Terraform Policy Library Rules
AWS: AutoScaling Group: Deny public IP address in launch configuration
Prohibit creation of autoscaling group if the launch configuration used has public IP address enabled.
Parameters
None
AWS: CloudFront: Prohibit CloudFront distributions without a default root object.
Requires AWS/CloudFront distributions to be configured with a default root object.
Parameters
None
AWS: CloudFront: Prohibit CloudFront distributions without access logging
Requires AWS/CloudFront distributions to be configured with access logging.
Parameters
None
Requires AWS/CloudFront distributions to be configured with encrypted traffic to origin.
Requires AWS/CloudFront distributions to be configured with access logging. Prohibits 'origin_protocol_policy' set to 'http-only' and prohibits 'origin_protocol_policy' set to 'match-viewer' if 'viewer_protocol_policy' is set to 'allow-all'.
Parameters
None
AWS: CloudFront: Prohibit CloudFront distributions without an HTTPS viewer protocol policy
Requires AWS/CloudFront distribution default and ordered cache behaviors to be configured with an 'https-only' or 'redirect-to-https' viewer_protocol_policy.
Parameters
None
AWS: CloudFront: Prohibit CloudFront distributions without a WAF association
Requires AWS/CloudFront distributions to be configured with a WAF web ACL ID.
Parameters
None
AWS: CloudTrail: Prohibit CloudTrails without server side encryption
Require AWS/Cloudtrail to have server side encryption using an AWS KMS key.
Parameters
None
AWS: CodeBuild Project: Prohibit if logging is not configured
Require CodeBuild Projects to have 'logs_config' with either s3_logs or 'cloudwatch_logs' enabled.
Parameters
None
AWS: Codebuild Project: Prohibit Privileged Mode enabled.
Require CodeBuild Projects environment config to have 'privileged_mode' set to false.
Parameters
None
AWS: DAX: Prohibit DAX clusters with disabled encryption at rest
Require AWS/DAX clusters to have enabled encryption at rest.
Parameters
None
AWS: DMS: Prohibit publicly accessible DMS replication instances
Require AWS/DMS replication instances to not be publicly accessible.
Parameters
None
AWS: EC2/EBS: Requires volumes to have a snapshot.
Ensure individually created EBS volumes have at least one associated snapshot.
Parameters
None
AWS: EC2: Ensure the EBS volumes are encrypted
Require individually created EBS volumes to be encrypted.
Parameters
None
AWS: EC2: Prohibit EC2 instances with a Public IP Address
Require AWS/EC2 instance to not have a Public IP Address.
Parameters
None
AWS: EC2: Restrict volume deletion after instance termination
Prevent volume being deleted after the termination of EC2 instance.
Parameters
None
AWS: EC2: Restrict instances with unapproved AMIs
Require EC2 instances to use an AMI from a pre-approved list.
Parameters
-
Parameters:
-
allowed_ami_ids: A list of AMI IDs (e.g., ami-830c94e3, ami-0022c769)
- Type: set_of_strings
- Unique: false
- Required: true
-
-
Required Parameters: allowed_ami_ids
AWS: EC2: Restrict instances with unapproved Regions
Require EC2 instances to use an AWS Region from a pre-approved list.
Parameters
-
Parameters:
-
allowed_regions: A list of AWS regions (eg., us-east-1, us-west-2)
- Type: set_of_strings
- Unique: false
- Required: true
-
-
Required Parameters: allowed_regions
AWS: EC2: Restrict instances with unapproved subnets
Require EC2 instances to use a subnet from a pre-approved list.
Parameters
-
Parameters:
-
allowed_subnets: A list of subnet IDs (e.g., subnet-012, subnet-890)
- Type: set_of_strings
- Unique: false
- Required: true
-
-
Required Parameters: allowed_subnets
AWS: EC2: Restrict instances with unapproved Security Groups
Require AWS/EC2 to use Security Groups from a pre-approved list.
Parameters
-
Parameters:
-
allowed_security_groups: A list of Security Groups (e.g., sg-830c94e3, sg-0022c769)
- Type: set_of_strings
- Unique: false
- Required: true
-
-
Required Parameters: allowed_security_groups
AWS: EC2: Ensure the instances use encrypted volume.
Require AWS/EC2 instances to use encrypted block storage volume.
Parameters
None
AWS: EC2: Restrict instances without IMDSv2
EC2 instances and EC2 Launch templates require Instance Metadata Service Version 2 (IMDSv2) enabled.
Parameters
None
AWS: EC2: Prohibit EC2 instances without a VPC
Require AWS/EC2 instances to be deployed in a dedicated VPC with specified security group IDs
Parameters
None
AWS: ECS: Prohibit ECS Service which has Assign Public IP enabled
Require AWS/ECS Service to have 'assign_public_ip' set as false in 'network_configuration'.
Parameters
None
AWS: Elastic Beanstalk: Prohibit the Elastic beanstalk environments with disabled managed actions
Require AWS/Elastic Beanstalk environments to have the managed actions setting enabled.
Parameters
None
AWS: Elasticsearch: Prohibit Elasticsearch Domains with disabled encryption at rest
Require AWS/Elasticsearch domains to have enabled encryption at rest.
Parameters
None
AWS: Elasticsearch: Prohibit Elasticsearch Domains not created in VPC
Require AWS/Elasticsearch domains to have subnets added in vpc_options.
Parameters
None
AWS: Elasticsearch: Prohibit Elasticsearch Domains which does not use TLS 1.2 and have https enforced.
Require AWS/Elasticsearch domains to have https enforced and use TLS 1.2.
Parameters
None
AWS: Elasticsearch: Prohibit Elasticsearch Domains with disabled node to node encryption
Require AWS/Elasticsearch domains to have enabled node to node encryption.
Parameters
None
AWS: ELB: Prohibit Elastic Load Balancers with listener's lb_protocol not set to SSL/HTTPS
Requires AWS/ELB listeners to be configured with lb_protocol as either SSL or HTTPS.
Parameters
None
AWS: ELB: Prohibit Elastic Load Balancers with connection draining not set to true
Requires AWS/ELB listeners to be configured with connection_draining as true.
Parameters
None
AWS: GuardDuty: Block GuardDuty organization with disabled GuardDuty detector
Require GuardDuty Detector to be enabled for a GuardDuty Organiztion.
Parameters
None
AWS: IAM: Ensure IAM account has Complex and Unique password policy
Require AWS/IAM account to have complex and unique password policy. As recommended by https://attack.mitre.org/techniques/T1110/ the standards here are based off of those established in https://pages.nist.gov/800-63-3/sp800-63b.html#appA and https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=6234434
Parameters
None
AWS: IAM: Ensure IAM account password policy meets AWS Foundational Security Best Practices
Require AWS/IAM account to have complex and unique password policy. As recommended by https://docs.aws.amazon.com/config/latest/developerguide/iam-password-policy.html
Parameters
None
AWS: IAM: Restrict Access Key Actions in IAM policies
Require AWS/IAM user/group/role policies to not have Create/Update/List/Delete AccessKeys permissions and allow all ('iam:' or '') in 'Action'.
Parameters
None
AWS: IAM: Restrict hardcoded secret credentials.
Hardcoding of AWS 'access_key' and 'secret_key' in Terraform files is prohibited.
Parameters
None
AWS: IAM: Prohibit IAM policies directly being attached to IAM users
Requires AWS/IAM policies not to be attached directly to IAM users.
Parameters
None
AWS: IAM: Prohibit Policies containing an Asterisk
Require AWS/IAM policies not have an asterisk ("") in Actions nor asterisk ("") without prefix in Resources.
Parameters
None
KICS: ALB Deletion Protection Disabled
Application Load Balancer should have deletion protection enabled
Parameters
None
KICS: ALB Is Not Integrated With WAF
All Application Load Balancers (ALB) must be protected with Web Application Firewall (WAF) service
Parameters
None
KICS: ALB Listening on HTTP
AWS Application Load Balancer (alb) should not listen on HTTP
Parameters
None
KICS: ALB Not Dropping Invalid Headers
It's considered a best practice when using Application Load Balancers to drop invalid header fields
Parameters
None
KICS: AmazonMQ Broker Encryption Disabled
AmazonMQ Broker should have Encryption Options defined
Parameters
None
KICS: AMI Not Encrypted
AWS AMI Encryption is not enabled
Parameters
None
KICS: AMI Shared With Multiple Accounts
Limits access to AWS AMIs by checking if more than one account is using the same image
Parameters
None
KICS: API Gateway Access Logging Disabled
API Gateway should have Access Log Settings defined
Parameters
None
KICS: API Gateway Deployment Without Access Log Setting
API Gateway Deployment should have access log setting defined when connected to an API Gateway Stage.
Parameters
None
KICS: API Gateway Deployment Without API Gateway UsagePlan Associated
API Gateway Deployment should have API Gateway UsagePlan defined and associated.
Parameters
None
KICS: API Gateway Endpoint Config is Not Private
The API Endpoint type in API Gateway should be set to PRIVATE so it's not exposed to the public internet
Parameters
None
KICS: API Gateway Method Does Not Contains An API Key
An API Key should be required on a method request.
Parameters
None
KICS: API Gateway Method Settings Cache Not Encrypted
API Gateway Method Settings Cache should be encrypted
Parameters
None
KICS: API Gateway Stage Without API Gateway UsagePlan Associated
API Gateway Stage should have API Gateway UsagePlan defined and associated.
Parameters
None
KICS: API Gateway With CloudWatch Logging Disabled
AWS CloudWatch Logs for APIs should be enabled and using the naming convention described in documentation
Parameters
None
KICS: API Gateway With Invalid Compression
API Gateway should have valid compression, which means attribute 'minimum_compression_size' should be set and its value should be greater than -1 and smaller than 10485760.
Parameters
None
KICS: API Gateway With Open Access
API Gateway Method should restrict the authorization type, except for the HTTP OPTIONS method.
Parameters
None
KICS: API Gateway Without Configured Authorizer
API Gateway REST API should have an API Gateway Authorizer
Parameters
None
KICS: API Gateway Without Security Policy
API Gateway should have a Security Policy defined and use TLS 1.2.
Parameters
None
KICS: API Gateway Without SSL Certificate
SSL Client Certificate should be enabled
Parameters
None
KICS: API Gateway without WAF
API Gateway should have WAF (Web Application Firewall) enabled
Parameters
None
KICS: API Gateway X-Ray Disabled
API Gateway should have X-Ray Tracing enabled
Parameters
None
KICS: Athena Database Not Encrypted
AWS Athena Database data in S3 should be encrypted
Parameters
None
KICS: Athena Workgroup Not Encrypted
Athena Workgroup query results should be encrypted, for all queries that run in the workgroup
Parameters
None
KICS: Authentication Without MFA
Users should authenticate with MFA (Multi-factor Authentication) to ensure an extra layer of protection when authenticating
Parameters
None
KICS: Auto Scaling Group With No Associated ELB
AWS Auto Scaling Groups must have associated ELBs to ensure high availability and improve application performance. This means the attribute 'load_balancers' must be defined and not empty.
Parameters
None
KICS: Automatic Minor Upgrades Disabled
RDS instance should have automatic minor upgrades enabled, which means the attribute 'auto_minor_version_upgrade' must be set to true.
Parameters
None
KICS: Autoscaling Groups Supply Tags
Autoscaling groups should supply tags to configurate
Parameters
None
KICS: AWS Password Policy With Unchangeable Passwords
Unchangeable passwords in AWS password policy
Parameters
None
KICS: Batch Job Definition With Privileged Container Properties
Batch Job Definition should not have Privileged Container Properties
Parameters
None
KICS: CA Certificate Identifier Is Outdated
The CA certificate Identifier must be 'rds-ca-2019'.
Parameters
None
KICS: CDN Configuration Is Missing
Content Delivery Network (CDN) service is used within an AWS account to secure and accelerate the delivery of websites. The use of a CDN can provide a layer of security between your origin content and the destination.
Parameters
None
KICS: Certificate Has Expired
Expired SSL/TLS certificates should be removed
Parameters
None
KICS: Certificate RSA Key Bytes Lower Than 256
The certificate should use a RSA key with a length equal to or higher than 256 bytes
Parameters
None
KICS: CloudFront Logging Disabled
AWS CloudFront distributions should have logging enabled to collect all viewer requests, which means the attribute 'logging_config' should be defined
Parameters
None
KICS: Cloudfront Viewer Protocol Policy Allows HTTP
Checks if the connection between CloudFront and the viewer is encrypted
Parameters
None
KICS: CloudFront Without Minimum Protocol TLS 1.2
CloudFront Minimum Protocol version should be at least TLS 1.2
Parameters
None
KICS: CloudFront Without WAF
All AWS CloudFront distributions should be integrated with the Web Application Firewall (AWS WAF) service
Parameters
None
KICS: CloudTrail Log File Validation Disabled
CloudTrail log file validation should be enabled to determine whether a log file has not been tampered
Parameters
None
KICS: CloudTrail Log Files Not Encrypted With KMS
Logs delivered by CloudTrail should be encrypted using KMS to increase security of your CloudTrail
Parameters
None
KICS: CloudTrail Log Files S3 Bucket is Publicly Accessible
CloudTrail Log Files S3 Bucket should not be publicly accessible
Parameters
None
KICS: CloudTrail Log Files S3 Bucket with Logging Disabled
CloudTrail Log Files S3 Bucket should have 'logging' enabled
Parameters
None
KICS: CloudTrail Logging Disabled
Checks if logging is enabled for CloudTrail.
Parameters
None
KICS: CloudTrail Multi Region Disabled
CloudTrail multi region should be enabled, which means attributes 'is_multi_region_trail' and 'include_global_service_events' should be enabled
Parameters
None
KICS: CloudTrail Not Integrated With CloudWatch
CloudTrail should be integrated with CloudWatch
Parameters
None
KICS: CloudTrail SNS Topic Name Undefined
Check if SNS topic name is set for CloudTrail
Parameters
None
KICS: CloudWatch AWS Config Configuration Changes Alarm Missing
Ensure a log metric filter and alarm exist for AWS Config configuration changes
Parameters
None
KICS: CloudWatch AWS Organizations Changes Missing Alarm
Ensure a log metric filter and alarm exist for AWS organizations changes
Parameters
None
KICS: CloudWatch Changes To NACL Alarm Missing
Ensure a log metric filter and alarm exist for changes to NACL
Parameters
None
KICS: Cloudwatch Cloudtrail Configuration Changes Alarm Missing
Ensure a log metric filter and alarm exist for CloudTrail configuration changes
Parameters
None
KICS: CloudWatch Disabling Or Scheduled Deletion Of Customer Created CMK Alarm Missing
Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMK
Parameters
None
KICS: CloudWatch IAM Policy Changes Alarm Missing
Ensure a log metric filter and alarm exist for IAM policy changes
Parameters
None
KICS: CloudWatch Log Group Without KMS
AWS CloudWatch Log groups should be encrypted using KMS
Parameters
None
KICS: CloudWatch Logging Disabled
Check if CloudWatch logging is disabled for Route53 hosted zones
Parameters
None
KICS: CloudWatch Logs Destination With Vulnerable Policy
CloudWatch Logs destination policy should avoid wildcard in 'principals' and 'actions'
Parameters
None
KICS: CloudWatch Management Console Auth Failed Alarm Missing
Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
Parameters
None
KICS: CloudWatch Console Sign-in Without MFA Alarm Missing
Ensure a log metric filter and alarm exist for management console sign-in without MFA
Parameters
None
KICS: CloudWatch Metrics Disabled
Checks if CloudWatch Metrics is Enabled
Parameters
None
KICS: CloudWatch Network Gateways Changes Alarm Missing
Ensure a log metric filter and alarm exist for network gateways changes
Parameters
None
KICS: CloudWatch Root Account Use Missing
Ensure a log metric filter and alarm exist for root acount usage
Parameters
None
KICS: CloudWatch Route Table Changes Alarm Missing
Ensure a log metric filter and alarm exist for route table changes
Parameters
None
KICS: CloudWatch S3 policy Change Alarm Missing
Ensure a log metric filter and alarm exist for S3 bucket policy changes
Parameters
None
KICS: Cloudwatch Security Group Changes Alarm Missing
Ensure a log metric filter and alarm exist for security group changes
Parameters
None
KICS: CloudWatch Unauthorized Access Alarm Missing
Ensure a log metric filter and alarm exist for unauthorized API calls
Parameters
None
KICS: CloudWatch VPC Changes Alarm Missing
Ensure a log metric filter and alarm exist for VPC changes
Parameters
None
KICS: CloudWatch Without Retention Period Specified
AWS CloudWatch Log groups should have retention days specified
Parameters
None
KICS: CMK Is Unusable
AWS Key Management Service (KMS) must only possess usable Customer Master Keys (CMK), which means the CMKs must have the attribute 'is_enabled' set to true
Parameters
None
KICS: CMK Rotation Disabled
Customer Master Keys (CMK) must have rotation enabled, which means the attribute 'enable_key_rotation' must be set to 'true' when the key is enabled.
Parameters
None
KICS: CodeBuild Project Encrypted With AWS Managed Key
CodeBuild Project should be encrypted with customer-managed KMS keys instead of AWS managed keys
Parameters
None
KICS: Cognito UserPool Without MFA
AWS Cognito UserPool should have MFA (Multi-Factor Authentication) defined to users
Parameters
None
KICS: Configuration Aggregator to All Regions Disabled
AWS Config Configuration Aggregator All Regions must be set to True
Parameters
None
KICS: Config Rule For Encrypted Volumes Disabled
Check if AWS config rules do not identify Encrypted Volumes as a source.
Parameters
None
KICS: Cross-Account IAM Assume Role Policy Without ExternalId or MFA
Cross-Account IAM Assume Role Policy should require external ID or MFA to protect cross-account access
Parameters
None
KICS: DAX Cluster Not Encrypted
AWS DAX Cluster should have server-side encryption at rest
Parameters
None
KICS: DB Instance Publicly Accessible
RDS must not be defined with public interface, which means the field 'publicly_accessible' should not be set to 'true' (default is 'false').
Parameters
None
KICS: DB Instance Storage Not Encrypted
AWS DB Instance should have its storage encrypted by setting the parameter to 'true'. The storage_encrypted default value is 'false'.
Parameters
None
KICS: DB Security Group Has Public Interface
The CIDR IP should not be a public interface
Parameters
None
KICS: DB Security Group Open To Large Scope
The IP address in a DB Security Group must not have more than 256 hosts.
Parameters
None
KICS: DB Security Group With Public Scope
The IP address in a DB Security Group should not be '0.0.0.0/0' (IPv4) or '::/0' (IPv6). If so, any IP can access it
Parameters
None
KICS: Default Security Groups With Unrestricted Traffic
Check if default security group does not restrict all inbound and outbound traffic.
Parameters
None
KICS: Default VPC Exists
It isn't recommended to use resources in default VPC
Parameters
None
KICS: DOCDB Cluster Encrypted With AWS Managed Key
DOCDB Cluster should be encrypted with customer-managed KMS keys instead of AWS managed keys
Parameters
None
KICS: DOCDB Cluster Not Encrypted
AWS DOCDB Cluster storage should be encrypted
Parameters
None
KICS: DOCDB Cluster Without KMS
AWS DOCDB Cluster should be encrypted with a KMS encryption key
Parameters
None
KICS: DocDB Logging Is Disabled
DocDB logging should be enabled
Parameters
None
KICS: DynamoDB Table Not Encrypted
AWS DynamoDB Tables should have server-side encryption
Parameters
None
KICS: DynamoDB Table Point In Time Recovery Disabled
It's considered a best practice to have point in time recovery enabled for DynamoDB Table
Parameters
None
KICS: Dynamodb VPC Endpoint Without Route Table Association
Dynamodb VPC Endpoint should be associated with Route Table Association
Parameters
None
KICS: EBS Default Encryption Disabled
EBS Encryption should be enabled
Parameters
None
KICS: EBS Volume Encryption Disabled
EBS volumes should be encrypted
Parameters
None
KICS: EBS Volume Snapshot Not Encrypted
The value on AWS EBS Volume Snapshot Encryptation must be true
Parameters
None
KICS: EC2 Instance Has Public IP
EC2 Instance should not have a public IP address.
Parameters
None
KICS: EC2 Instance Monitoring Disabled
EC2 Instance should have detailed monitoring enabled. With detailed monitoring enabled data is available in 1-minute periods
Parameters
None
KICS: EC2 Instance Using API Keys
EC2 instances should use roles to be granted access to other AWS services
Parameters
None
KICS: EC2 Instance Using Default Security Group
EC2 instances should not use default security group(s)
Parameters
None
KICS: EC2 Instance Using Default VPC
EC2 Instances should not be configured under a default VPC network
Parameters
None
KICS: EC2 Not EBS Optimized
It's considered a best practice for an EC2 instance to use an EBS optimized instance. This provides the best performance for your EBS volumes by minimizing contention between Amazon EBS I/O and other traffic from your instance
Parameters
None
KICS: ECR Image Tag Not Immutable
ECR should have an image tag be immutable. This prevents image tags from being overwritten.
Parameters
None
KICS: ECR Repository Is Publicly Accessible
Amazon ECR image repositories shouldn't have public access
Parameters
None
KICS: ECR Repository Not Encrypted With CMK
ECR repositories should be encrypted with customer-managed keys to meet stricter security and compliance requirements on access control, monitoring, and key rotation
Parameters
None
KICS: ECR Repository Without Policy
ECR Repository should have Policies attached to it
Parameters
None
KICS: ECS Cluster with Container Insights Disabled
ECS Cluster should enable container insights
Parameters
None
KICS: ECS Service Admin Role Is Present
ECS Services must not have Admin roles, which means the attribute 'iam_role' must not be an admin role
Parameters
None
KICS: ECS Service Without Running Tasks
ECS Service should have at least 1 task running
Parameters
None
KICS: ECS Task Definition Network Mode Not Recommended
Network_Mode should be 'awsvpc' in ecs_task_definition. AWS VPCs provides the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurations
Parameters
None
KICS: ECS Task Definition Volume Not Encrypted
AWS ECS Task Definition EFS data in transit between AWS ECS host and AWS EFS server should be encrypted
Parameters
None
KICS: ECS Task Definition Container With Plaintext Password
It's not recommended to use plaintext environment variables for sensitive information, such as credential data.
Parameters
None
KICS: EFS Not Encrypted
Elastic File System (EFS) must be encrypted
Parameters
None
KICS: EFS With Vulnerable Policy
EFS (Elastic File System) policy should avoid wildcard in 'Action' and 'Principal'.
Parameters
None
KICS: EFS Without KMS
Amazon Elastic Filesystem should have filesystem encryption enabled using KMS CMK customer-managed keys instead of AWS managed-keys
Parameters
None
KICS: EKS Cluster Encryption Disabled
EKS Cluster should be encrypted
Parameters
None
KICS: EKS Cluster Has Public Access
Amazon EKS public endpoint shoud be set to false
Parameters
None
KICS: EKS Cluster Has Public Access CIDRs
Amazon EKS public endpoint is enables and accessible to all: 0.0.0.0/0"
Parameters
None
KICS: EKS cluster logging is not enabled
Amazon EKS control plane logging is not enabled
Parameters
None
KICS: EKS node group remote access disabled
EKS node group remote access is disabled when 'SourceSecurityGroups' is missing
Parameters
None
KICS: ElastiCache Nodes Not Created Across Multi AZ
ElastiCache Nodes should be created across multi az, which means 'az_mode' should be set to 'cross-az' in multi nodes cluster
Parameters
None
KICS: ElastiCache Redis Cluster Without Backup
ElastiCache Redis cluster should have 'snapshot_retention_limit' higher than 0
Parameters
None
KICS: ElastiCache Replication Group Not Encrypted At Rest
ElastiCache Replication Group encryption should be enabled at Rest
Parameters
None
KICS: ElastiCache Replication Group Not Encrypted At Transit
ElastiCache Replication Group encryption should be enabled at Transit
Parameters
None
KICS: ElastiCache Using Default Port
ElastiCache should not use the default port (an attacker can easily guess the port). For engine set to Redis, the default port is 6379. The Memcached default port is 11211
Parameters
None
KICS: ElastiCache Without VPC
ElastiCache should be launched in a Virtual Private Cloud (VPC)
Parameters
None
KICS: Elasticsearch Domain Not Encrypted Node To Node
Elasticsearch Domain encryption should be enabled node to node
Parameters
None
KICS: Elasticsearch Domain With Vulnerable Policy
Elasticsearch Domain policy should avoid wildcard in 'Action' and 'Principal'.
Parameters
None
KICS: ElasticSearch Encryption With KMS Disabled
Check if any ElasticSearch domain isn't encrypted with KMS.
Parameters
None
KICS: Elasticsearch Log Disabled
AWS Elasticsearch should have logs enabled
Parameters
None
KICS: ElasticSearch Not Encrypted At Rest
Check if ElasticSearch encryption is disabled at Rest
Parameters
None
KICS: Elasticsearch Without IAM Authentication
AWS Elasticsearch should ensure IAM Authentication
Parameters
None
KICS: ElasticSearch Without Slow Logs
Ensure that AWS Elasticsearch enables support for slow logs
Parameters
None
KICS: ELB Access Log Disabled
ELB should have logging enabled to help on error investigation
Parameters
None
KICS: ELB Using Insecure Protocols
ELB Predefined or Custom Security Policies must not use insecure protocols, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the 'name' of 'policy_attributes' must not coincide with any of a predefined list of insecure protocols.
Parameters
None
KICS: ELB Using Weak Ciphers
ELB Predefined or Custom Security Policies must not use weak ciphers, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the 'name' of 'policy_attributes' must not coincide with any of a predefined list of weak ciphers.
Parameters
None
KICS: EMR Without VPC
Elastic MapReduce Cluster (EMR) should be launched in a Virtual Private Cloud (VPC)
Parameters
None
KICS: Global Accelerator Flow Logs Disabled
Global Accelerator should have flow logs enabled
Parameters
None
KICS: Glue Data Catalog Encryption Disabled
Glue Data Catalog Encryption Settings should have 'connection_password_encryption' and 'encryption_at_rest' enabled
Parameters
None
KICS: Glue Security Configuration Encryption Disabled
Glue Security Configuration Encryption should have 'cloudwatch_encryption', 'job_bookmarks_encryption' and 's3_encryption' enabled
Parameters
None
KICS: Glue With Vulnerable Policy
Glue policy should avoid wildcard in 'principals' and 'actions'
Parameters
None
KICS: Group With Privilege Escalation By Actions 'glue:UpdateDevEndpoint'
Group with privilege escalation by actions 'glue:UpdateDevEndpoint' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:AddUserToGroup'
Group with privilege escalation by actions 'iam:AddUserToGroup' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:AttachGroupPolicy'
Group with privilege escalation by actions 'iam:AttachGroupPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:AttachRolePolicy'
Group with privilege escalation by actions 'iam:AttachRolePolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:AttachUserPolicy'
Group with privilege escalation by actions 'iam:AttachUserPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:CreateAccessKey'
Group with privilege escalation by actions 'iam:CreateAccessKey' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:CreateLoginProfile'
Group with privilege escalation by actions 'iam:CreateLoginProfile' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:CreatePolicyVersion'
Group with privilege escalation by actions 'iam:CreatePolicyVersion' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'cloudformation:CreateStack' And 'iam:PassRole'
Group with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'ec2:RunInstances' And 'iam:PassRole'
Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'glue:CreateDevEndpoint' And 'iam:PassRole'
Group with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'lambda:CreateFunction' And 'iam:PassRole' And 'lambda:InvokeFunction'
Group with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:PutGroupPolicy'
Group with privilege escalation by actions 'iam:PutGroupPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:PutRolePolicy'
Group with privilege escalation by actions 'iam:PutRolePolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:PutUserPolicy'
Group with privilege escalation by actions 'iam:PutUserPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:SetDefaultPolicyVersion'
Group with privilege escalation by actions 'iam:SetDefaultPolicyVersion' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole'
Group with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'iam:UpdateLoginProfile'
Group with privilege escalation by actions 'iam:UpdateLoginProfile' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Group With Privilege Escalation By Actions 'lambda:UpdateFunctionCode'
Group with privilege escalation by actions 'lambda:UpdateFunctionCode' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: GuardDuty Detector Disabled
Make sure that Amazon GuardDuty is Enabled
Parameters
None
KICS: Hardcoded AWS Access Key
AWS Access Key should not be hardcoded
Parameters
None
KICS: Hardcoded AWS Access Key In Lambda
Lambda access/secret keys should not be hardcoded
Parameters
None
KICS: HTTP Port Open To Internet
The HTTP port is open to the internet in a Security Group
Parameters
None
KICS: IAM Access Analyzer Not Enabled
IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
Parameters
None
KICS: IAM Access Key Is Exposed
IAM Access Key should not be active for root users
Parameters
None
KICS: IAM Database Auth Not Enabled
IAM Database Auth Enabled should be configured to true when using compatible engine and version
Parameters
None
KICS: IAM Group Without Users
IAM Group should have at least one user associated
Parameters
None
KICS: IAM Password Without Lowercase Letter
IAM Password should have at least one lowercase letter
Parameters
None
KICS: IAM Password Without Minimum Length
IAM password should have the required minimum length
Parameters
None
KICS: IAM Password Without Symbol
IAM password should have the required symbols
Parameters
None
KICS: IAM Password Without Uppercase Letter
IAM password should have at least one uppercase letter
Parameters
None
KICS: IAM Policies Attached To User
IAM policies should be attached only to groups or roles
Parameters
None
KICS: IAM Policies With Full Privileges
IAM policies shouldn't allow full administrative privileges (for all resources)
Parameters
None
KICS: IAM Policy Grants 'AssumeRole' Permission Across All Services
IAM Policy should not grant 'AssumeRole' permission across all services.
Parameters
None
KICS: IAM Policy Grants Full Permissions
IAM policy should not grant full permissions to resources from the get-go, instead of granting permissions gradually as necessary.
Parameters
None
KICS: IAM Role Allows All Principals To Assume
IAM role allows all services or principals to assume it
Parameters
None
KICS: IAM Role Policy passRole Allows All
Using the iam:passrole action with wildcards (*) in the resource can be overly permissive because it allows iam:passrole permissions on multiple resources
Parameters
None
KICS: IAM Role With Full Privileges
IAM role policy that allow full administrative privileges (for all resources)
Parameters
None
KICS: IAM User Policy Without MFA
Check if the root user is authenticated with MFA
Parameters
None
KICS: IAM User Has Too Many Access Keys
Any IAM User should not have more than one access key since it increases the risk of unauthorized access and compromise credentials
Parameters
None
KICS: IAM User With Access To Console
AWS IAM Users should not have access to console
Parameters
None
KICS: Instance With No VPC
EC2 Instances should be configured under a VPC network. AWS VPCs provide the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurations.
Parameters
None
KICS: Kinesis Not Encrypted With KMS
AWS Kinesis Streams and metadata should be protected with KMS
Parameters
None
KICS: Kinesis SSE Not Configured
AWS Kinesis Server data at rest should have Server Side Encryption (SSE) enabled
Parameters
None
KICS: KMS Key With No Deletion Window
AWS KMS Key should have a valid deletion window
Parameters
None
KICS: KMS Key With Vulnerable Policy
Checks if the policy is vulnerable and needs updating.
Parameters
None
KICS: Lambda Function With Privileged Role
It is not advisable for AWS Lambda Functions to have privileged permissions.
Parameters
None
KICS: Lambda Functions Without X-Ray Tracing
AWS Lambda functions should have TracingConfig enabled. For this, property 'tracing_Config.mode' should have the value 'Active'
Parameters
None
KICS: Lambda IAM InvokeFunction Misconfigured
Lambda permission may be misconfigured if the action field is not filled in by 'lambda:InvokeFunction'
Parameters
None
KICS: Lambda Permission Misconfigured
Lambda permission may be misconfigured if the action field is not filled in by 'lambda:InvokeFunction'
Parameters
None
KICS: Lambda Permission Principal Is Wildcard
Lambda Permission Principal should not contain a wildcard.
Parameters
None
KICS: Lambda With Vulnerable Policy
The attribute 'action' should not have wildcard
Parameters
None
KICS: Launch Configuration Is Not Encrypted
Launch Configurations should have the data in the volumes encrypted. To encrypt the data, the 'encrypted' parameter should be set to true in each volume
Parameters
None
KICS: Misconfigured Password Policy Expiration
No password expiration policy
Parameters
None
KICS: Missing Cluster Log Types
Amazon EKS control plane logging don't enabled for all log types
Parameters
None
KICS: MQ Broker Is Publicly Accessible
Check if any MQ Broker is not publicly accessible
Parameters
None
KICS: MQ Broker Logging Disabled
Check if MQ Brokers don't have logging enabled in any of the two options possible (audit and general).
Parameters
None
KICS: MSK Broker Is Publicly Accessible
Public AWS MSK allows anyone to interact with the Apache Kafka broker, therefore increasing the opportunity for malicious activity. To prevent such a scenario, it is recommended for AWS MSK to not be publicly accessible
Parameters
None
KICS: MSK Cluster Encryption Disabled
Ensure MSK Cluster encryption in rest and transit is enabled
Parameters
None
KICS: MSK Cluster Logging Disabled
Ensure MSK Cluster Logging is enabled
Parameters
None
KICS: Neptune Cluster Instance is Publicly Accessible
Neptune Cluster Instance should not be publicly accessible
Parameters
None
KICS: Neptune Cluster With IAM Database Authentication Disabled
Neptune Cluster should have IAM Database Authentication enabled
Parameters
None
KICS: Neptune Database Cluster Encryption Disabled
Neptune database cluster storage should have encryption enabled
Parameters
None
KICS: Neptune Logging Is Disabled
Neptune logging should be enabled
Parameters
None
KICS: Network ACL With Unrestricted Access To RDP
'RDP' (TCP:3389) should not be public in AWS Network ACL
Parameters
None
KICS: Network ACL With Unrestricted Access To SSH
'SSH' (TCP:22) should not be public in AWS Network ACL
Parameters
None
KICS: No Password Policy Enabled
IAM password policies should be set through the password minimum length and reset password attributes
Parameters
None
KICS: No Stack Policy
AWS CloudFormation Stack should have a stack policy in order to protect stack resources from update actions
Parameters
None
KICS: Password Without Reuse Prevention
Check if IAM account password has the reuse password configured with 24
Parameters
None
KICS: Policy Without Principal
All policies, except IAM identity-based policies, should have the 'Principal' element defined
Parameters
None
KICS: Public and Private EC2 Share Role
Public and private EC2 instances should not share the same role.
Parameters
None
KICS: Public Lambda via API Gateway
Allowing to run lambda function using public API Gateway
Parameters
None
KICS: RDS Associated with Public Subnet
RDS should not run in public subnet
Parameters
None
KICS: RDS Cluster With Backup Disabled
RDS Cluster backup retention period should be specifically defined
Parameters
None
KICS: RDS Database Cluster not Encrypted
RDS Database Cluster Encryption should be enabled
Parameters
None
KICS: RDS Storage Not Encrypted
RDS Storage should be encrypted, which means the attribute 'storage_encrypted' should be set to 'true'
Parameters
None
KICS: RDS Using Default Port
RDS should not use the default port (an attacker can easily guess the port). For engines related to Aurora, MariaDB or MySQL, the default port is 3306. PostgreSQL default port is 5432, Oracle default port is 1521 and SQL Server default port is 1433
Parameters
None
KICS: RDS With Backup Disabled
Make sure the AWS RDS configuration has automatic backup configured. If the retention period is equal to 0 there is no backup
Parameters
None
KICS: RDS Without Logging
RDS does not have any kind of logger
Parameters
None
KICS: Redis Disabled
ElastiCache should have Redis enabled, since it covers Compliance Certifications such as FedRAMP, HIPAA, and PCI DSS. For more information, take a look at 'https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/SelectEngine.html'
Parameters
None
KICS: Redis Not Compliant
Check if the redis version is compliant with the necessary AWS PCI DSS requirements
Parameters
None
KICS: Redshift Cluster Logging Disabled
Make sure Logging is enabled for Redshift Cluster
Parameters
None
KICS: Redshift Cluster Without VPC
Redshift Cluster should be configured in VPC (Virtual Private Cloud)
Parameters
None
KICS: Redshift Not Encrypted
AWS Redshift Cluster should be encrypted. Check if 'encrypted' field is false or undefined (default is false)
Parameters
None
KICS: Redshift Publicly Accessible
AWS Redshift Clusters must not be publicly accessible. Check if 'publicly_accessible' field is true or undefined (default is true)
Parameters
None
KICS: Redshift Using Default Port
Redshift should not use the default port (5439) because an attacker can easily guess the port
Parameters
None
KICS: Remote Desktop Port Open To Internet
The Remote Desktop port is open to the internet in a Security Group
Parameters
None
KICS: Resource Not Using Tags
AWS services resource tags are an essential part of managing components. As a best practice, the field 'tags' should have additional tags defined other than 'Name'
Parameters
None
KICS: REST API With Vulnerable Policy
REST API policy should avoid wildcard in 'Action' and 'Principal'
Parameters
None
KICS: Role With Privilege Escalation By Actions 'glue:UpdateDevEndpoint'
Role with privilege escalation by actions 'glue:UpdateDevEndpoint' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:AddUserToGroup'
Role with privilege escalation by actions 'iam:AddUserToGroup' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:AttachGroupPolicy'
Role with privilege escalation by actions 'iam:AttachGroupPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:AttachRolePolicy'
Role with privilege escalation by actions 'iam:AttachRolePolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:AttachUserPolicy'
Role with privilege escalation by actions 'iam:AttachUserPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:CreateAccessKey'
Role with privilege escalation by actions 'iam:CreateAccessKey' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:CreateLoginProfile'
Role with privilege escalation by actions 'iam:CreateLoginProfile' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:CreatePolicyVersion'
Role with privilege escalation by actions 'iam:CreatePolicyVersion' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'cloudformation:CreateStack' And 'iam:PassRole'
Role with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'ec2:RunInstances' And 'iam:PassRole'
Role with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'glue:CreateDevEndpoint' And 'iam:PassRole'
Role with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'lambda:CreateFunction' And 'iam:PassRole' And 'lambda:InvokeFunction'
Role with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:PutGroupPolicy'
Role with privilege escalation by actions 'iam:PutGroupPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:PutRolePolicy'
Role with privilege escalation by actions 'iam:PutRolePolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:PutUserPolicy'
Role with privilege escalation by actions 'iam:PutUserPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:SetDefaultPolicyVersion'
Role with privilege escalation by actions 'iam:SetDefaultPolicyVersion' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole'
Role with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'iam:UpdateLoginProfile'
Role with privilege escalation by actions 'iam:UpdateLoginProfile' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Role With Privilege Escalation By Actions 'lambda:UpdateFunctionCode'
Role with privilege escalation by actions 'lambda:UpdateFunctionCode' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: Root Account Has Active Access Keys
The AWS Root Account must not have active access keys associated, which means if there are access keys associated to the Root Account, they must be inactive.
Parameters
None
KICS: Route53 Record Undefined
Check if Record is set
Parameters
None
KICS: S3 Bucket Access to Any Principal
S3 Buckets must not allow Actions From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when there are All Principals
Parameters
None
KICS: S3 Bucket ACL Allows Read Or Write to All Users
S3 Buckets should not be readable and writable to all users
Parameters
None
KICS: S3 Bucket ACL Allows Read to Any Authenticated User
S3 Buckets should not be readable to any authenticated user
Parameters
None
KICS: S3 Bucket ACL Grants WRITE_ACP Permission
S3 Buckets should not allow WRITE_ACP permission to the S3 Bucket Access Control List in order to prevent AWS accounts or IAM users to modify access control permissions to the bucket.
Parameters
None
KICS: S3 Bucket Allows Delete Action From All Principals
S3 Buckets must not allow Delete Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Delete, for all Principals.
Parameters
None
KICS: S3 Bucket Allows Get Action From All Principals
S3 Buckets must not allow Get Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Get, for all Principals.
Parameters
None
KICS: S3 Bucket Allows List Action From All Principals
S3 Buckets must not allow List Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is List, for all Principals.
Parameters
None
KICS: S3 Bucket Allows Public ACL
S3 bucket allows public ACL
Parameters
None
KICS: S3 Bucket Allows Put Action From All Principals
S3 Buckets must not allow Put Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Put, for all Principals.
Parameters
None
KICS: S3 Bucket Logging Disabled
Server Access Logging should be enabled on S3 Buckets so that all changes are logged and trackable
Parameters
None
KICS: S3 Bucket Object Level CloudTrail Logging Disabled
S3 Bucket object-level CloudTrail logging should be enabled for read and write events
Parameters
None
KICS: S3 Bucket Object Not Encrypted
S3 Bucket Object should have server-side encryption enabled
Parameters
None
KICS: S3 Bucket Policy Accepts HTTP Requests
S3 Bucket policy should not accept HTTP Requests
Parameters
None
KICS: S3 Bucket Public ACL Overridden By Public Access Block
S3 bucket public access is overridden by S3 bucket Public Access Block when the following attributes are set to true - 'block_public_acls', 'block_public_policy', 'ignore_public_acls', and 'restrict_public_buckets'
Parameters
None
KICS: S3 Bucket SSE Disabled
If algorithm is AES256 then the master key is null, empty or undefined, otherwise the master key is required
Parameters
None
KICS: S3 Bucket With All Permissions
S3 Buckets should not have all permissions, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is '*', for all Principals.
Parameters
None
KICS: S3 Bucket Allows Public Policy
S3 bucket allows public policy
Parameters
None
KICS: S3 Bucket with Unsecured CORS Rule
If the CORS (Cross-Origin Resource Sharing) rule is defined in an S3 bucket, it should be secure
Parameters
None
KICS: S3 Bucket Without Enabled MFA Delete
S3 bucket without MFA Delete Enabled. MFA delete cannot be enabled through Terraform, it can be done by adding a MFA device (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html) and enabling versioning and MFA delete by using AWS CLI: 'aws s3api put-bucket-versioning --versioning-configuration=Status=Enabled,MFADelete=Enabled --bucket="BUCKET_NAME" --mfa="MFA_SERIAL_NUMBER"'. Please, also notice that MFA delete can not be used with lifecycle configurations
Parameters
None
KICS: S3 Bucket Without Ignore Public ACL
S3 bucket without ignore public ACL
Parameters
None
KICS: S3 Bucket Without Restriction Of Public Bucket
S3 bucket without restriction of public bucket
Parameters
None
KICS: S3 Bucket Without Versioning
S3 bucket should have versioning enabled
Parameters
None
KICS: S3 Static Website Host Enabled
Checks if any static websites are hosted on buckets. Even static websites can be a liability when poorly configured.
Parameters
None
KICS: Sagemaker Endpoint Configuration Encryption Disabled
Sagemaker endpoint configuration should encrypt data
Parameters
None
KICS: Sagemaker Notebook Instance Without KMS
AWS SageMaker should encrypt model artifacts at rest using Amazon S3 server-side encryption with an AWS KMS
Parameters
None
KICS: Secrets Manager With Vulnerable Policy
Secrets Manager policy should avoid wildcard in 'Principal' and 'Action'
Parameters
None
KICS: Secretsmanager Secret Encrypted With AWS Managed Key
Secrets Manager secret should be encrypted with customer-managed KMS keys instead of AWS managed keys
Parameters
None
KICS: Secretsmanager Secret Without KMS
AWS Secretmanager should use AWS KMS customer master key (CMK) to encrypt the secret values in the versions stored in the secret
Parameters
None
KICS: Secure Ciphers Disabled
Check if secure ciphers aren't used in CloudFront
Parameters
None
KICS: Security Group Rule Without Description
It's considered a best practice for all rules in AWS Security Group to have a description
Parameters
None
KICS: Security Group With Unrestricted Access To SSH
'SSH' (TCP:22) should not be public in AWS Security Group
Parameters
None
KICS: Security Group Rule Without Description
It's considered a best practice for AWS Security Group to have a description
Parameters
None
KICS: Security Group Not Used
Security group must be used or not declared
Parameters
None
KICS: Sensitive Port Is Exposed To Entire Network
A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
Parameters
None
KICS: Sensitive Port Is Exposed To Small Public Network
A sensitive port, such as port 23 or port 110, is open for a small public network in either TCP or UDP protocol
Parameters
None
KICS: Sensitive Port Is Exposed To Wide Private Network
A sensitive port, such as port 23 or port 110, is open for a wide private network in either TCP or UDP protocol
Parameters
None
KICS: Service Control Policies Disabled
Check if the Amazon Organizations ensure that all features are enabled to achieve full control over the use of AWS services and actions across multiple AWS accounts using Service Control Policies (SCPs).
Parameters
None
KICS: SES Policy With Allowed IAM Actions
SES policy should not allow IAM actions to all principals
Parameters
None
KICS: Shield Advanced Not In Use
AWS Shield Advanced should be used for Amazon Route 53 hosted zone, AWS Global Accelerator accelerator, Elastic IP Address, Elastic Load Balancing, and Amazon CloudFront Distribution to protect these resources against robust DDoS attacks
Parameters
None
KICS: SNS Topic Encrypted With AWS Managed Key
SNS (Simple Notification Service) Topic should be encrypted with customer-managed KMS keys instead of AWS managed keys
Parameters
None
KICS: SNS Topic is Publicly Accessible
SNS Topic Policy should not allow any principal to access
Parameters
None
KICS: SNS Topic Not Encrypted
SNS (Simple Notification Service) Topic should be encrypted
Parameters
None
KICS: SNS Topic Publicity Has Allow and NotAction Simultaneously
SNS topic Publicity should not have 'Effect: Allow' and argument 'NotAction' at the same time. If it has 'Effect: Allow', the argument stated should be 'Action'.
Parameters
None
KICS: SQL Analysis Services Port 2383 (TCP) Is Publicly Accessible
Check if port 2383 on TCP is publicly accessible by checking the CIDR block range that can access it.
Parameters
None
KICS: SQS Policy Allows All Actions
SQS policy allows ALL (*) actions
Parameters
None
KICS: SQS Policy With Public Access
Checks for dangerous permissions in Action statements in an SQS Queue Policy. This is deemed a potential security risk as it would allow various attacks to the queue
Parameters
None
KICS: SQS Queue Exposed
Checks if the SQS Queue is exposed
Parameters
None
KICS: SQS VPC Endpoint Without DNS Resolution
SQS VPC Endpoint should have DNS resolution enabled
Parameters
None
KICS: SQS With SSE Disabled
Amazon Simple Queue Service (SQS) queue should protect the contents of their messages using Server-Side Encryption (SSE)
Parameters
None
KICS: SSM Session Transit Encryption Disabled
SSM Session should be encrypted in transit
Parameters
None
KICS: SSO Permission With Inadequate User Session Duration
SSO permissions should be configured to limit user sessions to no longer than 1 hour. Allowing longer sessions can increase the risk of unauthorized access or session hijacking. This is a best practice for security and should be implemented in SSO permission settings.
Parameters
None
KICS: SSO Policy with full privileges
SSO policies should be configured to grant limited administrative privileges, rather than full access to all resources. This approach allows for better security and control over the resources being accessed.
Parameters
None
KICS: Stack Notifications Disabled
AWS CloudFormation should have stack notifications enabled to be notified when an event occurs
Parameters
None
KICS: Stack Retention Disabled
Make sure that retain_stack is enabled to keep the Stack and it's associated resources during resource destruction
Parameters
None
KICS: Stack Without Template
AWS CloudFormation should have a template defined through the attribute template_url or attribute template_body
Parameters
None
KICS: Unknown Port Exposed To Internet
AWS Security Group should not have an unknown port exposed to the entire Internet
Parameters
None
KICS: Unrestricted Security Group Ingress
Security groups allow ingress from 0.0.0.0:0 and/or ::/0
Parameters
None
KICS: Unscanned ECR Image
Checks if the ECR Image has been scanned
Parameters
None
KICS: User Data Contains Encoded Private Key
User Data should not contain a base64 encoded private key. If so, anyone can decode the private key easily
Parameters
None
KICS: User Data Shell Script Is Encoded
User Data Shell Script must be encoded
Parameters
None
KICS: User With Privilege Escalation By Actions 'glue:UpdateDevEndpoint'
User with privilege escalation by actions 'glue:UpdateDevEndpoint' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:AddUserToGroup'
User with privilege escalation by actions 'iam:AddUserToGroup' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:AttachGroupPolicy'
User with privilege escalation by actions 'iam:AttachGroupPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:AttachRolePolicy'
User with privilege escalation by actions 'iam:AttachRolePolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:AttachUserPolicy'
User with privilege escalation by actions 'iam:AttachUserPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:CreateAccessKey'
User with privilege escalation by actions 'iam:CreateAccessKey' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:CreateLoginProfile'
User with privilege escalation by actions 'iam:CreateLoginProfile' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:CreatePolicyVersion'
User with privilege escalation by actions 'iam:CreatePolicyVersion' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'cloudformation:CreateStack' And 'iam:PassRole'
User with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'ec2:RunInstances' And 'iam:PassRole'
User with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'glue:CreateDevEndpoint' And 'iam:PassRole'
User with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'lambda:CreateFunction' And 'iam:PassRole' And 'lambda:InvokeFunction'
User with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:PutGroupPolicy'
User with privilege escalation by actions 'iam:PutGroupPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:PutRolePolicy'
User with privilege escalation by actions 'iam:PutRolePolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:PutUserPolicy'
User with privilege escalation by actions 'iam:PutUserPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:SetDefaultPolicyVersion'
User with privilege escalation by actions 'iam:SetDefaultPolicyVersion' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole'
User with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'iam:UpdateLoginProfile'
User with privilege escalation by actions 'iam:UpdateLoginProfile' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: User With Privilege Escalation By Actions 'lambda:UpdateFunctionCode'
User with privilege escalation by actions 'lambda:UpdateFunctionCode' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.
Parameters
None
KICS: VPC Default Security Group Accepts All Traffic
Default Security Group attached to every VPC should restrict all traffic
Parameters
None
KICS: VPC FlowLogs Disabled
Every VPC resource should have an associated Flow Log
Parameters
None
KICS: VPC Peering Route Table with Unrestricted CIDR
VPC Peering Route Table should restrict CIDR
Parameters
None
KICS: VPC Subnet Assigns Public IP
VPC Subnet should not assign public IP
Parameters
None
KICS: VPC Without Network Firewall
VPC should have a Network Firewall associated
Parameters
None
KICS: Vulnerable Default SSL Certificate
CloudFront web distributions should use custom (and not default) SSL certificates. Custom SSL certificates allow only defined users to access content by using an alternate domain name instead of the default one.
Parameters
None
KICS: Workspaces Workspace Volume Not Encrypted
AWS Workspaces Workspace data stored in volumes should be encrypted
Parameters
None
AWS: Lambda: Prohibit publicly accessible Lambda functions
Requires AWS/Lambda Function Permissions to include an AWS account ID principal, principal_org_id, source_account AWS account ID, or source_arn resource ARN to prevent public access.
Parameters
None
AWS: Security Groups: Restrict Ingress from public IPs.
Require AWS/Security Groups to allow ingress from private IPv4 CIDRs only. Private IPv4 CIDR IP 'ranges:' "10.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.168.0.0/16"
Parameters
None
AWS: Security Groups: Ingress Allow only whitelisted CIDR and Ports
Require AWS/Security Groups to have ingress from whitelisted CIDR blocks on whitelisted ports. To allow all, use wildcard entry '*'.
Parameters
-
Parameters:
-
allowed_cidr_ports: An object with allowed CIDR ports by address
- Type: object
- Unique: false
- Required: true
-
-
Required Parameters: allowed_cidr_ports
AWS: Security Groups: Allow only whitelisted Ports for Public Ingress
Require AWS/Security Groups Ingresses for CIDR "0.0.0.0/0" use only whitelisted ports.
Parameters
-
Parameters:
-
allowed_ports: Ports allowed for ingress traffic from cidr '0.0.0.0/0' (e.g., 80 443)
- Type: set_of_strings
- Unique: false
- Required: true
-
-
Required Parameters: allowed_ports
AWS: OpenSearch: Prohibit OpenSearch Domains with disabled encryption at rest
Require AWS/OpenSearch domains to have enabled encryption at rest.
Parameters
None
AWS: Opensearch: Prohibit Opensearch Domains with disabled node to node encryption
Require AWS/Opensearch domains to have enabled node to node encryption.
Parameters
None
AWS: Opensearch: Prohibit Opensearch Domains not created in VPC
Require AWS/Opensearch domains to have subnets added in vpc_options.
Parameters
None
AWS: RDS: Prohibit RDS instance with disabled automatic minor version upgrade
Require AWS/RDS instances to have automatic minor version upgrade enabled.
Parameters
None
AWS: RDS: Prohibit RDS instances with disabled IAM database authentication
Require AWS/RDS instances to have IAM authentication enabled.
Parameters
None
AWS: RDS: Prohibit publicly accessible RDS instances
Require AWS/RDS instances to not be publicly accessible.
Parameters
None
AWS: RDS: Prohibit RDS clusters with disabled IAM authentication
Require AWS/RDS clusters to have IAM authentication enabled.
Parameters
None
AWS: RDS: Prohibit RDS instances with disabled CloudWatch log exports
Require AWS/RDS instances to have CloudWatch log exports enabled.
Parameters
None
AWS: Redshift: Prohibit Redshift cluster with disabled enhanced VPC routing
Require AWS/Redshift cluster to have enhanced VPC routing enabled.
Parameters
None
AWS: Redshift: Prohibit publicly accessible Redshift cluster
Require AWS/Redshift cluster to not be publicly accessible.
Parameters
None
AWS: S3: Ensure Logging is Enabled in S3 Buckets
Require AWS/S3 buckets to have logging enabled.
Parameters
None
AWS: S3: Prohibit Bucket Policies containing An Asterisk In Actions
Require AWS/S3 bucket policy to not use asterisk in 'Action'.
Parameters
None
AWS: S3: Prohibit Unencrypted Buckets
Require AWS/S3 buckets to be encrypted.
Parameters
None
AWS: S3: Prohibit Unencrypted Bucket Object
Require AWS/S3 bucket object to be server side encrypted
Parameters
None
AWS: S3: Ensure Versioning is Enabled for S3 Buckets
Require AWS/S3 buckets to have versioning enabled.
Parameters
None
AWS: S3: Restrict S3 buckets with unapproved ACL
Require AWS/S3 to use Canned ACL from a pre-approved list.
Parameters
-
Parameters:
-
allowed_acls: A list of ACLs
- Type: set_of_strings
- Unique: false
- Required: true
-
-
Required Parameters: allowed_acls
AWS: S3: Allow ingress only from whitelisted IP's
Require AWS/S3 bucket policy with whitelisted source IP's. To allow all, use wildcard entry '*'.
Parameters
-
Parameters:
-
allowed_ips: A list of allowed IPs
- Type: set_of_strings
- Unique: false
- Required: true
-
-
Required Parameters: allowed_ips
AWS: SageMaker: Prohibit SageMaker Notebook instance with direct internet access enabled
Require AWS/SageMaker instance to have direct internet access disabled.
Parameters
None
AWS: SSM: Prohibit publicly accessible SSM documents
AWS/SSM Document not to be publicly accessible.
Parameters
None
Azure: IAM: Prohibit assignment of Owner role
Require Azure/IAM role assignment to not have owner role assigned to any principal.
Parameters
None
KICS: AD Admin Not Configured For SQL Server
The Active Directory Administrator is not configured for a SQL server
Parameters
None
KICS: Admin User Enabled For Container Registry
Admin user is enabled for Container Registry
Parameters
None
KICS: AKS Disk Encryption Set ID Undefined
Azure Container Service (AKS) should use Disk Encryption Set ID in supported types of disk
Parameters
None
KICS: AKS Network Policy Misconfigured
Azure Kubernetes Service should have the proper network policy configuration to ensure the principle of least privileges, which means that 'network_profile.network_policy' should be defined
Parameters
None
KICS: AKS Private Cluster Disabled
Azure Kubernetes Service (AKS) API should not be exposed to the internet
Parameters
None
KICS: AKS RBAC Disabled
Azure Container Service (AKS) instance should have role-based access control (RBAC) enabled
Parameters
None
KICS: AKS Uses Azure Policies Add-On Disabled
Azure Container Service (AKS) should use Azure Policies Add-On
Parameters
None
KICS: App Service Authentication Disabled
Azure App Service authentication settings should be enabled
Parameters
None
KICS: App Service FTPS Enforce Disabled
Azure App Service should only enforce FTPS when 'ftps_state' is enabled
Parameters
None
KICS: App Service HTTP2 Disabled
App Service should have 'http2_enabled' enabled
Parameters
None
KICS: App Service Managed Identity Disabled
Azure App Service should have managed identity enabled
Parameters
None
KICS: App Service Not Using Latest TLS Encryption Version
Ensure App Service is using the latest version of TLS encryption
Parameters
None
KICS: App Service Without Latest PHP Version
Periodically newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.
Parameters
None
KICS: App Service Without Latest Python Version
Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest full Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.
Parameters
None
KICS: Azure Active Directory Authentication
Azure Active Directory must be used for authentication for Service Fabric
Parameters
None
KICS: Azure App Service Client Certificate Disabled
Azure App Service client certificate should be enabled
Parameters
None
KICS: Azure Cognitive Search Public Network Access Enabled
Public Network Access should be disabled for Azure Cognitive Search
Parameters
None
KICS: Azure Container Registry With No Locks
Azurerm Container Registry should contain associated locks, which means 'azurerm_management_lock.scope' should be associated with 'azurerm_container_registry'
Parameters
None
KICS: Azure Front Door WAF Disabled
Azure Front Door WAF should be enabled
Parameters
None
KICS: Cosmos DB Account Without Tags
Cosmos DB Account must have a mapping of tags.
Parameters
None
KICS: CosmosDB Account IP Range Filter Not Set
The IP range filter should be defined to secure the data stored
Parameters
None
KICS: Dashboard Is Enabled
Check if the Kubernetes Dashboard is enabled.
Parameters
None
KICS: Default Azure Storage Account Network Access Is Too Permissive
Default Azure Storage Account network access should be set to Deny
Parameters
None
KICS: Default Network Access is Allowed
Default Network Access rule for Storage Accounts must be set to deny, which means the attribute 'default_action' must be 'Deny'
Parameters
None
KICS: Email Alerts Disabled
Make sure that alerts notifications are set to 'On' in the Azure Security Center Contact
Parameters
None
KICS: Encryption On Managed Disk Disabled
Ensure that the encryption is active on the disk
Parameters
None
KICS: Firewall Rule Allows Too Many Hosts To Access Redis Cache
Check if any firewall rule allows too many hosts to access Redis Cache
Parameters
None
KICS: Function App Authentication Disabled
Azure Function App authentication settings should be enabled
Parameters
None
KICS: Function App Client Certificates Unrequired
Azure Function App should have 'client_cert_mode' set to required
Parameters
None
KICS: Function App FTPS Enforce Disabled
Azure Function App should only enforce FTPS when 'ftps_state' is enabled
Parameters
None
KICS: Function App HTTP2 Disabled
Function App should have 'http2_enabled' enabled
Parameters
None
KICS: Function App Managed Identity Disabled
Azure Function App should have managed identity enabled
Parameters
None
KICS: Function App Not Using Latest TLS Encryption Version
Ensure Function App is using the latest version of TLS encryption
Parameters
None
KICS: Geo Redundancy Is Disabled
Make sure that on PostgreSQL Geo Redundant Backups is enabled
Parameters
None
KICS: Key Expiration Not Set
Make sure that for all keys the expiration date is set
Parameters
None
KICS: Key Vault Secrets Content Type Undefined
Key Vault Secrets should have set Content Type
Parameters
None
KICS: Log Retention Is Not Set
Make sure that for PostgreSQL Database, server parameter 'log_retention' is set to 'ON'
Parameters
None
KICS: MariaDB Server Public Network Access Enabled
MariaDB Server Public Network Access should be disabled
Parameters
None
KICS: MariaDB Server Geo-redundant Backup Disabled
MariaDB Server Geo-redundant Backup should be enabled
Parameters
None
KICS: MSSQL Server Auditing Disabled
Make sure that for MSSQL Servers, that 'Auditing' is set to 'On'
Parameters
None
KICS: MSSQL Server Public Network Access Enabled
MSSQL Server public network access should be disabled
Parameters
None
KICS: MySQL Server Public Access Enabled
MySQL Server public access should be disabled
Parameters
None
KICS: MySQL SSL Connection Disabled
Make sure that for MySQL Database Server, 'Enforce SSL connection' is enabled
Parameters
None
KICS: Network Interfaces With Public IP
Network Interfaces should not be exposed with a public IP address. If configured, additional security baselines should be followed (https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/virtual-network-security-baseline, https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/public-ip-security-baseline)
Parameters
None
KICS: Network Interfaces IP Forwarding Enabled
Network Interfaces IP Forwarding should be disabled
Parameters
None
KICS: Network Watcher Flow Disabled
Check if enable field in the resource azurerm_network_watcher_flow_log is false.
Parameters
None
KICS: PostgreSQL Log Checkpoints Disabled
Make sure that for Postgre SQL Database Server, parameter 'log_checkpoints' is set to 'ON'
Parameters
None
KICS: PostgreSQL Log Connections Not Set
Make sure that for PostgreSQL Database, server parameter 'log_connections' is set to 'ON'
Parameters
None
KICS: PostgreSQL Log Duration Not Set
Make sure that for PostgreSQL Database, server parameter 'log_duration' is set to 'ON'
Parameters
None
KICS: PostgreSQL Server Infrastructure Encryption Disabled
PostgreSQL Server Infrastructure Encryption should be enabled
Parameters
None
KICS: PostgreSQL Server Without Connection Throttling
Ensure that Connection Throttling is set for the PostgreSQL server
Parameters
None
KICS: PostgreSQL Log Disconnections Not Set
Make sure that for PostgreSQL Database, server parameter 'log_disconnections' is set to 'ON'
Parameters
None
KICS: PostgreSQL Server Threat Detection Policy Disabled
PostgreSQL Server Threat Detection Policy should be enabled
Parameters
None
KICS: Public Storage Account
Storage Account should not be public to grant the principle of least privileges
Parameters
None
KICS: RDP Is Exposed To The Internet
Port 3389 (Remote Desktop) is exposed to the internet
Parameters
None
KICS: Redis Cache Allows Non SSL Connections
Redis Cache resources should not allow non-SSL connections
Parameters
None