AWS_37 | resource | aws_dms_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 595 | CKV2_AWS_37 | resource | aws_dms_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 596 | CKV2_AWS_37 | resource | aws_dms_replication_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 597 | CKV2_AWS_37 | resource | aws_dms_replication_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 598 | CKV2_AWS_37 | resource | aws_dms_replication_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 599 | CKV2_AWS_37 | resource | aws_docdb_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 600 | CKV2_AWS_37 | resource | aws_docdb_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 601 | CKV2_AWS_37 | resource | aws_docdb_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 602 | CKV2_AWS_37 | resource | aws_docdb_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 603 | CKV2_AWS_37 | resource | aws_docdb_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 604 | CKV2_AWS_37 | resource | aws_dx_bgp_peer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 605 | CKV2_AWS_37 | resource | aws_dx_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 606 | CKV2_AWS_37 | resource | aws_dx_connection_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 607 | CKV2_AWS_37 | resource | aws_dx_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 608 | CKV2_AWS_37 | resource | aws_dx_gateway_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 609 | CKV2_AWS_37 | resource | aws_dx_gateway_association_proposal | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 610 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 611 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 612 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 613 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 614 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 615 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 616 | CKV2_AWS_37 | resource | aws_dx_lag | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 617 | CKV2_AWS_37 | resource | aws_dx_private_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 618 | CKV2_AWS_37 | resource | aws_dx_public_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 619 | CKV2_AWS_37 | resource | aws_dx_transit_virtual_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 620 | CKV2_AWS_37 | resource | aws_dynamodb_global_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 621 | CKV2_AWS_37 | resource | aws_dynamodb_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 622 | CKV2_AWS_37 | resource | aws_dynamodb_table_item | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 623 | CKV2_AWS_37 | resource | aws_ebs_default_kms_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 624 | CKV2_AWS_37 | resource | aws_ebs_encryption_by_default | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 625 | CKV2_AWS_37 | resource | aws_ebs_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 626 | CKV2_AWS_37 | resource | aws_ebs_snapshot_copy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 627 | CKV2_AWS_37 | resource | aws_ebs_volume | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 628 | CKV2_AWS_37 | resource | aws_ec2_availability_zone_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 629 | CKV2_AWS_37 | resource | aws_ec2_capacity_reservation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 630 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_authorization_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 631 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 632 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_network_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 633 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 634 | CKV2_AWS_37 | resource | aws_ec2_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 635 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 636 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 637 | CKV2_AWS_37 | resource | aws_ec2_tag | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 638 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 639 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 640 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_session | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 641 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 642 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 643 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 644 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 645 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 646 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 647 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 648 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 649 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 650 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 651 | CKV2_AWS_37 | resource | aws_ecr_lifecycle_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 652 | CKV2_AWS_37 | resource | aws_ecr_repository | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 653 | CKV2_AWS_37 | resource | aws_ecr_repository_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 654 | CKV2_AWS_37 | resource | aws_ecs_capacity_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 655 | CKV2_AWS_37 | resource | aws_ecs_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 656 | CKV2_AWS_37 | resource | aws_ecs_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 657 | CKV2_AWS_37 | resource | aws_ecs_task_definition | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 658 | CKV2_AWS_37 | resource | aws_efs_access_point | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 659 | CKV2_AWS_37 | resource | aws_efs_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 660 | CKV2_AWS_37 | resource | aws_efs_file_system_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 661 | CKV2_AWS_37 | resource | aws_efs_mount_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 662 | CKV2_AWS_37 | resource | aws_egress_only_internet_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 663 | CKV2_AWS_37 | resource | aws_eip | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 664 | CKV2_AWS_37 | resource | aws_eip_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 665 | CKV2_AWS_37 | resource | aws_eks_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 666 | CKV2_AWS_37 | resource | aws_eks_fargate_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 667 | CKV2_AWS_37 | resource | aws_eks_node_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 668 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 669 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 670 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_configuration_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 671 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_environment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 672 | CKV2_AWS_37 | resource | aws_elasticache_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 673 | CKV2_AWS_37 | resource | aws_elasticache_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 674 | CKV2_AWS_37 | resource | aws_elasticache_replication_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 675 | CKV2_AWS_37 | resource | aws_elasticache_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 676 | CKV2_AWS_37 | resource | aws_elasticache_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 677 | CKV2_AWS_37 | resource | aws_elasticsearch_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 678 | CKV2_AWS_37 | resource | aws_elasticsearch_domain_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 679 | CKV2_AWS_37 | resource | aws_elastictranscoder_pipeline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 680 | CKV2_AWS_37 | resource | aws_elastictranscoder_preset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 681 | CKV2_AWS_37 | resource | aws_elb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 682 | CKV2_AWS_37 | resource | aws_elb_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 683 | CKV2_AWS_37 | resource | aws_emr_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 684 | CKV2_AWS_37 | resource | aws_emr_instance_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 685 | CKV2_AWS_37 | resource | aws_emr_security_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 686 | CKV2_AWS_37 | resource | aws_flow_log | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 687 | CKV2_AWS_37 | resource | aws_fms_admin_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 688 | CKV2_AWS_37 | resource | aws_fsx_lustre_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 689 | CKV2_AWS_37 | resource | aws_fsx_windows_file_system | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 690 | CKV2_AWS_37 | resource | aws_gamelift_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 691 | CKV2_AWS_37 | resource | aws_gamelift_build | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 692 | CKV2_AWS_37 | resource | aws_gamelift_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 693 | CKV2_AWS_37 | resource | aws_gamelift_game_session_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 694 | CKV2_AWS_37 | resource | aws_glacier_vault | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 695 | CKV2_AWS_37 | resource | aws_glacier_vault_lock | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 696 | CKV2_AWS_37 | resource | aws_globalaccelerator_accelerator | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 697 | CKV2_AWS_37 | resource | aws_globalaccelerator_endpoint_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 698 | CKV2_AWS_37 | resource | aws_globalaccelerator_listener | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 699 | CKV2_AWS_37 | resource | aws_glue_catalog_database | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 700 | CKV2_AWS_37 | resource | aws_glue_catalog_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 701 | CKV2_AWS_37 | resource | aws_glue_classifier | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 702 | CKV2_AWS_37 | resource | aws_glue_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 703 | CKV2_AWS_37 | resource | aws_glue_crawler | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 704 | CKV2_AWS_37 | resource | aws_glue_job | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 705 | CKV2_AWS_37 | resource | aws_glue_security_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 706 | CKV2_AWS_37 | resource | aws_glue_trigger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 707 | CKV2_AWS_37 | resource | aws_glue_workflow | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 708 | CKV2_AWS_37 | resource | aws_guardduty_detector | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 709 | CKV2_AWS_37 | resource | aws_guardduty_invite_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 710 | CKV2_AWS_37 | resource | aws_guardduty_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 711 | CKV2_AWS_37 | resource | aws_guardduty_member | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 712 | CKV2_AWS_37 | resource | aws_guardduty_organization_admin_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 713 | CKV2_AWS_37 | resource | aws_guardduty_organization_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 714 | CKV2_AWS_37 | resource | aws_guardduty_threatintelset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 715 | CKV2_AWS_37 | resource | aws_iam_access_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 716 | CKV2_AWS_37 | resource | aws_iam_account_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 717 | CKV2_AWS_37 | resource | aws_iam_account_password_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 718 | CKV2_AWS_37 | resource | aws_iam_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 719 | CKV2_AWS_37 | resource | aws_iam_group_membership | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 720 | CKV2_AWS_37 | resource | aws_iam_group_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 721 | CKV2_AWS_37 | resource | aws_iam_group_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 722 | CKV2_AWS_37 | resource | aws_iam_instance_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 723 | CKV2_AWS_37 | resource | aws_iam_openid_connect_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 724 | CKV2_AWS_37 | resource | aws_iam_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 725 | CKV2_AWS_37 | resource | aws_iam_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 726 | CKV2_AWS_37 | resource | aws_iam_policy_document | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 727 | CKV2_AWS_37 | resource | aws_iam_role | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 728 | CKV2_AWS_37 | resource | aws_iam_role_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 729 | CKV2_AWS_37 | resource | aws_iam_role_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 730 | CKV2_AWS_37 | resource | aws_iam_saml_provider | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 731 | CKV2_AWS_37 | resource | aws_iam_server_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 732 | CKV2_AWS_37 | resource | aws_iam_service_linked_role | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 733 | CKV2_AWS_37 | resource | aws_iam_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 734 | CKV2_AWS_37 | resource | aws_iam_user_group_membership | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 735 | CKV2_AWS_37 | resource | aws_iam_user_login_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 736 | CKV2_AWS_37 | resource | aws_iam_user_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 737 | CKV2_AWS_37 | resource | aws_iam_user_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 738 | CKV2_AWS_37 | resource | aws_iam_user_ssh_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 739 | CKV2_AWS_37 | resource | aws_inspector_assessment_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 740 | CKV2_AWS_37 | resource | aws_inspector_assessment_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 741 | CKV2_AWS_37 | resource | aws_inspector_resource_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 742 | CKV2_AWS_37 | resource | aws_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 743 | CKV2_AWS_37 | resource | aws_internet_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 744 | CKV2_AWS_37 | resource | aws_iot_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 745 | CKV2_AWS_37 | resource | aws_iot_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 746 | CKV2_AWS_37 | resource | aws_iot_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 747 | CKV2_AWS_37 | resource | aws_iot_role_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 748 | CKV2_AWS_37 | resource | aws_iot_thing | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 749 | CKV2_AWS_37 | resource | aws_iot_thing_principal_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 750 | CKV2_AWS_37 | resource | aws_iot_thing_type | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 751 | CKV2_AWS_37 | resource | aws_iot_topic_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 752 | CKV2_AWS_37 | resource | aws_key_pair | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 753 | CKV2_AWS_37 | resource | aws_kinesis_analytics_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 754 | CKV2_AWS_37 | resource | aws_kinesis_firehose_delivery_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 755 | CKV2_AWS_37 | resource | aws_kinesis_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 756 | CKV2_AWS_37 | resource | aws_kinesis_video_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 757 | CKV2_AWS_37 | resource | aws_kms_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 758 | CKV2_AWS_37 | resource | aws_kms_ciphertext | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 759 | CKV2_AWS_37 | resource | aws_kms_external_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 760 | CKV2_AWS_37 | resource | aws_kms_grant | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 761 | CKV2_AWS_37 | resource | aws_kms_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 762 | CKV2_AWS_37 | resource | aws_lambda_alias | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 763 | CKV2_AWS_37 | resource | aws_lambda_event_source_mapping | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 764 | CKV2_AWS_37 | resource | aws_lambda_function | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 765 | CKV2_AWS_37 | resource | aws_lambda_function_event_invoke_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 766 | CKV2_AWS_37 | resource | aws_lambda_layer_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 767 | CKV2_AWS_37 | resource | aws_lambda_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 768 | CKV2_AWS_37 | resource | aws_lambda_provisioned_concurrency_config | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 769 | CKV2_AWS_37 | resource | aws_launch_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 770 | CKV2_AWS_37 | resource | aws_launch_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 771 | CKV2_AWS_37 | resource | aws_lb | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 772 | CKV2_AWS_37 | resource | aws_lb_cookie_stickiness_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 773 | CKV2_AWS_37 | resource | aws_lb_listener | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 774 | CKV2_AWS_37 | resource | aws_lb_listener_certificate | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 775 | CKV2_AWS_37 | resource | aws_lb_listener_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 776 | CKV2_AWS_37 | resource | aws_lb_ssl_negotiation_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 777 | CKV2_AWS_37 | resource | aws_lb_target_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 778 | CKV2_AWS_37 | resource | aws_lb_target_group_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 779 | CKV2_AWS_37 | resource | aws_licensemanager_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 780 | CKV2_AWS_37 | resource | aws_licensemanager_license_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 781 | CKV2_AWS_37 | resource | aws_lightsail_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 782 | CKV2_AWS_37 | resource | aws_lightsail_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 783 | CKV2_AWS_37 | resource | aws_lightsail_key_pair | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 784 | CKV2_AWS_37 | resource | aws_lightsail_static_ip | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 785 | CKV2_AWS_37 | resource | aws_lightsail_static_ip_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 786 | CKV2_AWS_37 | resource | aws_load_balancer_backend_server_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 787 | CKV2_AWS_37 | resource | aws_load_balancer_listener_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 788 | CKV2_AWS_37 | resource | aws_load_balancer_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 789 | CKV2_AWS_37 | resource | aws_macie_member_account_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 790 | CKV2_AWS_37 | resource | aws_macie_s3_bucket_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 791 | CKV2_AWS_37 | resource | aws_main_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 792 | CKV2_AWS_37 | resource | aws_media_convert_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 793 | CKV2_AWS_37 | resource | aws_media_package_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 794 | CKV2_AWS_37 | resource | aws_media_store_container | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 795 | CKV2_AWS_37 | resource | aws_media_store_container_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 796 | CKV2_AWS_37 | resource | aws_mq_broker | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 797 | CKV2_AWS_37 | resource | aws_mq_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 798 | CKV2_AWS_37 | resource | aws_msk_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 799 | CKV2_AWS_37 | resource | aws_msk_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 800 | CKV2_AWS_37 | resource | aws_nat_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 801 | CKV2_AWS_37 | resource | aws_neptune_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 802 | CKV2_AWS_37 | resource | aws_neptune_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 803 | CKV2_AWS_37 | resource | aws_neptune_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 804 | CKV2_AWS_37 | resource | aws_neptune_cluster_snapshot | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 805 | CKV2_AWS_37 | resource | aws_neptune_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 806 | CKV2_AWS_37 | resource | aws_neptune_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 807 | CKV2_AWS_37 | resource | aws_neptune_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 808 | CKV2_AWS_37 | resource | aws_network_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 809 | CKV2_AWS_37 | resource | aws_network_acl_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 810 | CKV2_AWS_37 | resource | aws_network_interface | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 811 | CKV2_AWS_37 | resource | aws_network_interface_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 812 | CKV2_AWS_37 | resource | aws_network_interface_sg_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 813 | CKV2_AWS_37 | resource | aws_opsworks_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 814 | CKV2_AWS_37 | resource | aws_opsworks_custom_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 815 | CKV2_AWS_37 | resource | aws_opsworks_ganglia_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 816 | CKV2_AWS_37 | resource | aws_opsworks_haproxy_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 817 | CKV2_AWS_37 | resource | aws_opsworks_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 818 | CKV2_AWS_37 | resource | aws_opsworks_java_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 819 | CKV2_AWS_37 | resource | aws_opsworks_memcached_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 820 | CKV2_AWS_37 | resource | aws_opsworks_mysql_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 821 | CKV2_AWS_37 | resource | aws_opsworks_nodejs_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 822 | CKV2_AWS_37 | resource | aws_opsworks_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 823 | CKV2_AWS_37 | resource | aws_opsworks_php_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 824 | CKV2_AWS_37 | resource | aws_opsworks_rails_app_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 825 | CKV2_AWS_37 | resource | aws_opsworks_rds_db_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 826 | CKV2_AWS_37 | resource | aws_opsworks_stack | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 827 | CKV2_AWS_37 | resource | aws_opsworks_static_web_layer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 828 | CKV2_AWS_37 | resource | aws_opsworks_user_profile | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 829 | CKV2_AWS_37 | resource | aws_organizations_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 830 | CKV2_AWS_37 | resource | aws_organizations_organization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 831 | CKV2_AWS_37 | resource | aws_organizations_organizational_unit | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 832 | CKV2_AWS_37 | resource | aws_organizations_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 833 | CKV2_AWS_37 | resource | aws_organizations_policy_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 834 | CKV2_AWS_37 | resource | aws_pinpoint_adm_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 835 | CKV2_AWS_37 | resource | aws_pinpoint_apns_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 836 | CKV2_AWS_37 | resource | aws_pinpoint_apns_sandbox_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 837 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 838 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 839 | CKV2_AWS_37 | resource | aws_pinpoint_app | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 840 | CKV2_AWS_37 | resource | aws_pinpoint_baidu_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 841 | CKV2_AWS_37 | resource | aws_pinpoint_email_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 842 | CKV2_AWS_37 | resource | aws_pinpoint_event_stream | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 843 | CKV2_AWS_37 | resource | aws_pinpoint_gcm_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 844 | CKV2_AWS_37 | resource | aws_pinpoint_sms_channel | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 845 | CKV2_AWS_37 | resource | aws_placement_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 846 | CKV2_AWS_37 | resource | aws_proxy_protocol_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 847 | CKV2_AWS_37 | resource | aws_qldb_ledger | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 848 | CKV2_AWS_37 | resource | aws_quicksight_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 849 | CKV2_AWS_37 | resource | aws_quicksight_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 850 | CKV2_AWS_37 | resource | aws_ram_principal_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 851 | CKV2_AWS_37 | resource | aws_ram_resource_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 852 | CKV2_AWS_37 | resource | aws_ram_resource_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 853 | CKV2_AWS_37 | resource | aws_ram_resource_share_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 854 | CKV2_AWS_37 | resource | aws_rds_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 855 | CKV2_AWS_37 | resource | aws_rds_cluster_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 856 | CKV2_AWS_37 | resource | aws_rds_cluster_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 857 | CKV2_AWS_37 | resource | aws_rds_cluster_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 858 | CKV2_AWS_37 | resource | aws_rds_global_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 859 | CKV2_AWS_37 | resource | aws_redshift_cluster | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 860 | CKV2_AWS_37 | resource | aws_redshift_event_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 861 | CKV2_AWS_37 | resource | aws_redshift_parameter_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 862 | CKV2_AWS_37 | resource | aws_redshift_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 863 | CKV2_AWS_37 | resource | aws_redshift_snapshot_copy_grant | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 864 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 865 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 866 | CKV2_AWS_37 | resource | aws_redshift_subnet_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 867 | CKV2_AWS_37 | resource | aws_resourcegroups_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 868 | CKV2_AWS_37 | resource | aws_root | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 869 | CKV2_AWS_37 | resource | aws_root_access_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 870 | CKV2_AWS_37 | resource | aws_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 871 | CKV2_AWS_37 | resource | aws_route53_delegation_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 872 | CKV2_AWS_37 | resource | aws_route53_health_check | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 873 | CKV2_AWS_37 | resource | aws_route53_query_log | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 874 | CKV2_AWS_37 | resource | aws_route53_record | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 875 | CKV2_AWS_37 | resource | aws_route53_resolver_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 876 | CKV2_AWS_37 | resource | aws_route53_resolver_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 877 | CKV2_AWS_37 | resource | aws_route53_resolver_rule_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 878 | CKV2_AWS_37 | resource | aws_route53_vpc_association_authorization | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 879 | CKV2_AWS_37 | resource | aws_route53_zone | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 880 | CKV2_AWS_37 | resource | aws_route53_zone_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 881 | CKV2_AWS_37 | resource | aws_route_table | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 882 | CKV2_AWS_37 | resource | aws_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 883 | CKV2_AWS_37 | resource | aws_s3_access_point | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 884 | CKV2_AWS_37 | resource | aws_s3_account_public_access_block | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 885 | CKV2_AWS_37 | resource | aws_s3_bucket | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 886 | CKV2_AWS_37 | resource | aws_s3_bucket_analytics_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 887 | CKV2_AWS_37 | resource | aws_s3_bucket_inventory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 888 | CKV2_AWS_37 | resource | aws_s3_bucket_metric | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 889 | CKV2_AWS_37 | resource | aws_s3_bucket_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 890 | CKV2_AWS_37 | resource | aws_s3_bucket_object | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 891 | CKV2_AWS_37 | resource | aws_s3_bucket_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 892 | CKV2_AWS_37 | resource | aws_s3_bucket_public_access_block | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 893 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 894 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 895 | CKV2_AWS_37 | resource | aws_sagemaker_model | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 896 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 897 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 898 | CKV2_AWS_37 | resource | aws_secretsmanager_secret | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 899 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_rotation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 900 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_version | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 901 | CKV2_AWS_37 | resource | aws_security_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 902 | CKV2_AWS_37 | resource | aws_security_group_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 903 | CKV2_AWS_37 | resource | aws_securityhub_account | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 904 | CKV2_AWS_37 | resource | aws_securityhub_member | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 905 | CKV2_AWS_37 | resource | aws_securityhub_product_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 906 | CKV2_AWS_37 | resource | aws_securityhub_standards_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 907 | CKV2_AWS_37 | resource | aws_service_discovery_http_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 908 | CKV2_AWS_37 | resource | aws_service_discovery_private_dns_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 909 | CKV2_AWS_37 | resource | aws_service_discovery_public_dns_namespace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 910 | CKV2_AWS_37 | resource | aws_service_discovery_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 911 | CKV2_AWS_37 | resource | aws_servicecatalog_portfolio | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 912 | CKV2_AWS_37 | resource | aws_servicequotas_service_quota | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 913 | CKV2_AWS_37 | resource | aws_ses_active_receipt_rule_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 914 | CKV2_AWS_37 | resource | aws_ses_configuration_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 915 | CKV2_AWS_37 | resource | aws_ses_domain_dkim | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 916 | CKV2_AWS_37 | resource | aws_ses_domain_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 917 | CKV2_AWS_37 | resource | aws_ses_domain_identity_verification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 918 | CKV2_AWS_37 | resource | aws_ses_domain_mail_from | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 919 | CKV2_AWS_37 | resource | aws_ses_email_identity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 920 | CKV2_AWS_37 | resource | aws_ses_event_destination | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 921 | CKV2_AWS_37 | resource | aws_ses_identity_notification_topic | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 922 | CKV2_AWS_37 | resource | aws_ses_identity_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 923 | CKV2_AWS_37 | resource | aws_ses_receipt_filter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 924 | CKV2_AWS_37 | resource | aws_ses_receipt_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 925 | CKV2_AWS_37 | resource | aws_ses_receipt_rule_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 926 | CKV2_AWS_37 | resource | aws_ses_template | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 927 | CKV2_AWS_37 | resource | aws_sfn_activity | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 928 | CKV2_AWS_37 | resource | aws_sfn_state_machine | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 929 | CKV2_AWS_37 | resource | aws_shield_protection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 930 | CKV2_AWS_37 | resource | aws_simpledb_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 931 | CKV2_AWS_37 | resource | aws_snapshot_create_volume_permission | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 932 | CKV2_AWS_37 | resource | aws_sns_platform_application | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 933 | CKV2_AWS_37 | resource | aws_sns_sms_preferences | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 934 | CKV2_AWS_37 | resource | aws_sns_topic | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 935 | CKV2_AWS_37 | resource | aws_sns_topic_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 936 | CKV2_AWS_37 | resource | aws_sns_topic_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 937 | CKV2_AWS_37 | resource | aws_spot_datafeed_subscription | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 938 | CKV2_AWS_37 | resource | aws_spot_fleet_request | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 939 | CKV2_AWS_37 | resource | aws_spot_instance_request | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 940 | CKV2_AWS_37 | resource | aws_sqs_queue | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 941 | CKV2_AWS_37 | resource | aws_sqs_queue_policy | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 942 | CKV2_AWS_37 | resource | aws_ssm_activation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 943 | CKV2_AWS_37 | resource | aws_ssm_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 944 | CKV2_AWS_37 | resource | aws_ssm_document | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 945 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 946 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_target | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 947 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_task | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 948 | CKV2_AWS_37 | resource | aws_ssm_parameter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 949 | CKV2_AWS_37 | resource | aws_ssm_patch_baseline | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 950 | CKV2_AWS_37 | resource | aws_ssm_patch_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 951 | CKV2_AWS_37 | resource | aws_ssm_resource_data_sync | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 952 | CKV2_AWS_37 | resource | aws_storagegateway_cache | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 953 | CKV2_AWS_37 | resource | aws_storagegateway_cached_iscsi_volume | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 954 | CKV2_AWS_37 | resource | aws_storagegateway_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 955 | CKV2_AWS_37 | resource | aws_storagegateway_nfs_file_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 956 | CKV2_AWS_37 | resource | aws_storagegateway_smb_file_share | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 957 | CKV2_AWS_37 | resource | aws_storagegateway_upload_buffer | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 958 | CKV2_AWS_37 | resource | aws_storagegateway_working_storage | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 959 | CKV2_AWS_37 | resource | aws_subnet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 960 | CKV2_AWS_37 | resource | aws_swf_domain | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 961 | CKV2_AWS_37 | resource | aws_transfer_server | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 962 | CKV2_AWS_37 | resource | aws_transfer_ssh_key | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 963 | CKV2_AWS_37 | resource | aws_transfer_user | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 964 | CKV2_AWS_37 | resource | aws_volume_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 965 | CKV2_AWS_37 | resource | aws_vpc | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 966 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 967 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 968 | CKV2_AWS_37 | resource | aws_vpc_endpoint | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 969 | CKV2_AWS_37 | resource | aws_vpc_endpoint_connection_notification | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 970 | CKV2_AWS_37 | resource | aws_vpc_endpoint_route_table_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 971 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 972 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 973 | CKV2_AWS_37 | resource | aws_vpc_endpoint_subnet_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 974 | CKV2_AWS_37 | resource | aws_vpc_ipv4_cidr_block_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 975 | CKV2_AWS_37 | resource | aws_vpc_peering_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 976 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_accepter | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 977 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_options | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 978 | CKV2_AWS_37 | resource | aws_vpn_connection | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 979 | CKV2_AWS_37 | resource | aws_vpn_connection_route | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 980 | CKV2_AWS_37 | resource | aws_vpn_gateway | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 981 | CKV2_AWS_37 | resource | aws_vpn_gateway_attachment | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 982 | CKV2_AWS_37 | resource | aws_vpn_gateway_route_propagation | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 983 | CKV2_AWS_37 | resource | aws_waf_byte_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 984 | CKV2_AWS_37 | resource | aws_waf_geo_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 985 | CKV2_AWS_37 | resource | aws_waf_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 986 | CKV2_AWS_37 | resource | aws_waf_rate_based_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 987 | CKV2_AWS_37 | resource | aws_waf_regex_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 988 | CKV2_AWS_37 | resource | aws_waf_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 989 | CKV2_AWS_37 | resource | aws_waf_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 990 | CKV2_AWS_37 | resource | aws_waf_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 991 | CKV2_AWS_37 | resource | aws_waf_size_constraint_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 992 | CKV2_AWS_37 | resource | aws_waf_sql_injection_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 993 | CKV2_AWS_37 | resource | aws_waf_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 994 | CKV2_AWS_37 | resource | aws_waf_xss_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 995 | CKV2_AWS_37 | resource | aws_wafregional_byte_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 996 | CKV2_AWS_37 | resource | aws_wafregional_geo_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 997 | CKV2_AWS_37 | resource | aws_wafregional_ipset | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 998 | CKV2_AWS_37 | resource | aws_wafregional_rate_based_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 999 | CKV2_AWS_37 | resource | aws_wafregional_regex_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1000 | CKV2_AWS_37 | resource | aws_wafregional_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1001 | CKV2_AWS_37 | resource | aws_wafregional_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1002 | CKV2_AWS_37 | resource | aws_wafregional_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1003 | CKV2_AWS_37 | resource | aws_wafregional_size_constraint_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1004 | CKV2_AWS_37 | resource | aws_wafregional_sql_injection_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1005 | CKV2_AWS_37 | resource | aws_wafregional_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1006 | CKV2_AWS_37 | resource | aws_wafregional_web_acl_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1007 | CKV2_AWS_37 | resource | aws_wafregional_xss_match_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1008 | CKV2_AWS_37 | resource | aws_wafv2_ip_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1009 | CKV2_AWS_37 | resource | aws_wafv2_regex_pattern_set | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1010 | CKV2_AWS_37 | resource | aws_wafv2_rule_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1011 | CKV2_AWS_37 | resource | aws_wafv2_web_acl | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1012 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1013 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_logging_configuration | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1014 | CKV2_AWS_37 | resource | aws_worklink_fleet | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1015 | CKV2_AWS_37 | resource | aws_worklink_website_certificate_authority_association | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1016 | CKV2_AWS_37 | resource | aws_workspaces_directory | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1017 | CKV2_AWS_37 | resource | aws_workspaces_ip_group | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1018 | CKV2_AWS_37 | resource | aws_workspaces_workspace | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1019 | CKV2_AWS_37 | resource | aws_xray_sampling_rule | Ensure Codecommit associates an approval rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1020 | CKV2_AWS_38 | resource | aws_route53_zone | Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1021 | CKV2_AWS_39 | resource | aws_route53_zone | Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1022 | CKV2_AWS_40 | resource | aws_iam_group_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1023 | CKV2_AWS_40 | resource | aws_iam_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1024 | CKV2_AWS_40 | resource | aws_iam_role_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1025 | CKV2_AWS_40 | resource | aws_iam_user_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1026 | CKV2_AWS_40 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1027 | CKV2_AWS_40 | resource | data.aws_iam_policy_document | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1028 | CKV2_AWS_41 | resource | aws_instance | Ensure an IAM role is attached to EC2 instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1029 | CKV2_AWS_42 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront distribution uses custom SSL certificate | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1030 | CKV2_AWS_43 | resource | aws_s3_bucket_acl | Ensure S3 Bucket does not allow access to all Authenticated users | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1031 | CKV2_AWS_44 | resource | aws_route | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1032 | CKV2_AWS_44 | resource | aws_route_table | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1033 | CKV_AZURE_1 | resource | azurerm_linux_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureInstancePassword.py | +| 1034 | CKV_AZURE_1 | resource | azurerm_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureInstancePassword.py | +| 1035 | CKV_AZURE_2 | resource | azurerm_managed_disk | Ensure Azure managed disk has encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureManagedDiskEncryption.py | +| 1036 | CKV_AZURE_3 | resource | azurerm_storage_account | Ensure that 'Secure transfer required' is set to 'Enabled' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py | +| 1037 | CKV_AZURE_4 | resource | azurerm_kubernetes_cluster | Ensure AKS logging to Azure Monitoring is Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py | +| 1038 | CKV_AZURE_5 | resource | azurerm_kubernetes_cluster | Ensure RBAC is enabled on AKS clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSRbacEnabled.py | +| 1039 | CKV_AZURE_6 | resource | azurerm_kubernetes_cluster | Ensure AKS has an API Server Authorized IP Ranges enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py | +| 1040 | CKV_AZURE_7 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster has Network Policy configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py | +| 1041 | CKV_AZURE_8 | resource | azurerm_kubernetes_cluster | Ensure Kubernetes Dashboard is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSDashboardDisabled.py | +| 1042 | CKV_AZURE_9 | resource | azurerm_network_security_group | Ensure that RDP access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py | +| 1043 | CKV_AZURE_9 | resource | azurerm_network_security_rule | Ensure that RDP access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py | +| 1044 | CKV_AZURE_10 | resource | azurerm_network_security_group | Ensure that SSH access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py | +| 1045 | CKV_AZURE_10 | resource | azurerm_network_security_rule | Ensure that SSH access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py | +| 1046 | CKV_AZURE_11 | resource | azurerm_mariadb_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py | +| 1047 | CKV_AZURE_11 | resource | azurerm_mysql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py | +| 1048 | CKV_AZURE_11 | resource | azurerm_postgresql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py | +| 1049 | CKV_AZURE_11 | resource | azurerm_sql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py | +| 1050 | CKV_AZURE_12 | resource | azurerm_network_watcher_flow_log | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py | +| 1051 | CKV_AZURE_13 | resource | azurerm_app_service | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py | +| 1052 | CKV_AZURE_13 | resource | azurerm_linux_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py | +| 1053 | CKV_AZURE_13 | resource | azurerm_windows_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py | +| 1054 | CKV_AZURE_14 | resource | azurerm_app_service | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py | +| 1055 | CKV_AZURE_14 | resource | azurerm_linux_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py | +| 1056 | CKV_AZURE_14 | resource | azurerm_windows_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py | +| 1057 | CKV_AZURE_15 | resource | azurerm_app_service | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py | +| 1058 | CKV_AZURE_15 | resource | azurerm_linux_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py | +| 1059 | CKV_AZURE_15 | resource | azurerm_windows_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py | +| 1060 | CKV_AZURE_16 | resource | azurerm_app_service | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentity.py | +| 1061 | CKV_AZURE_16 | resource | azurerm_linux_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentity.py | +| 1062 | CKV_AZURE_16 | resource | azurerm_windows_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentity.py | +| 1063 | CKV_AZURE_17 | resource | azurerm_app_service | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py | +| 1064 | CKV_AZURE_17 | resource | azurerm_linux_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py | +| 1065 | CKV_AZURE_17 | resource | azurerm_windows_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py | +| 1066 | CKV_AZURE_18 | resource | azurerm_app_service | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py | +| 1067 | CKV_AZURE_18 | resource | azurerm_linux_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py | +| 1068 | CKV_AZURE_18 | resource | azurerm_windows_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py | +| 1069 | CKV_AZURE_19 | resource | azurerm_security_center_subscription_pricing | Ensure that standard pricing tier is selected | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterStandardPricing.py | +| 1070 | CKV_AZURE_20 | resource | azurerm_security_center_contact | Ensure that security contact 'Phone number' is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterContactPhone.py | +| 1071 | CKV_AZURE_21 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlert.py | +| 1072 | CKV_AZURE_22 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlertAdmins.py | +| 1073 | CKV_AZURE_23 | resource | azurerm_mssql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1074 | CKV_AZURE_23 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1075 | CKV_AZURE_23 | resource | azurerm_sql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1076 | CKV_AZURE_24 | resource | azurerm_mssql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1077 | CKV_AZURE_24 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1078 | CKV_AZURE_24 | resource | azurerm_sql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1079 | CKV_AZURE_25 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Threat Detection types' is set to 'All' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerThreatDetectionTypes.py | +| 1080 | CKV_AZURE_26 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerEmailAlertsEnabled.py | +| 1081 | CKV_AZURE_27 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerEmailAlertsToAdminsEnabled.py | +| 1082 | CKV_AZURE_28 | resource | azurerm_mysql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLServerSSLEnforcementEnabled.py | +| 1083 | CKV_AZURE_29 | resource | azurerm_postgresql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerSSLEnforcementEnabled.py | +| 1084 | CKV_AZURE_30 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerLogCheckpointsEnabled.py | +| 1085 | CKV_AZURE_31 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerLogConnectionsEnabled.py | +| 1086 | CKV_AZURE_32 | resource | azurerm_postgresql_configuration | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerConnectionThrottlingEnabled.py | +| 1087 | CKV_AZURE_33 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountLoggingQueueServiceEnabled.py | +| 1088 | CKV_AZURE_34 | resource | azurerm_storage_container | Ensure that 'Public access level' is set to Private for blob containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageBlobServiceContainerPrivateAccess.py | +| 1089 | CKV_AZURE_35 | resource | azurerm_storage_account | Ensure default network access rule for Storage Accounts is set to deny | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py | +| 1090 | CKV_AZURE_35 | resource | azurerm_storage_account_network_rules | Ensure default network access rule for Storage Accounts is set to deny | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py | +| 1091 | CKV_AZURE_36 | resource | azurerm_storage_account | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py | +| 1092 | CKV_AZURE_36 | resource | azurerm_storage_account_network_rules | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py | +| 1093 | CKV_AZURE_37 | resource | azurerm_monitor_log_profile | Ensure that Activity Log Retention is set 365 days or greater | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MonitorLogProfileRetentionDays.py | +| 1094 | CKV_AZURE_38 | resource | azurerm_monitor_log_profile | Ensure audit profile captures all the activities | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MonitorLogProfileCategories.py | +| 1095 | CKV_AZURE_39 | resource | azurerm_role_definition | Ensure that no custom subscription owner roles are created | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CutsomRoleDefinitionSubscriptionOwner.py | +| 1096 | CKV_AZURE_40 | resource | azurerm_key_vault_key | Ensure that the expiration date is set on all keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyExpirationDate.py | +| 1097 | CKV_AZURE_41 | resource | azurerm_key_vault_secret | Ensure that the expiration date is set on all secrets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecretExpirationDate.py | +| 1098 | CKV_AZURE_42 | resource | azurerm_key_vault | Ensure the key vault is recoverable | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyvaultRecoveryEnabled.py | +| 1099 | CKV_AZURE_43 | resource | azurerm_storage_account | Ensure Storage Accounts adhere to the naming rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountName.py | +| 1100 | CKV_AZURE_44 | resource | azurerm_storage_account | Ensure Storage Account is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountMinimumTlsVersion.py | +| 1101 | CKV_AZURE_45 | resource | azurerm_virtual_machine | Ensure that no sensitive credentials are exposed in VM custom_data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMCredsInCustomData.py | +| 1102 | CKV_AZURE_47 | resource | azurerm_mariadb_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MariaDBSSLEnforcementEnabled.py | +| 1103 | CKV_AZURE_48 | resource | azurerm_mariadb_server | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MariaDBPublicAccessDisabled.py | +| 1104 | CKV_AZURE_49 | resource | azurerm_linux_virtual_machine_scale_set | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureScaleSetPassword.py | +| 1105 | CKV_AZURE_50 | resource | azurerm_linux_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py | +| 1106 | CKV_AZURE_50 | resource | azurerm_windows_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py | +| 1107 | CKV_AZURE_52 | resource | azurerm_mssql_server | Ensure MSSQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MSSQLServerMinTLSVersion.py | +| 1108 | CKV_AZURE_53 | resource | azurerm_mysql_server | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLPublicAccessDisabled.py | +| 1109 | CKV_AZURE_54 | resource | azurerm_mysql_server | Ensure MySQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLServerMinTLSVersion.py | +| 1110 | CKV_AZURE_55 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnServers.py | +| 1111 | CKV_AZURE_56 | resource | azurerm_function_app | Ensure that function apps enables Authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppsEnableAuthentication.py | +| 1112 | CKV_AZURE_57 | resource | azurerm_app_service | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py | +| 1113 | CKV_AZURE_57 | resource | azurerm_linux_web_app | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py | +| 1114 | CKV_AZURE_57 | resource | azurerm_windows_web_app | Ensure that CORS disallows every resource to access app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py | +| 1115 | CKV_AZURE_58 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces enables managed virtual networks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesManagedVirtualNetworks.py | +| 1116 | CKV_AZURE_59 | resource | azurerm_storage_account | Ensure that Storage accounts disallow public access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageAccountDisablePublicAccess.py | +| 1117 | CKV_AZURE_61 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for App Service | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnAppServices.py | +| 1118 | CKV_AZURE_62 | resource | azurerm_function_app | Ensure function apps are not accessible from all regions | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppDisallowCORS.py | +| 1119 | CKV_AZURE_63 | resource | azurerm_app_service | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py | +| 1120 | CKV_AZURE_63 | resource | azurerm_linux_web_app | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py | +| 1121 | CKV_AZURE_63 | resource | azurerm_windows_web_app | Ensure that App service enables HTTP logging | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py | +| 1122 | CKV_AZURE_64 | resource | azurerm_storage_sync | Ensure that Azure File Sync disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/StorageSyncPublicAccessDisabled.py | +| 1123 | CKV_AZURE_65 | resource | azurerm_app_service | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py | +| 1124 | CKV_AZURE_65 | resource | azurerm_linux_web_app | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py | +| 1125 | CKV_AZURE_65 | resource | azurerm_windows_web_app | Ensure that App service enables detailed error messages | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py | +| 1126 | CKV_AZURE_66 | resource | azurerm_app_service | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py | +| 1127 | CKV_AZURE_66 | resource | azurerm_linux_web_app | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py | +| 1128 | CKV_AZURE_66 | resource | azurerm_windows_web_app | Ensure that App service enables failed request tracing | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py | +| 1129 | CKV_AZURE_67 | resource | azurerm_function_app | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py | +| 1130 | CKV_AZURE_67 | resource | azurerm_function_app_slot | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py | +| 1131 | CKV_AZURE_68 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerPublicAccessDisabled.py | +| 1132 | CKV_AZURE_69 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Azure SQL database servers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServers.py | +| 1133 | CKV_AZURE_70 | resource | azurerm_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py | +| 1134 | CKV_AZURE_71 | resource | azurerm_app_service | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py | +| 1135 | CKV_AZURE_71 | resource | azurerm_linux_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py | +| 1136 | CKV_AZURE_71 | resource | azurerm_windows_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py | +| 1137 | CKV_AZURE_72 | resource | azurerm_app_service | Ensure that remote debugging is not enabled for app services | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/RemoteDebggingNotEnabled.py | +| 1138 | CKV_AZURE_73 | resource | azurerm_automation_variable_bool | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AutomationEncrypted.py | +| 1139 | CKV_AZURE_73 | resource | azurerm_automation_variable_datetime | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AutomationEncrypted.py | +| 1140 | CKV_AZURE_73 | resource | azurerm_automation_variable_int | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AutomationEncrypted.py | +| 1141 | CKV_AZURE_73 | resource | azurerm_automation_variable_string | Ensure that Automation account variables are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AutomationEncrypted.py | +| 1142 | CKV_AZURE_74 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses disk encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DataExplorerUsesDiskEncryption.py | +| 1143 | CKV_AZURE_75 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses double encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDataExplorerDoubleEncryptionEnabled.py | +| 1144 | CKV_AZURE_76 | resource | azurerm_batch_account | Ensure that Azure Batch account uses key vault to encrypt data | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureBatchAccountUsesKeyVaultEncryption.py | +| 1145 | CKV_AZURE_77 | resource | azurerm_network_security_group | Ensure that UDP Services are restricted from the Internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py | +| 1146 | CKV_AZURE_77 | resource | azurerm_network_security_rule | Ensure that UDP Services are restricted from the Internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py | +| 1147 | CKV_AZURE_78 | resource | azurerm_app_service | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py | +| 1148 | CKV_AZURE_78 | resource | azurerm_linux_web_app | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py | +| 1149 | CKV_AZURE_78 | resource | azurerm_windows_web_app | Ensure FTP deployments are disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py | +| 1150 | CKV_AZURE_79 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for SQL servers on machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServerVMS.py | +| 1151 | CKV_AZURE_80 | resource | azurerm_app_service | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py | +| 1152 | CKV_AZURE_81 | resource | azurerm_app_service | Ensure that 'PHP version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServicePHPVersion.py | +| 1153 | CKV_AZURE_82 | resource | azurerm_app_service | Ensure that 'Python version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServicePythonVersion.py | +| 1154 | CKV_AZURE_83 | resource | azurerm_app_service | Ensure that 'Java version' is the latest, if used to run the web app | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceJavaVersion.py | +| 1155 | CKV_AZURE_84 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Storage | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnStorage.py | +| 1156 | CKV_AZURE_85 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Kubernetes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnKubernetes.py | +| 1157 | CKV_AZURE_86 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Container Registries | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnContainerRegistry.py | +| 1158 | CKV_AZURE_87 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Key Vault | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureDefenderOnKeyVaults.py | +| 1159 | CKV_AZURE_88 | resource | azurerm_app_service | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py | +| 1160 | CKV_AZURE_88 | resource | azurerm_linux_web_app | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py | +| 1161 | CKV_AZURE_88 | resource | azurerm_windows_web_app | Ensure that app services use Azure Files | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py | +| 1162 | CKV_AZURE_89 | resource | azurerm_redis_cache | Ensure that Azure Cache for Redis disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/RedisCachePublicNetworkAccessEnabled.py | +| 1163 | CKV_AZURE_91 | resource | azurerm_redis_cache | Ensure that only SSL are enabled for Cache for Redis | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/RedisCacheEnableNonSSLPort.py | +| 1164 | CKV_AZURE_92 | resource | azurerm_linux_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMStorageOsDisk.py | +| 1165 | CKV_AZURE_92 | resource | azurerm_windows_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMStorageOsDisk.py | +| 1166 | CKV_AZURE_93 | resource | azurerm_managed_disk | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureManagedDiskEncryptionSet.py | +| 1167 | CKV_AZURE_94 | resource | azurerm_mysql_server | Ensure that My SQL server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLGeoBackupEnabled.py | +| 1168 | CKV_AZURE_95 | resource | azurerm_virtual_machine_scale_set | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMScaleSetsAutoOSImagePatchingEnabled.py | +| 1169 | CKV_AZURE_96 | resource | azurerm_mysql_server | Ensure that MySQL server enables infrastructure encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLEncryptionEnaled.py | +| 1170 | CKV_AZURE_97 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py | +| 1171 | CKV_AZURE_97 | resource | azurerm_windows_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py | +| 1172 | CKV_AZURE_98 | resource | azurerm_container_group | Ensure that Azure Container group is deployed into virtual network | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureContainerGroupDeployedIntoVirtualNetwork.py | +| 1173 | CKV_AZURE_99 | resource | azurerm_cosmosdb_account | Ensure Cosmos DB accounts have restricted access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBAccountsRestrictedAccess.py | +| 1174 | CKV_AZURE_100 | resource | azurerm_cosmosdb_account | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBHaveCMK.py | +| 1175 | CKV_AZURE_101 | resource | azurerm_cosmosdb_account | Ensure that Azure Cosmos DB disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBDisablesPublicNetwork.py | +| 1176 | CKV_AZURE_102 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgressSQLGeoBackupEnabled.py | +| 1177 | CKV_AZURE_103 | resource | azurerm_data_factory | Ensure that Azure Data Factory uses Git repository for source control | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DataFactoryUsesGitRepository.py | +| 1178 | CKV_AZURE_104 | resource | azurerm_data_factory | Ensure that Azure Data factory public network access is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DataFactoryNoPublicNetworkAccess.py | +| 1179 | CKV_AZURE_105 | resource | azurerm_data_lake_store | Ensure that Data Lake Store accounts enables encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DataLakeStoreEncryption.py | +| 1180 | CKV_AZURE_106 | resource | azurerm_eventgrid_domain | Ensure that Azure Event Grid Domain public network access is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/EventgridDomainNetworkAccess.py | +| 1181 | CKV_AZURE_107 | resource | azurerm_api_management | Ensure that API management services use virtual networks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/APIServicesUseVirtualNetwork.py | +| 1182 | CKV_AZURE_108 | resource | azurerm_iothub | Ensure that Azure IoT Hub disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/IoTNoPublicNetworkAccess.py | +| 1183 | CKV_AZURE_109 | resource | azurerm_key_vault | Ensure that key vault allows firewall rules settings | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyVaultEnablesFirewallRulesSettings.py | +| 1184 | CKV_AZURE_110 | resource | azurerm_key_vault | Ensure that key vault enables purge protection | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyVaultEnablesPurgeProtection.py | +| 1185 | CKV_AZURE_111 | resource | azurerm_key_vault | Ensure that key vault enables soft delete | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyVaultEnablesSoftDelete.py | +| 1186 | CKV_AZURE_112 | resource | azurerm_key_vault_key | Ensure that key vault key is backed by HSM | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/KeyBackedByHSM.py | +| 1187 | CKV_AZURE_113 | resource | azurerm_mssql_server | Ensure that SQL server disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SQLServerPublicAccessDisabled.py | +| 1188 | CKV_AZURE_114 | resource | azurerm_key_vault_secret | Ensure that key vault secrets have "content_type" set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecretContentType.py | +| 1189 | CKV_AZURE_115 | resource | azurerm_kubernetes_cluster | Ensure that AKS enables private clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSEnablesPrivateClusters.py | +| 1190 | CKV_AZURE_116 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses Azure Policies Add-on | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py | +| 1191 | CKV_AZURE_117 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses disk encryption set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSUsesDiskEncryptionSet.py | +| 1192 | CKV_AZURE_118 | resource | azurerm_network_interface | Ensure that Network Interfaces disable IP forwarding | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NetworkInterfaceEnableIPForwarding.py | +| 1193 | CKV_AZURE_119 | resource | azurerm_network_interface | Ensure that Network Interfaces don't use public IPs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1194 | CKV_AZURE_120 | resource | azurerm_application_gateway | Ensure that Application Gateway enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1195 | CKV_AZURE_120 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1196 | CKV_AZURE_121 | resource | azurerm_frontdoor | Ensure that Azure Front Door enables WAF | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py | +| 1197 | CKV_AZURE_122 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway uses WAF in "Detection" or "Prevention" modes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppGWUseWAFMode.py | +| 1198 | CKV_AZURE_123 | resource | azurerm_frontdoor_firewall_policy | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FrontdoorUseWAFMode.py | +| 1199 | CKV_AZURE_124 | resource | azurerm_search_service | Ensure that Azure Cognitive Search disables public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureSearchPublicNetworkAccessDisabled.py | +| 1200 | CKV_AZURE_125 | resource | azurerm_service_fabric_cluster | Ensures that Service Fabric use three levels of protection available | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AzureServiceFabricClusterProtectionLevel.py | +| 1201 | CKV_AZURE_126 | resource | azurerm_service_fabric_cluster | Ensures that Active Directory is used for authentication for Service Fabric | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ActiveDirectoryUsedAuthenticationServiceFabric.py | +| 1202 | CKV_AZURE_127 | resource | azurerm_mysql_server | Ensure that My SQL server enables Threat detection policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MySQLTreatDetectionEnabled.py | +| 1203 | CKV_AZURE_128 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables Threat detection policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgresSQLTreatDetectionEnabled.py | +| 1204 | CKV_AZURE_129 | resource | azurerm_mariadb_server | Ensure that MariaDB server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MariaDBGeoBackupEnabled.py | +| 1205 | CKV_AZURE_130 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables infrastructure encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLEncryptionEnabled.py | +| 1206 | CKV_AZURE_131 | resource | azurerm_security_center_contact | Ensure that 'Security contact emails' is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SecurityCenterContactEmails.py | +| 1207 | CKV_AZURE_132 | resource | azurerm_cosmosdb_account | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBDisableAccessKeyWrite.py | +| 1208 | CKV_AZURE_133 | resource | azurerm_frontdoor_firewall_policy | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FrontDoorWAFACLCVE202144228.py | +| 1209 | CKV_AZURE_134 | resource | azurerm_cognitive_account | Ensure that Cognitive Services accounts disable public network access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CognitiveServicesDisablesPublicNetwork.py | +| 1210 | CKV_AZURE_135 | resource | azurerm_web_application_firewall_policy | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppGatewayWAFACLCVE202144228.py | +| 1211 | CKV_AZURE_136 | resource | azurerm_postgresql_flexible_server | Ensure that PostgreSQL Flexible server enables geo-redundant backups | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLFlexiServerGeoBackupEnabled.py | +| 1212 | CKV_AZURE_137 | resource | azurerm_container_registry | Ensure ACR admin account is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRAdminAccountDisabled.py | +| 1213 | CKV_AZURE_138 | resource | azurerm_container_registry | Ensures that ACR disables anonymous pulling of images | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRAnonymousPullDisabled.py | +| 1214 | CKV_AZURE_139 | resource | azurerm_container_registry | Ensure ACR set to disable public networking | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRPublicNetworkAccessDisabled.py | +| 1215 | CKV_AZURE_140 | resource | azurerm_cosmosdb_account | Ensure that Local Authentication is disabled on CosmosDB | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/CosmosDBLocalAuthDisabled.py | +| 1216 | CKV_AZURE_141 | resource | azurerm_kubernetes_cluster | Ensure AKS local admin account is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py | +| 1217 | CKV_AZURE_142 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Local Authentication is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MLCCLADisabled.py | +| 1218 | CKV_AZURE_143 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster nodes do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AKSNodePublicIpDisabled.py | +| 1219 | CKV_AZURE_144 | resource | azurerm_machine_learning_workspace | Ensure that Public Access is disabled for Machine Learning Workspace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MLPublicAccess.py | +| 1220 | CKV_AZURE_145 | resource | azurerm_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py | +| 1221 | CKV_AZURE_146 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLServerLogRetentionEnabled.py | +| 1222 | CKV_AZURE_147 | resource | azurerm_postgresql_server | Ensure PostgreSQL is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/PostgreSQLMinTLSVersion.py | +| 1223 | CKV_AZURE_148 | resource | azurerm_redis_cache | Ensure Redis Cache is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/RedisCacheMinTLSVersion.py | +| 1224 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine | Ensure that Virtual machine does not enable password authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py | +| 1225 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine does not enable password authentication | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py | +| 1226 | CKV_AZURE_150 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MLComputeClusterMinNodes.py | +| 1227 | CKV_AZURE_151 | resource | azurerm_windows_virtual_machine | Ensure Windows VM enables encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/WinVMEncryptionAtHost.py | +| 1228 | CKV_AZURE_152 | resource | azurerm_api_management | Ensure Client Certificates are enforced for API management | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/APIManagementCertsEnforced.py | +| 1229 | CKV_AZURE_153 | resource | azurerm_app_service_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py | +| 1230 | CKV_AZURE_154 | resource | azurerm_app_service_slot | Ensure the App service slot is using the latest version of TLS encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceSlotMinTLS.py | +| 1231 | CKV_AZURE_155 | resource | azurerm_app_service_slot | Ensure debugging is disabled for the App service slot | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/AppServiceSlotDebugDisabled.py | +| 1232 | CKV_AZURE_156 | resource | azurerm_mssql_database_extended_auditing_policy | Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/MSSQLServerAuditPolicyLogMonitor.py | +| 1233 | CKV_AZURE_157 | resource | azurerm_synapse_workspace | Ensure that Synapse workspace has data_exfiltration_protection_enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesDataExfilProtection.py | +| 1234 | CKV_AZURE_158 | resource | azurerm_databricks_workspace | Ensure that databricks workspace has not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py | +| 1235 | CKV_AZURE_159 | resource | azurerm_function_app | Ensure function app builtin logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py | +| 1236 | CKV_AZURE_159 | resource | azurerm_function_app_slot | Ensure function app builtin logging is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py | +| 1237 | CKV_AZURE_160 | resource | azurerm_network_security_group | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py | +| 1238 | CKV_AZURE_160 | resource | azurerm_network_security_rule | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py | +| 1239 | CKV_AZURE_161 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal is enabled on for HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SpringCloudAPIPortalHTTPSOnly.py | +| 1240 | CKV_AZURE_162 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal Public Access Is Disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/SpringCloudAPIPortalPublicAccessIsDisabled.py | +| 1241 | CKV_AZURE_163 | resource | azurerm_container_registry | Enable vulnerability scanning for container images. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRContainerScanEnabled.py | +| 1242 | CKV_AZURE_164 | resource | azurerm_container_registry | Ensures that ACR uses signed/trusted images | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRUseSignedImages.py | +| 1243 | CKV_AZURE_165 | resource | azurerm_container_registry | Ensure geo-replicated container registries to match multi-region container deployments. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACRGeoreplicated.py | +| 1244 | CKV_AZURE_166 | resource | azurerm_container_registry | Ensure container image quarantine, scan, and mark images verified | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACREnableImageQuarantine.py | +| 1245 | CKV_AZURE_167 | resource | azurerm_container_registry | Ensure a retention policy is set to cleanup untagged manifests. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/azure/ACREnableRetentionPolicy.py | +| 1246 | CKV2_AZURE_1 | resource | azurerm_storage_account | Ensure storage for critical data are encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1247 | CKV2_AZURE_2 | resource | azurerm_mssql_server_security_alert_policy | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1248 | CKV2_AZURE_2 | resource | azurerm_sql_server | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1249 | CKV2_AZURE_3 | resource | azurerm_mssql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1250 | CKV2_AZURE_3 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1251 | CKV2_AZURE_3 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1252 | CKV2_AZURE_3 | resource | azurerm_sql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1253 | CKV2_AZURE_4 | resource | azurerm_mssql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1254 | CKV2_AZURE_4 | resource | azurerm_mssql_server_security_alert_policy | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1255 | CKV2_AZURE_4 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1256 | CKV2_AZURE_4 | resource | azurerm_sql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1257 | CKV2_AZURE_5 | resource | azurerm_mssql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1258 | CKV2_AZURE_5 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1259 | CKV2_AZURE_5 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1260 | CKV2_AZURE_5 | resource | azurerm_sql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1261 | CKV2_AZURE_6 | resource | azurerm_sql_firewall_rule | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1262 | CKV2_AZURE_6 | resource | azurerm_sql_server | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1263 | CKV2_AZURE_7 | resource | azurerm_sql_server | Ensure that Azure Active Directory Admin is configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1264 | CKV2_AZURE_8 | resource | azurerm_monitor_activity_log_alert | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1265 | CKV2_AZURE_8 | resource | azurerm_storage_account | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1266 | CKV2_AZURE_8 | resource | azurerm_storage_container | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1267 | CKV2_AZURE_9 | resource | azurerm_virtual_machine | Ensure Virtual Machines are utilizing Managed Disks | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1268 | CKV2_AZURE_10 | resource | azurerm_virtual_machine | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1269 | CKV2_AZURE_10 | resource | azurerm_virtual_machine_extension | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1270 | CKV2_AZURE_11 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer encryption at rest uses a customer-managed key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1271 | CKV2_AZURE_12 | resource | azurerm_virtual_machine | Ensure that virtual machines are backed up using Azure Backup | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1272 | CKV2_AZURE_13 | resource | azurerm_mssql_server_security_alert_policy | Ensure that sql servers enables data security policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1273 | CKV2_AZURE_13 | resource | azurerm_sql_server | Ensure that sql servers enables data security policy | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1274 | CKV2_AZURE_14 | resource | azurerm_managed_disk | Ensure that Unattached disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1275 | CKV2_AZURE_14 | resource | azurerm_virtual_machine | Ensure that Unattached disks are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1276 | CKV2_AZURE_15 | resource | azurerm_data_factory | Ensure that Azure data factories are encrypted with a customer-managed key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1277 | CKV2_AZURE_16 | resource | azurerm_mysql_server | Ensure that MySQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1278 | CKV2_AZURE_16 | resource | azurerm_mysql_server_key | Ensure that MySQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1279 | CKV2_AZURE_17 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1280 | CKV2_AZURE_17 | resource | azurerm_postgresql_server_key | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1281 | CKV2_AZURE_18 | resource | azurerm_storage_account | Ensure that Storage Accounts use customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1282 | CKV2_AZURE_18 | resource | azurerm_storage_account_customer_managed_key | Ensure that Storage Accounts use customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1283 | CKV2_AZURE_19 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1284 | CKV2_AZURE_20 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1285 | CKV2_AZURE_20 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1286 | CKV2_AZURE_20 | resource | azurerm_storage_table | Ensure Storage logging is enabled for Table service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1287 | CKV2_AZURE_21 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1288 | CKV2_AZURE_21 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1289 | CKV2_AZURE_21 | resource | azurerm_storage_container | Ensure Storage logging is enabled for Blob service for read requests | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1290 | CKV2_AZURE_22 | resource | azurerm_cognitive_account | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1291 | CKV2_AZURE_22 | resource | azurerm_cognitive_account_customer_managed_key | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1292 | CKV_BCW_1 | provider | bridgecrew | Ensure no hard coded API token exist in the provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/bridgecrew/credentials.py | +| 1293 | CKV_DIO_1 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/digitalocean/SpacesBucketVersioning.py | +| 1294 | CKV_DIO_2 | resource | digitalocean_droplet | Ensure the droplet specifies an SSH key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/digitalocean/DropletSSHKeys.py | +| 1295 | CKV_DIO_3 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket is private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/digitalocean/SpacesBucketPublicRead.py | +| 1296 | CKV_DIO_4 | resource | digitalocean_firewall | Ensure the firewall ingress is not wide open | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/digitalocean/FirewallIngressOpen.py | +| 1297 | CKV_GCP_1 | resource | google_container_cluster | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEClusterLogging.py | +| 1298 | CKV_GCP_2 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted ssh access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py | +| 1299 | CKV_GCP_3 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted rdp access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py | +| 1300 | CKV_GCP_4 | resource | google_compute_ssl_policy | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeSSLPolicy.py | +| 1301 | CKV_GCP_6 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance requires all incoming connections to use SSL | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabaseRequireSsl.py | +| 1302 | CKV_GCP_7 | resource | google_container_cluster | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEDisableLegacyAuth.py | +| 1303 | CKV_GCP_8 | resource | google_container_cluster | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEMonitoringEnabled.py | +| 1304 | CKV_GCP_9 | resource | google_container_node_pool | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKENodePoolAutoRepairEnabled.py | +| 1305 | CKV_GCP_10 | resource | google_container_node_pool | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKENodePoolAutoUpgradeEnabled.py | +| 1306 | CKV_GCP_11 | resource | google_sql_database_instance | Ensure that Cloud SQL database Instances are not open to the world | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePubliclyAccessible.py | +| 1307 | CKV_GCP_12 | resource | google_container_cluster | Ensure Network Policy is enabled on Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKENetworkPolicyEnabled.py | +| 1308 | CKV_GCP_13 | resource | google_container_cluster | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py | +| 1309 | CKV_GCP_14 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance have backup configuration enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlBackupConfiguration.py | +| 1310 | CKV_GCP_15 | resource | google_bigquery_dataset | Ensure that BigQuery datasets are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleBigQueryDatasetPublicACL.py | +| 1311 | CKV_GCP_16 | resource | google_dns_managed_zone | Ensure that DNSSEC is enabled for Cloud DNS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudDNSSECEnabled.py | +| 1312 | CKV_GCP_17 | resource | google_dns_managed_zone | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudDNSKeySpecsRSASHA1.py | +| 1313 | CKV_GCP_18 | resource | google_container_cluster | Ensure GKE Control Plane is not public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEPublicControlPlane.py | +| 1314 | CKV_GCP_19 | resource | google_container_cluster | Ensure GKE basic auth is disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py | +| 1315 | CKV_GCP_20 | resource | google_container_cluster | Ensure master authorized networks is set to enabled in GKE clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEMasterAuthorizedNetworksEnabled.py | +| 1316 | CKV_GCP_21 | resource | google_container_cluster | Ensure Kubernetes Clusters are configured with Labels | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEHasLabels.py | +| 1317 | CKV_GCP_22 | resource | google_container_node_pool | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEUseCosImage.py | +| 1318 | CKV_GCP_23 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEAliasIpEnabled.py | +| 1319 | CKV_GCP_24 | resource | google_container_cluster | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEPodSecurityPolicyEnabled.py | +| 1320 | CKV_GCP_25 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Private cluster enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEPrivateClusterConfig.py | +| 1321 | CKV_GCP_26 | resource | google_compute_subnetwork | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py | +| 1322 | CKV_GCP_27 | resource | google_project | Ensure that the default network does not exist in a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectDefaultNetwork.py | +| 1323 | CKV_GCP_28 | resource | google_storage_bucket_iam_binding | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py | +| 1324 | CKV_GCP_28 | resource | google_storage_bucket_iam_member | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py | +| 1325 | CKV_GCP_29 | resource | google_storage_bucket | Ensure that Cloud Storage buckets have uniform bucket-level access enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleStorageBucketUniformAccess.py | +| 1326 | CKV_GCP_30 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py | +| 1327 | CKV_GCP_30 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py | +| 1328 | CKV_GCP_30 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py | +| 1329 | CKV_GCP_31 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py | +| 1330 | CKV_GCP_31 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py | +| 1331 | CKV_GCP_31 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py | +| 1332 | CKV_GCP_32 | resource | google_compute_instance | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py | +| 1333 | CKV_GCP_32 | resource | google_compute_instance_from_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py | +| 1334 | CKV_GCP_32 | resource | google_compute_instance_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py | +| 1335 | CKV_GCP_33 | resource | google_compute_project_metadata | Ensure oslogin is enabled for a Project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeProjectOSLogin.py | +| 1336 | CKV_GCP_34 | resource | google_compute_instance | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py | +| 1337 | CKV_GCP_34 | resource | google_compute_instance_from_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py | +| 1338 | CKV_GCP_34 | resource | google_compute_instance_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py | +| 1339 | CKV_GCP_35 | resource | google_compute_instance | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py | +| 1340 | CKV_GCP_35 | resource | google_compute_instance_from_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py | +| 1341 | CKV_GCP_35 | resource | google_compute_instance_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py | +| 1342 | CKV_GCP_36 | resource | google_compute_instance | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py | +| 1343 | CKV_GCP_36 | resource | google_compute_instance_from_template | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py | +| 1344 | CKV_GCP_36 | resource | google_compute_instance_template | Ensure that IP forwarding is not enabled on Instances | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py | +| 1345 | CKV_GCP_37 | resource | google_compute_disk | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeDiskEncryption.py | +| 1346 | CKV_GCP_38 | resource | google_compute_instance | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeBootDiskEncryption.py | +| 1347 | CKV_GCP_39 | resource | google_compute_instance | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py | +| 1348 | CKV_GCP_39 | resource | google_compute_instance_from_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py | +| 1349 | CKV_GCP_39 | resource | google_compute_instance_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py | +| 1350 | CKV_GCP_40 | resource | google_compute_instance | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py | +| 1351 | CKV_GCP_40 | resource | google_compute_instance_from_template | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py | +| 1352 | CKV_GCP_40 | resource | google_compute_instance_template | Ensure that Compute instances do not have public IP addresses | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py | +| 1353 | CKV_GCP_41 | resource | google_project_iam_binding | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py | +| 1354 | CKV_GCP_41 | resource | google_project_iam_member | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py | +| 1355 | CKV_GCP_42 | resource | google_project_iam_member | Ensure that Service Account has no Admin privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectAdminServiceAccount.py | +| 1356 | CKV_GCP_43 | resource | google_kms_crypto_key | Ensure KMS encryption keys are rotated within a period of 90 days | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py | +| 1357 | CKV_GCP_44 | resource | google_folder_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py | +| 1358 | CKV_GCP_44 | resource | google_folder_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py | +| 1359 | CKV_GCP_45 | resource | google_organization_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py | +| 1360 | CKV_GCP_45 | resource | google_organization_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py | +| 1361 | CKV_GCP_46 | resource | google_project_iam_binding | Ensure Default Service account is not used at a project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py | +| 1362 | CKV_GCP_46 | resource | google_project_iam_member | Ensure Default Service account is not used at a project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py | +| 1363 | CKV_GCP_47 | resource | google_organization_iam_binding | Ensure default service account is not used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py | +| 1364 | CKV_GCP_47 | resource | google_organization_iam_member | Ensure default service account is not used at an organization level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py | +| 1365 | CKV_GCP_48 | resource | google_folder_iam_binding | Ensure Default Service account is not used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py | +| 1366 | CKV_GCP_48 | resource | google_folder_iam_member | Ensure Default Service account is not used at a folder level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py | +| 1367 | CKV_GCP_49 | resource | google_project_iam_binding | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py | +| 1368 | CKV_GCP_49 | resource | google_project_iam_member | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py | +| 1369 | CKV_GCP_50 | resource | google_sql_database_instance | Ensure MySQL database 'local_infile' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudMySqlLocalInfileOff.py | +| 1370 | CKV_GCP_51 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogCheckpoints.py | +| 1371 | CKV_GCP_52 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_connections' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogConnection.py | +| 1372 | CKV_GCP_53 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_disconnections' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogDisconnection.py | +| 1373 | CKV_GCP_54 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogLockWaits.py | +| 1374 | CKV_GCP_55 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinMessage.py | +| 1375 | CKV_GCP_56 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_temp_files flag is set to '0' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogTemp.py | +| 1376 | CKV_GCP_57 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinDuration.py | +| 1377 | CKV_GCP_58 | resource | google_sql_database_instance | Ensure SQL database 'cross db ownership chaining' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerCrossDBOwnershipChaining.py | +| 1378 | CKV_GCP_59 | resource | google_sql_database_instance | Ensure SQL database 'contained database authentication' flag is set to 'off' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerContainedDBAuthentication.py | +| 1379 | CKV_GCP_60 | resource | google_sql_database_instance | Ensure Cloud SQL database does not have public IP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerNoPublicIP.py | +| 1380 | CKV_GCP_61 | resource | google_container_cluster | Enable VPC Flow Logs and Intranode Visibility | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEEnableVPCFlowLogs.py | +| 1381 | CKV_GCP_62 | resource | google_storage_bucket | Bucket should log access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudStorageLogging.py | +| 1382 | CKV_GCP_63 | resource | google_storage_bucket | Bucket should not log to itself | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudStorageSelfLogging.py | +| 1383 | CKV_GCP_64 | resource | google_container_cluster | Ensure clusters are created with Private Nodes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEPrivateNodes.py | +| 1384 | CKV_GCP_65 | resource | google_container_cluster | Manage Kubernetes RBAC users with Google Groups for GKE | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEKubernetesRBACGoogleGroups.py | +| 1385 | CKV_GCP_66 | resource | google_container_cluster | Ensure use of Binary Authorization | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEBinaryAuthorization.py | +| 1386 | CKV_GCP_67 | resource | google_container_cluster | Ensure legacy Compute Engine instance metadata APIs are Disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKELegacyInstanceMetadataDisabled.py | +| 1387 | CKV_GCP_68 | resource | google_container_cluster | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py | +| 1388 | CKV_GCP_68 | resource | google_container_node_pool | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py | +| 1389 | CKV_GCP_69 | resource | google_container_cluster | Ensure the GKE Metadata Server is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py | +| 1390 | CKV_GCP_69 | resource | google_container_node_pool | Ensure the GKE Metadata Server is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py | +| 1391 | CKV_GCP_70 | resource | google_container_cluster | Ensure the GKE Release Channel is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEReleaseChannel.py | +| 1392 | CKV_GCP_71 | resource | google_container_cluster | Ensure Shielded GKE Nodes are Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEEnableShieldedNodes.py | +| 1393 | CKV_GCP_72 | resource | google_container_cluster | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py | +| 1394 | CKV_GCP_72 | resource | google_container_node_pool | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py | +| 1395 | CKV_GCP_73 | resource | google_compute_security_policy | Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudArmorWAFACLCVE202144228.py | +| 1396 | CKV_GCP_74 | resource | google_compute_subnetwork | Ensure that private_ip_google_access is enabled for Subnet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleSubnetworkPrivateGoogleEnabled.py | +| 1397 | CKV_GCP_75 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted FTP access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress21.py | +| 1398 | CKV_GCP_76 | resource | google_compute_subnetwork | Ensure that Private google access is enabled for IPV6 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleSubnetworkIPV6PrivateGoogleEnabled.py | +| 1399 | CKV_GCP_77 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow on ftp port | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress20.py | +| 1400 | CKV_GCP_78 | resource | google_storage_bucket | Ensure Cloud storage has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudStorageVersioningEnabled.py | +| 1401 | CKV_GCP_79 | resource | google_sql_database_instance | Ensure SQL database is using latest Major version | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py | +| 1402 | CKV_GCP_80 | resource | google_bigquery_table | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigQueryTableEncryptedWithCMK.py | +| 1403 | CKV_GCP_81 | resource | google_bigquery_dataset | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigQueryDatasetEncryptedWithCMK.py | +| 1404 | CKV_GCP_82 | resource | google_kms_crypto_key | Ensure KMS keys are protected from deletion | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleKMSPreventDestroy.py | +| 1405 | CKV_GCP_83 | resource | google_pubsub_topic | Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudPubSubEncryptedWithCMK.py | +| 1406 | CKV_GCP_84 | resource | google_artifact_registry_repository | Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/ArtifactRegsitryEncryptedWithCMK.py | +| 1407 | CKV_GCP_85 | resource | google_bigtable_instance | Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigTableInstanceEncryptedWithCMK.py | +| 1408 | CKV_GCP_86 | resource | google_cloudbuild_worker_pool | Ensure Cloud build workers are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudBuildWorkersArePrivate.py | +| 1409 | CKV_GCP_87 | resource | google_data_fusion_instance | Ensure Data fusion instances are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataFusionPrivateInstance.py | +| 1410 | CKV_GCP_88 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted mysql access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3306.py | +| 1411 | CKV_GCP_89 | resource | google_notebooks_instance | Ensure Vertex AI instances are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/VertexAIPrivateInstance.py | +| 1412 | CKV_GCP_90 | resource | google_dataflow_job | Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataflowJobEncryptedWithCMK.py | +| 1413 | CKV_GCP_91 | resource | google_dataproc_cluster | Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataprocClusterEncryptedWithCMK.py | +| 1414 | CKV_GCP_92 | resource | google_vertex_ai_dataset | Ensure Vertex AI datasets uses a CMK (Customer Manager Key) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/VertexAIDatasetEncryptedWithCMK.py | +| 1415 | CKV_GCP_93 | resource | google_spanner_database | Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/SpannerDatabaseEncryptedWithCMK.py | +| 1416 | CKV_GCP_94 | resource | google_dataflow_job | Ensure Dataflow jobs are private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataflowPrivateJob.py | +| 1417 | CKV_GCP_95 | resource | google_redis_instance | Ensure Memorystore for Redis has AUTH enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/MemorystoreForRedisAuthEnabled.py | +| 1418 | CKV_GCP_96 | resource | google_vertex_ai_metadata_store | Ensure Vertex AI Metadata Store uses a CMK (Customer Manager Key) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/VertexAIMetadataStoreEncryptedWithCMK.py | +| 1419 | CKV_GCP_97 | resource | google_redis_instance | Ensure Memorystore for Redis uses intransit encryption | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/MemorystoreForRedisInTransitEncryption.py | +| 1420 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_binding | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py | +| 1421 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_member | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py | +| 1422 | CKV_GCP_99 | resource | google_pubsub_topic_iam_binding | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py | +| 1423 | CKV_GCP_99 | resource | google_pubsub_topic_iam_member | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py | +| 1424 | CKV_GCP_100 | resource | google_bigquery_table_iam_binding | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py | +| 1425 | CKV_GCP_100 | resource | google_bigquery_table_iam_member | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py | +| 1426 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_binding | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py | +| 1427 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_member | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py | +| 1428 | CKV_GCP_102 | resource | google_cloud_run_service_iam_binding | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py | +| 1429 | CKV_GCP_102 | resource | google_cloud_run_service_iam_member | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py | +| 1430 | CKV_GCP_103 | resource | google_dataproc_cluster | Ensure Dataproc Clusters do not have public IPs | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataprocPublicIpCluster.py | +| 1431 | CKV_GCP_104 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver logging enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataFusionStackdriverLogs.py | +| 1432 | CKV_GCP_105 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver monitoring enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/DataFusionStackdriverMonitoring.py | +| 1433 | CKV_GCP_106 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress80.py | +| 1434 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_binding | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py | +| 1435 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_member | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py | +| 1436 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_binding | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py | +| 1437 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_member | Cloud functions should not be public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py | +| 1438 | CKV_GCP_108 | resource | google_sql_database_instance | Ensure hostnames are logged for GCP PostgreSQL databases | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogHostname.py | +| 1439 | CKV_GCP_109 | resource | google_sql_database_instance | Ensure the GCP PostgreSQL database log levels are set to ERROR or lower | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinErrorStatement.py | +| 1440 | CKV_GCP_110 | resource | google_sql_database_instance | Ensure pgAudit is enabled for your GCP PostgreSQL database | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlEnablePgaudit.py | +| 1441 | CKV_GCP_111 | resource | google_sql_database_instance | Ensure GCP PostgreSQL logs SQL statements | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogStatement.py | +| 1442 | CKV2_GCP_1 | resource | google_project_default_service_accounts | Ensure GKE clusters are not running using the Compute Engine default service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1443 | CKV2_GCP_2 | resource | google_compute_network | Ensure legacy networks do not exist for a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1444 | CKV2_GCP_3 | resource | google_service_account_key | Ensure that there are only GCP-managed service account keys for each service account | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1445 | CKV2_GCP_4 | resource | google_logging_folder_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1446 | CKV2_GCP_4 | resource | google_logging_organization_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1447 | CKV2_GCP_4 | resource | google_logging_project_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1448 | CKV2_GCP_4 | resource | google_storage_bucket | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1449 | CKV2_GCP_5 | resource | google_project | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1450 | CKV2_GCP_5 | resource | google_project_iam_audit_config | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1451 | CKV2_GCP_6 | resource | google_kms_crypto_key | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1452 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_binding | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1453 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_member | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1454 | CKV2_GCP_7 | resource | google_sql_database_instance | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1455 | CKV2_GCP_7 | resource | google_sql_user | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1456 | CKV2_GCP_8 | resource | google_kms_key_ring | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1457 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_binding | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1458 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_member | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1459 | CKV2_GCP_9 | resource | google_container_registry | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1460 | CKV2_GCP_9 | resource | google_storage_bucket_iam_binding | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1461 | CKV2_GCP_9 | resource | google_storage_bucket_iam_member | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1462 | CKV2_GCP_10 | resource | google_cloudfunctions_function | Ensure GCP Cloud Function HTTP trigger is secured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1463 | CKV2_GCP_11 | resource | google_project_services | Ensure GCP GCR Container Vulnerability Scanning is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1464 | CKV2_GCP_12 | resource | google_compute_firewall | Ensure GCP compute firewall ingress does not allow unrestricted access to all ports | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1465 | CKV_GIT_1 | resource | github_repository | Ensure GitHub repository is Private | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/PrivateRepo.py | +| 1466 | CKV_GIT_2 | resource | github_repository_webhook | Ensure GitHub repository webhooks are using HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/WebhookInsecureSsl.py | +| 1467 | CKV_GIT_3 | resource | github_repository | Ensure GitHub repository has vulnerability alerts enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py | +| 1468 | CKV_GIT_4 | resource | github_actions_environment_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/SecretsEncrypted.py | +| 1469 | CKV_GIT_4 | resource | github_actions_organization_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/SecretsEncrypted.py | +| 1470 | CKV_GIT_4 | resource | github_actions_secret | Ensure GitHub Actions secrets are encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/SecretsEncrypted.py | +| 1471 | CKV_GIT_5 | resource | github_branch_protection | GitHub pull requests should require at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py | +| 1472 | CKV_GIT_5 | resource | github_branch_protection_v3 | GitHub pull requests should require at least 2 approvals | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py | +| 1473 | CKV_GIT_6 | resource | github_branch_protection | Ensure GitHub branch protection rules requires signed commits | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py | +| 1474 | CKV_GIT_6 | resource | github_branch_protection_v3 | Ensure GitHub branch protection rules requires signed commits | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py | +| 1475 | CKV2_GIT_1 | resource | github_repository | Ensure each Repository has branch protection associated | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1476 | CKV_GLB_1 | resource | gitlab_project | Ensure at least two approving reviews are required to merge a GitLab MR | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gitlab/RequireTwoApprovalsToMerge.py | +| 1477 | CKV_GLB_2 | resource | gitlab_branch_protection | Ensure GitLab branch protection rules does not allow force pushes | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gitlab/ForcePushDisabled.py | +| 1478 | CKV_GLB_3 | resource | gitlab_project | Ensure GitLab prevent secrets is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gitlab/PreventSecretsEnabled.py | +| 1479 | CKV_GLB_4 | resource | gitlab_project | Ensure GitLab commits are signed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/gitlab/RejectUnsignedCommits.py | +| 1480 | CKV_K8S_1 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPIDPSP.py | +| 1481 | CKV_K8S_2 | resource | kubernetes_pod_security_policy | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainerPSP.py | +| 1482 | CKV_K8S_3 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPCPSP.py | +| 1483 | CKV_K8S_4 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespacePSP.py | +| 1484 | CKV_K8S_5 | resource | kubernetes_pod_security_policy | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalationPSP.py | +| 1485 | CKV_K8S_6 | resource | kubernetes_pod_security_policy | Do not admit root containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/RootContainerPSP.py | +| 1486 | CKV_K8S_7 | resource | kubernetes_pod_security_policy | Do not admit containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilitiesPSP.py | +| 1487 | CKV_K8S_8 | resource | kubernetes_deployment | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py | +| 1488 | CKV_K8S_8 | resource | kubernetes_deployment_v1 | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py | +| 1489 | CKV_K8S_8 | resource | kubernetes_pod | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py | +| 1490 | CKV_K8S_8 | resource | kubernetes_pod_v1 | Liveness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py | +| 1491 | CKV_K8S_9 | resource | kubernetes_deployment | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py | +| 1492 | CKV_K8S_9 | resource | kubernetes_deployment_v1 | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py | +| 1493 | CKV_K8S_9 | resource | kubernetes_pod | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py | +| 1494 | CKV_K8S_9 | resource | kubernetes_pod_v1 | Readiness Probe Should be Configured | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py | +| 1495 | CKV_K8S_10 | resource | kubernetes_deployment | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPURequests.py | +| 1496 | CKV_K8S_10 | resource | kubernetes_deployment_v1 | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPURequests.py | +| 1497 | CKV_K8S_10 | resource | kubernetes_pod | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPURequests.py | +| 1498 | CKV_K8S_10 | resource | kubernetes_pod_v1 | CPU requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPURequests.py | +| 1499 | CKV_K8S_11 | resource | kubernetes_deployment | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPULimits.py | +| 1500 | CKV_K8S_11 | resource | kubernetes_deployment_v1 | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPULimits.py | +| 1501 | CKV_K8S_11 | resource | kubernetes_pod | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPULimits.py | +| 1502 | CKV_K8S_11 | resource | kubernetes_pod_v1 | CPU Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/CPULimits.py | +| 1503 | CKV_K8S_12 | resource | kubernetes_deployment | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py | +| 1504 | CKV_K8S_12 | resource | kubernetes_deployment_v1 | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py | +| 1505 | CKV_K8S_12 | resource | kubernetes_pod | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py | +| 1506 | CKV_K8S_12 | resource | kubernetes_pod_v1 | Memory Limits should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py | +| 1507 | CKV_K8S_13 | resource | kubernetes_deployment | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py | +| 1508 | CKV_K8S_13 | resource | kubernetes_deployment_v1 | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py | +| 1509 | CKV_K8S_13 | resource | kubernetes_pod | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py | +| 1510 | CKV_K8S_13 | resource | kubernetes_pod_v1 | Memory requests should be set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py | +| 1511 | CKV_K8S_14 | resource | kubernetes_deployment | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py | +| 1512 | CKV_K8S_14 | resource | kubernetes_deployment_v1 | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py | +| 1513 | CKV_K8S_14 | resource | kubernetes_pod | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py | +| 1514 | CKV_K8S_14 | resource | kubernetes_pod_v1 | Image Tag should be fixed - not latest or blank | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py | +| 1515 | CKV_K8S_15 | resource | kubernetes_deployment | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py | +| 1516 | CKV_K8S_15 | resource | kubernetes_deployment_v1 | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py | +| 1517 | CKV_K8S_15 | resource | kubernetes_pod | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py | +| 1518 | CKV_K8S_15 | resource | kubernetes_pod_v1 | Image Pull Policy should be Always | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py | +| 1519 | CKV_K8S_16 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py | +| 1520 | CKV_K8S_16 | resource | kubernetes_deployment_v1 | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py | +| 1521 | CKV_K8S_16 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py | +| 1522 | CKV_K8S_16 | resource | kubernetes_pod_v1 | Do not admit privileged containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py | +| 1523 | CKV_K8S_17 | resource | kubernetes_deployment | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py | +| 1524 | CKV_K8S_17 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py | +| 1525 | CKV_K8S_17 | resource | kubernetes_pod | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py | +| 1526 | CKV_K8S_17 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py | +| 1527 | CKV_K8S_18 | resource | kubernetes_deployment | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py | +| 1528 | CKV_K8S_18 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py | +| 1529 | CKV_K8S_18 | resource | kubernetes_pod | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py | +| 1530 | CKV_K8S_18 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py | +| 1531 | CKV_K8S_19 | resource | kubernetes_deployment | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py | +| 1532 | CKV_K8S_19 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py | +| 1533 | CKV_K8S_19 | resource | kubernetes_pod | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py | +| 1534 | CKV_K8S_19 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host network namespace | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py | +| 1535 | CKV_K8S_20 | resource | kubernetes_deployment | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py | +| 1536 | CKV_K8S_20 | resource | kubernetes_deployment_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py | +| 1537 | CKV_K8S_20 | resource | kubernetes_pod | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py | +| 1538 | CKV_K8S_20 | resource | kubernetes_pod_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py | +| 1539 | CKV_K8S_21 | resource | kubernetes_config_map | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1540 | CKV_K8S_21 | resource | kubernetes_config_map_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1541 | CKV_K8S_21 | resource | kubernetes_cron_job | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1542 | CKV_K8S_21 | resource | kubernetes_cron_job_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1543 | CKV_K8S_21 | resource | kubernetes_daemon_set_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1544 | CKV_K8S_21 | resource | kubernetes_daemonset | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1545 | CKV_K8S_21 | resource | kubernetes_deployment | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1546 | CKV_K8S_21 | resource | kubernetes_deployment_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1547 | CKV_K8S_21 | resource | kubernetes_ingress | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1548 | CKV_K8S_21 | resource | kubernetes_ingress_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1549 | CKV_K8S_21 | resource | kubernetes_job | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1550 | CKV_K8S_21 | resource | kubernetes_job_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1551 | CKV_K8S_21 | resource | kubernetes_pod | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1552 | CKV_K8S_21 | resource | kubernetes_pod_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1553 | CKV_K8S_21 | resource | kubernetes_replication_controller | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1554 | CKV_K8S_21 | resource | kubernetes_replication_controller_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1555 | CKV_K8S_21 | resource | kubernetes_role_binding | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1556 | CKV_K8S_21 | resource | kubernetes_role_binding_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1557 | CKV_K8S_21 | resource | kubernetes_secret | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1558 | CKV_K8S_21 | resource | kubernetes_secret_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1559 | CKV_K8S_21 | resource | kubernetes_service | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1560 | CKV_K8S_21 | resource | kubernetes_service_account | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1561 | CKV_K8S_21 | resource | kubernetes_service_account_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1562 | CKV_K8S_21 | resource | kubernetes_service_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1563 | CKV_K8S_21 | resource | kubernetes_stateful_set | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1564 | CKV_K8S_21 | resource | kubernetes_stateful_set_v1 | The default namespace should not be used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py | +| 1565 | CKV_K8S_22 | resource | kubernetes_deployment | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py | +| 1566 | CKV_K8S_22 | resource | kubernetes_deployment_v1 | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py | +| 1567 | CKV_K8S_22 | resource | kubernetes_pod | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py | +| 1568 | CKV_K8S_22 | resource | kubernetes_pod_v1 | Use read-only filesystem for containers where possible | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py | +| 1569 | CKV_K8S_24 | resource | kubernetes_pod_security_policy | Do not allow containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesPSP.py | +| 1570 | CKV_K8S_25 | resource | kubernetes_deployment | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py | +| 1571 | CKV_K8S_25 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py | +| 1572 | CKV_K8S_25 | resource | kubernetes_pod | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py | +| 1573 | CKV_K8S_25 | resource | kubernetes_pod_v1 | Minimize the admission of containers with added capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py | +| 1574 | CKV_K8S_26 | resource | kubernetes_deployment | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/HostPort.py | +| 1575 | CKV_K8S_26 | resource | kubernetes_deployment_v1 | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/HostPort.py | +| 1576 | CKV_K8S_26 | resource | kubernetes_pod | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/HostPort.py | +| 1577 | CKV_K8S_26 | resource | kubernetes_pod_v1 | Do not specify hostPort unless absolutely necessary | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/HostPort.py | +| 1578 | CKV_K8S_27 | resource | kubernetes_daemon_set_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 1579 | CKV_K8S_27 | resource | kubernetes_daemonset | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 1580 | CKV_K8S_27 | resource | kubernetes_deployment | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 1581 | CKV_K8S_27 | resource | kubernetes_deployment_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 1582 | CKV_K8S_27 | resource | kubernetes_pod | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 1583 | CKV_K8S_27 | resource | kubernetes_pod_v1 | Do not expose the docker daemon socket to containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py | +| 1584 | CKV_K8S_28 | resource | kubernetes_deployment | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py | +| 1585 | CKV_K8S_28 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py | +| 1586 | CKV_K8S_28 | resource | kubernetes_pod | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py | +| 1587 | CKV_K8S_28 | resource | kubernetes_pod_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py | +| 1588 | CKV_K8S_29 | resource | kubernetes_daemon_set_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 1589 | CKV_K8S_29 | resource | kubernetes_daemonset | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 1590 | CKV_K8S_29 | resource | kubernetes_deployment | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 1591 | CKV_K8S_29 | resource | kubernetes_deployment_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 1592 | CKV_K8S_29 | resource | kubernetes_pod | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 1593 | CKV_K8S_29 | resource | kubernetes_pod_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py | +| 1594 | CKV_K8S_30 | resource | kubernetes_deployment | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py | +| 1595 | CKV_K8S_30 | resource | kubernetes_deployment_v1 | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py | +| 1596 | CKV_K8S_30 | resource | kubernetes_pod | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py | +| 1597 | CKV_K8S_30 | resource | kubernetes_pod_v1 | Apply security context to your pods and containers | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py | +| 1598 | CKV_K8S_32 | resource | kubernetes_pod_security_policy | Ensure default seccomp profile set to docker/default or runtime/default | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/SeccompPSP.py | +| 1599 | CKV_K8S_34 | resource | kubernetes_deployment | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Tiller.py | +| 1600 | CKV_K8S_34 | resource | kubernetes_deployment_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Tiller.py | +| 1601 | CKV_K8S_34 | resource | kubernetes_pod | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Tiller.py | +| 1602 | CKV_K8S_34 | resource | kubernetes_pod_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Tiller.py | +| 1603 | CKV_K8S_35 | resource | kubernetes_deployment | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Secrets.py | +| 1604 | CKV_K8S_35 | resource | kubernetes_deployment_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Secrets.py | +| 1605 | CKV_K8S_35 | resource | kubernetes_pod | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Secrets.py | +| 1606 | CKV_K8S_35 | resource | kubernetes_pod_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/Secrets.py | +| 1607 | CKV_K8S_36 | resource | kubernetes_pod_security_policy | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilitiesPSP.py | +| 1608 | CKV_K8S_37 | resource | kubernetes_deployment | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py | +| 1609 | CKV_K8S_37 | resource | kubernetes_deployment_v1 | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py | +| 1610 | CKV_K8S_37 | resource | kubernetes_pod | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py | +| 1611 | CKV_K8S_37 | resource | kubernetes_pod_v1 | Minimise the admission of containers with capabilities assigned | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py | +| 1612 | CKV_K8S_39 | resource | kubernetes_deployment | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py | +| 1613 | CKV_K8S_39 | resource | kubernetes_deployment_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py | +| 1614 | CKV_K8S_39 | resource | kubernetes_pod | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py | +| 1615 | CKV_K8S_39 | resource | kubernetes_pod_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py | +| 1616 | CKV_K8S_41 | resource | kubernetes_service_account | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py | +| 1617 | CKV_K8S_41 | resource | kubernetes_service_account_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py | +| 1618 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py | +| 1619 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py | +| 1620 | CKV_K8S_42 | resource | kubernetes_role_binding | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py | +| 1621 | CKV_K8S_42 | resource | kubernetes_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py | +| 1622 | CKV_K8S_43 | resource | kubernetes_deployment | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageDigest.py | +| 1623 | CKV_K8S_43 | resource | kubernetes_deployment_v1 | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageDigest.py | +| 1624 | CKV_K8S_43 | resource | kubernetes_pod | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageDigest.py | +| 1625 | CKV_K8S_43 | resource | kubernetes_pod_v1 | Image should use digest | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/ImageDigest.py | +| 1626 | CKV_K8S_44 | resource | kubernetes_service | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/TillerService.py | +| 1627 | CKV_K8S_44 | resource | kubernetes_service_v1 | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/TillerService.py | +| 1628 | CKV_K8S_49 | resource | kubernetes_cluster_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py | +| 1629 | CKV_K8S_49 | resource | kubernetes_cluster_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py | +| 1630 | CKV_K8S_49 | resource | kubernetes_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py | +| 1631 | CKV_K8S_49 | resource | kubernetes_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py | +| 1632 | CKV_LIN_1 | provider | linode | Ensure no hard coded Linode tokens exist in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/linode/credentials.py | +| 1633 | CKV_LIN_2 | resource | linode_instance | Ensure SSH key set in authorized_keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/authorized_keys.py | +| 1634 | CKV_LIN_3 | resource | linode_user | Ensure email is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/user_email_set.py | +| 1635 | CKV_LIN_4 | resource | linode_user | Ensure username is set | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/user_username_set.py | +| 1636 | CKV_LIN_5 | resource | linode_firewall | Ensure Inbound Firewall Policy is not set to ACCEPT | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/firewall_inbound_policy.py | +| 1637 | CKV_LIN_6 | resource | linode_firewall | Ensure Outbound Firewall Policy is not set to ACCEPT | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/linode/firewall_outbound_policy.py | +| 1638 | CKV_NCP_1 | resource | ncloud_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBTargetGroupDefinesHealthCheck.py | +| 1639 | CKV_NCP_2 | resource | ncloud_access_control_group | Ensure every access control groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py | +| 1640 | CKV_NCP_2 | resource | ncloud_access_control_group_rule | Ensure every access control groups rule has a description | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py | +| 1641 | CKV_NCP_3 | resource | ncloud_access_control_group_rule | Ensure no security group rules allow outbound traffic to 0.0.0.0/0 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupOutboundRule.py | +| 1642 | CKV_NCP_4 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort22.py | +| 1643 | CKV_NCP_5 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort3389.py | +| 1644 | CKV_NCP_6 | resource | ncloud_server | Ensure Server instance is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/ServerEncryptionVPC.py | +| 1645 | CKV_NCP_7 | resource | ncloud_launch_configuration | Ensure Basic Block storage is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LaunchConfigurationEncryptionVPC.py | +| 1646 | CKV_NCP_8 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 20 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLInbound20.py | +| 1647 | CKV_NCP_9 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 21 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLInbound21.py | +| 1648 | CKV_NCP_10 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLInbound22.py | +| 1649 | CKV_NCP_11 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLInbound3389.py | +| 1650 | CKV_NCP_12 | resource | ncloud_network_acl_rule | An inbound Network ACL rule should not allow ALL ports. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NACLPortCheck.py | +| 1651 | CKV_NCP_13 | resource | ncloud_lb_listener | Ensure LB Listener uses only secure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBListenerUsesSecureProtocols.py | +| 1652 | CKV_NCP_14 | resource | ncloud_nas_volume | Ensure NAS is securely encrypted | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NASEncryptionEnabled.py | +| 1653 | CKV_NCP_15 | resource | ncloud_lb_target_group | Ensure Load Balancer Target Group is not using HTTP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBTargetGroupUsingHTTPS.py | +| 1654 | CKV_NCP_16 | resource | ncloud_lb | Ensure Load Balancer isn't exposed to the internet | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBNetworkPrivate.py | +| 1655 | CKV_NCP_19 | resource | ncloud_nks_cluster | Ensure Naver Kubernetes Service public endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NKSPublicAccess.py | +| 1656 | CKV_NCP_22 | resource | ncloud_nks_cluster | Ensure NKS control plane logging enabled for all log types | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/NKSControlPlaneLogging.py | +| 1657 | CKV_NCP_23 | resource | ncloud_public_ip | Ensure Server instance should not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/ServerPublicIP.py | +| 1658 | CKV_NCP_24 | resource | ncloud_lb_listener | Ensure Load Balancer Listener Using HTTPS | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/LBListenerUsingHTTPS.py | +| 1659 | CKV_NCP_25 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort80.py | +| 1660 | CKV_OCI_1 | provider | oci | Ensure no hard coded OCI private key in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/oci/credentials.py | +| 1661 | CKV_OCI_2 | resource | oci_core_volume | Ensure OCI Block Storage Block Volume has backup enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/StorageBlockBackupEnabled.py | +| 1662 | CKV_OCI_3 | resource | oci_core_volume | OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/StorageBlockEncryption.py | +| 1663 | CKV_OCI_4 | resource | oci_core_instance | Ensure OCI Compute Instance boot volume has in-transit data encryption enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/InstanceBootVolumeIntransitEncryption.py | +| 1664 | CKV_OCI_5 | resource | oci_core_instance | Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/InstanceMetadataServiceEnabled.py | +| 1665 | CKV_OCI_6 | resource | oci_core_instance | Ensure OCI Compute Instance has monitoring enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/InstanceMonitoringEnabled.py | +| 1666 | CKV_OCI_7 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage bucket can emit object events | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/ObjectStorageEmitEvents.py | +| 1667 | CKV_OCI_8 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage has versioning enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/ObjectStorageVersioning.py | +| 1668 | CKV_OCI_9 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is encrypted with Customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/ObjectStorageEncryption.py | +| 1669 | CKV_OCI_10 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is not Public | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/ObjectStoragePublic.py | +| 1670 | CKV_OCI_11 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain lower case | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordPolicyLowerCase.py | +| 1671 | CKV_OCI_12 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Numeric characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordPolicyNumeric.py | +| 1672 | CKV_OCI_13 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Special characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordPolicySpecialCharacters.py | +| 1673 | CKV_OCI_14 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Uppercase characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordPolicyUpperCase.py | +| 1674 | CKV_OCI_15 | resource | oci_file_storage_file_system | Ensure OCI File System is Encrypted with a customer Managed Key | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/FileSystemEncryption.py | +| 1675 | CKV_OCI_16 | resource | oci_core_security_list | Ensure VCN has an inbound security list | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityListIngress.py | +| 1676 | CKV_OCI_17 | resource | oci_core_security_list | Ensure VCN inbound security lists are stateless | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityListIngressStateless.py | +| 1677 | CKV_OCI_18 | resource | oci_identity_authentication_policy | OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/IAMPasswordLength.py | +| 1678 | CKV_OCI_19 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 22. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress22.py | +| 1679 | CKV_OCI_20 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 3389. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress3389.py | +| 1680 | CKV_OCI_21 | resource | oci_core_network_security_group_security_rule | Ensure security group has stateless ingress security rules | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/SecurityGroupsIngressStatelessSecurityRules.py | +| 1681 | CKV_OCI_22 | resource | oci_core_network_security_group_security_rule | Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22 | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/oci/AbsSecurityGroupUnrestrictedIngress.py | +| 1682 | CKV2_OCI_1 | resource | oci_identity_group | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1683 | CKV2_OCI_1 | resource | oci_identity_user | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1684 | CKV2_OCI_1 | resource | oci_identity_user_group_membership | Ensure administrator users are not associated with API keys | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/common/graph/checks_infra/base_check.py | +| 1685 | CKV_OPENSTACK_1 | provider | openstack | Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/openstack/credentials.py | +| 1686 | CKV_OPENSTACK_2 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py | +| 1687 | CKV_OPENSTACK_2 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py | +| 1688 | CKV_OPENSTACK_3 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py | +| 1689 | CKV_OPENSTACK_3 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py | +| 1690 | CKV_OPENSTACK_4 | resource | openstack_compute_instance_v2 | Ensure that instance does not use basic credentials | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/ComputeInstanceAdminPassword.py | +| 1691 | CKV_OPENSTACK_5 | resource | openstack_fw_rule_v1 | Ensure firewall rule set a destination IP | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/openstack/FirewallRuleSetDestinationIP.py | +| 1692 | CKV_PAN_1 | provider | panos | Ensure no hard coded PAN-OS credentials exist in provider | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/provider/panos/credentials.py | +| 1693 | CKV_PAN_2 | resource | panos_management_profile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoHTTP.py | +| 1694 | CKV_PAN_3 | resource | panos_management_profile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoTelnet.py | +| 1695 | CKV_PAN_4 | resource | panos_security_policy | Ensure DSRI is not enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoDSRI.py | +| 1696 | CKV_PAN_4 | resource | panos_security_rule_group | Ensure DSRI is not enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoDSRI.py | +| 1697 | CKV_PAN_5 | resource | panos_security_policy | Ensure security rules do not have 'applications' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py | +| 1698 | CKV_PAN_5 | resource | panos_security_rule_group | Ensure security rules do not have 'applications' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py | +| 1699 | CKV_PAN_6 | resource | panos_security_policy | Ensure security rules do not have 'services' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py | +| 1700 | CKV_PAN_6 | resource | panos_security_rule_group | Ensure security rules do not have 'services' set to 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py | +| 1701 | CKV_PAN_7 | resource | panos_security_policy | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py | +| 1702 | CKV_PAN_7 | resource | panos_security_rule_group | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py | +| 1703 | CKV_PAN_8 | resource | panos_security_policy | Ensure description is populated within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyDescription.py | +| 1704 | CKV_PAN_8 | resource | panos_security_rule_group | Ensure description is populated within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyDescription.py | +| 1705 | CKV_PAN_9 | resource | panos_security_policy | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyLogForwarding.py | +| 1706 | CKV_PAN_9 | resource | panos_security_rule_group | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyLogForwarding.py | +| 1707 | CKV_PAN_10 | resource | panos_security_policy | Ensure logging at session end is enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py | +| 1708 | CKV_PAN_10 | resource | panos_security_rule_group | Ensure logging at session end is enabled within security policies | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py | +| 1709 | CKV_PAN_11 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py | +| 1710 | CKV_PAN_11 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py | +| 1711 | CKV_PAN_12 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py | +| 1712 | CKV_PAN_12 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py | +| 1713 | CKV_PAN_13 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py | +| 1714 | CKV_PAN_13 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py | +| 1715 | CKV_PAN_14 | resource | panos_panorama_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py | +| 1716 | CKV_PAN_14 | resource | panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py | +| 1717 | CKV_PAN_14 | resource | panos_zone_entry | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py | +| 1718 | CKV_PAN_15 | resource | panos_panorama_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py | +| 1719 | CKV_PAN_15 | resource | panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py | +| 1720 | CKV_YC_1 | resource | yandex_mdb_clickhouse_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1721 | CKV_YC_1 | resource | yandex_mdb_elasticsearch_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1722 | CKV_YC_1 | resource | yandex_mdb_greenplum_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1723 | CKV_YC_1 | resource | yandex_mdb_kafka_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1724 | CKV_YC_1 | resource | yandex_mdb_mongodb_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1725 | CKV_YC_1 | resource | yandex_mdb_mysql_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1726 | CKV_YC_1 | resource | yandex_mdb_postgresql_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1727 | CKV_YC_1 | resource | yandex_mdb_redis_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1728 | CKV_YC_1 | resource | yandex_mdb_sqlserver_cluster | Ensure security group is assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py | +| 1729 | CKV_YC_2 | resource | yandex_compute_instance | Ensure compute instance does not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeVMPublicIP.py | +| 1730 | CKV_YC_3 | resource | yandex_storage_bucket | Ensure storage bucket is encrypted. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketEncryption.py | +| 1731 | CKV_YC_4 | resource | yandex_compute_instance | Ensure compute instance does not have serial console enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeVMSerialConsole.py | +| 1732 | CKV_YC_5 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster does not have public IP address. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SPublicIP.py | +| 1733 | CKV_YC_6 | resource | yandex_kubernetes_node_group | Ensure Kubernetes cluster node group does not have public IP addresses. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupPublicIP.py | +| 1734 | CKV_YC_7 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster auto-upgrade is enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SAutoUpgrade.py | +| 1735 | CKV_YC_8 | resource | yandex_kubernetes_node_group | Ensure Kubernetes node group auto-upgrade is enabled. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupAutoUpgrade.py | +| 1736 | CKV_YC_9 | resource | yandex_kms_symmetric_key | Ensure KMS symmetric key is rotated. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/KMSSymmetricKeyRotation.py | +| 1737 | CKV_YC_10 | resource | yandex_kubernetes_cluster | Ensure etcd database is encrypted with KMS key. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SEtcdKMSEncryption.py | +| 1738 | CKV_YC_11 | resource | yandex_compute_instance | Ensure security group is assigned to network interface. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeVMSecurityGroup.py | +| 1739 | CKV_YC_12 | resource | yandex_mdb_clickhouse_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 1740 | CKV_YC_12 | resource | yandex_mdb_elasticsearch_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 1741 | CKV_YC_12 | resource | yandex_mdb_greenplum_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 1742 | CKV_YC_12 | resource | yandex_mdb_kafka_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 1743 | CKV_YC_12 | resource | yandex_mdb_mongodb_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 1744 | CKV_YC_12 | resource | yandex_mdb_mysql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 1745 | CKV_YC_12 | resource | yandex_mdb_postgresql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 1746 | CKV_YC_12 | resource | yandex_mdb_sqlserver_cluster | Ensure public IP is not assigned to database cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py | +| 1747 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure cloud member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py | +| 1748 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_member | Ensure cloud member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py | +| 1749 | CKV_YC_14 | resource | yandex_kubernetes_cluster | Ensure security group is assigned to Kubernetes cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SSecurityGroup.py | +| 1750 | CKV_YC_15 | resource | yandex_kubernetes_node_group | Ensure security group is assigned to Kubernetes node group. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupSecurityGroup.py | +| 1751 | CKV_YC_16 | resource | yandex_kubernetes_cluster | Ensure network policy is assigned to Kubernetes cluster. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/K8SNetworkPolicy.py | +| 1752 | CKV_YC_17 | resource | yandex_storage_bucket | Ensure storage bucket does not have public access permissions. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketPublicAccess.py | +| 1753 | CKV_YC_18 | resource | yandex_compute_instance_group | Ensure compute instance group does not have public IP. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupPublicIP.py | +| 1754 | CKV_YC_19 | resource | yandex_vpc_security_group | Ensure security group does not contain allow-all rules. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupAllowAll.py | +| 1755 | CKV_YC_20 | resource | yandex_vpc_security_group_rule | Ensure security group rule is not allow-all. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupRuleAllowAll.py | +| 1756 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_binding | Ensure organization member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py | +| 1757 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_member | Ensure organization member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py | +| 1758 | CKV_YC_22 | resource | yandex_compute_instance_group | Ensure compute instance group has security group assigned. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupSecurityGroup.py | +| 1759 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_binding | Ensure folder member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py | +| 1760 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_member | Ensure folder member does not have elevated access. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py | +| 1761 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 1762 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 1763 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 1764 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 1765 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | +| 1766 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py | ---