Unencrypted storage bucket foundTF-GCP002Legacy `ABAC` permissions are enabledTF-GCP005Potentially sensitive data stored in block attributeTF-GEN003Invalid AWS S3 bucket regionTF-L0052Invalid AWS DB instance typeTF-L0006Ensure all Cloud SQL database instance requires all incoming connections to use SSLTF-S2006Ensure that Cloud SQL database instances are not open to the worldTF-S2011Azure instance is using basic authenticationTF-S1001Azure AKS is not using RBACTF-S1005Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suitesTF-S2004Kubernetes Engine Cluster authentication missing client certificateTF-S2013Kubernetes Engine Cluster missing Network PolicyTF-S2012Ensure Google compute firewall ingress does not allow unrestricted ssh accessTF-S2002Ensure Google compute firewall ingress does not allow unrestricted RDP accessTF-S2003Ensure Legacy Authorization is set to Disabled on Kubernetes Engine ClustersTF-S2007Exposed BigQuery datasetsTF-S2015Found usage of RSASHA1 for the zone-signing and key-signing keys in Cloud DNS DNSSECTF-S2017Detected password authentication instead of `SSH` keysTF-AZU005Unencrypted data lake store foundTF-AZU004Potentially sensitive data stored in `default` value of variableTF-GEN001Potentially sensitive data stored in local valueTF-GEN002Deprecated interpolationTF-L0037Use of default AWS DB parameter groupTF-L0034Use of an old generation AWS elasticache cluster node typeTF-L0035Use of default AWS elasticache parameter groupTF-L0036Legacy dot index syntaxTF-L0038Unused declarationTF-L0039Missing routing target in `aws_route` resourceTF-L0030Use of previous generation AWS instance typeTF-L0032Cloud DNS has DNSSEC disabledTF-S2016Ensure 'Automatic node repair' is enabled for Kubernetes ClustersTF-S2009AKS API server does not define authorized IP rangesTF-S1006Unencrypted Azure managed disk foundTF-S1002`supportsHttpsTrafficOnly` is not set to `true`TF-S1003AKS logging is not configured with Azure MonitoringTF-S1004Cloud SQL database found with backup configuration disabledTF-S2014An inbound firewall rule allows traffic from `/0`TF-GCP003Invalid AWS MQ broker engine typeTF-L0050Load balancer is exposed to the internetTF-AWS005An outdated SSL policy is in use by a load balancerTF-AWS010A resource is marked as publicly accessibleTF-AWS011Unencrypted SQS queueTF-AWS015Use of plain `HTTP`TF-AWS004Unencrypted managed disk detectedTF-AZU003AWS instance with invalid AMI IDTF-L0015AWS launch configuration with invalid AMI IDTF-L0021Invalid `excess_capacity_termination_policy`TF-L0053Unrestricted RDP accessTF-S1009Invalid AWS Load Banancer subnet IDTF-L0002Invalid AWS DB subnet group nameTF-L0003Invalid ACL value for AWS S3 bucketTF-L0051Module doesn't comply with Terraform Standard Module StructureTF-L0048Invalid AWS Application Load Balancer security groupTF-L0001Invalid `ParameterGroupName` for AWS DB instanceTF-L0005Route definition has multiple routing targetsTF-L0031Unrestricted access to Kubernetes dashboardTF-S1008Unrestricted SSH accessTF-S1010SQL Databases allows ingress from `0.0.0.0/0`TF-S1011Unprotected AKS cluster detectedTF-S1007Standard pricing tier is not selectedTF-S1019App Service Authentication is not enabled on Azure App ServiceTF-S1013Register with Azure Active Directory is not enabled on Azure App ServiceTF-S1016Security contact phone number not setTF-S1020Send email notification for high severity alerts is disabledTF-S1021Incoming client certificates are disabledTF-S1017HTTP version being used is outdatedTF-S1018Web application does not redirect all HTTP traffic to HTTPS in Azure App ServiceTF-S1014Web application is not using TLS 1.2 on Azure App ServiceTF-S1015Send email notification for high severity alerts to administrator is disabledTF-S1022'Auditing' is not 'Enabled' for SQL serversTF-S1023An ingress security group rule allows traffic from `/0`TF-AWS006An egress security group rule allows traffic to `/0`TF-AWS007An inline ingress security group rule allows traffic from `/0`TF-AWS008An inline egress security group rule allows traffic to `/0`TF-AWS009Task definition defines sensitive environment variable(s)TF-AWS013Launch configuration with unencrypted block deviceTF-AWS014Unencrypted SNS topicTF-AWS016Unencrypted S3 bucketTF-AWS017Missing description for security group/security group ruleTF-AWS018An inbound network security rule allows traffic from `/0`TF-AZU001S3 Bucket does not have logging enabledTF-AWS002AWS Classic resource usageTF-AWS003Unencrypted compute disk foundTF-GCP001An outbound firewall rule allows traffic to `/0`TF-GCP004An outbound network security rule allows traffic from /0TF-AZU002S3 Bucket has an ACL defined which allows public accessTF-AWS001Elasticsearch domain endpoint is using outdated TLS policyTF-AWS034EKS should have the encryption of secrets enabledTF-AWS066S3 Access block should block public ACLTF-AWS074AWS IAM policy document has wildcard action statementTF-AWS046A resource has a public IP addressTF-AWS012A KMS key is not configured to auto-rotateTF-AWS019ECR repository has image scans disabledTF-AWS023API Gateway domain name uses outdated SSL/TLS protocolsTF-AWS025Elasticsearch domain isn't encrypted at restTF-AWS031Elasticsearch doesn't enforce HTTPS trafficTF-AWS033Unencrypted Elasticache Replication GroupTF-AWS035IAM Password policy should have requirement for at least one lowercase characterTF-AWS042AWS SQS policy document has wildcard action statementTF-AWS047RDS encryption has not been enabled at a database Instance levelTF-AWS052Encryption for RDS Performance Insights should be enabledTF-AWS053ElasticSearch nodes should communicate with node to node encryption enabledTF-AWS055Ensure that lambda function permission has a source arn specifiedTF-AWS058API Gateway stages for V1 and V2 should have access logging enabledTF-AWS061User data for EC2 instances must not contain sensitive AWS keysTF-AWS062CloudTrail should be encrypted at rest to secure access to sensitive trail dataTF-AWS065`aws_instance` resource should activate session tokens for Instance Metadata ServiceTF-AWS079EKS Clusters should have cluster control plane logging turned onTF-AWS067Viewer Protocol Policy in CloudFront Distribution Cache should always be set to HTTPSTF-AWS072S3 Access block should block public policyTF-AWS076CodeBuild Project artifacts encryption should not be disabledTF-AWS080Amazon DynamoDB Accelerator Cluster should always encrypt data at restTF-AWS081Use of previous generation AWS database instanceTF-L0033Detected a git or mercurial repository as a module source without pinning to a versionTF-L0044Audit: `terraform.workspace` used with a `remote` backend with remote executionTF-L0049There is no encryption specified or encryption is disabled on the RDS ClusterTF-AWS051Athena databases and workgroup configurations are created unencrypted at rest by default, they should be encryptedTF-AWS059IAM Password policy should prevent password reuseTF-AWS037IAM Password policy should have expiry less than or equal to 90 daysTF-AWS038IAM Password policy should have requirement for at least one symbol in the passwordTF-AWS040IAM Password policy should have requirement for at least one number in the passwordTF-AWS041An ingress Network ACL rule allows specific ports from `/0`TF-AWS049ElasticSearch domains should enforce HTTPSTF-AWS054Domain logging should be enabled for ElasticSearch domainsTF-AWS057Athena workgroups should enforce configuration to prevent client disabling encryptionTF-AWS060CloudTrail should be enabled in all regions, regardless of where your AWS resources are generally locatedTF-AWS063EKS Clusters should have the public access disabledTF-AWS069AWS ElasticSearch Domain should have logging enabledTF-AWS070CloudFront distribution should have Access Logging configuredTF-AWS071S3 Access Block should Ignore Public ACLTF-AWS073S3 Access block should restrict public bucket to limit accessTF-AWS075S3 Data should be versionedTF-AWS077ECR images tags shouldn't be mutableTF-AWS078Invalid AWS DB `OptionGroupName`TF-L0004Invalid AWS VPC Security GroupTF-L0007`terraform` declarations without `require_version`TF-L0046Provider doesn't have version constraintTF-L0047CloudFront distribution allows unencrypted (HTTP) communicationsTF-AWS020CloudFront distribution uses outdated SSL/TLS protocolsTF-AWS021A MSK cluster allows unencrypted data in transitTF-AWS022Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine ClustersTF-S2001Ensure 'Automatic node upgrade' is enabled for Kubernetes ClustersTF-S2010Kinesis stream is unencryptedTF-AWS024CloudFront distribution does not have a WAF in frontTF-AWS045EFS Encryption has not been enabledTF-AWS048CloudTrail log validation should be enabled to prevent tampering of log dataTF-AWS064EKS cluster should not have open CIDR range for public accessTF-AWS068Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine ClustersTF-S2008Elasticsearch domain uses plaintext traffic for node to node communicationTF-AWS032AWS provider has access credentials specifiedTF-AWS044Elasticache Replication Group uses unencrypted trafficTF-AWS036IAM Password policy should have minimum password length of 14 or more charactersTF-AWS039IAM Password policy should have requirement for at least one uppercase characterTF-AWS043An ingress Network ACL rule allows ALL ports from `/0`TF-AWS050Master authorized networks are not enabled in GKE clustersTF-S2019GCP Kubernetes engine clusters have basic authentication enabledTF-S2018Consider using `#` for commentsTF-L0040Output declaration without descriptionTF-L0041`variable` declaration without descriptionTF-L0042`variable` declaration without typeTF-L0043
Terraform logoTerraform/
TF-S1011

SQL Databases allows ingress from `0.0.0.0/0`TF-S1011

Critical severityCritical
Security categorySecurity

Allowing ingress from 0.0.0.0/0 means that the SQL database can accept connection requests from all the IP addresses. This can lead to allowing unauthorized connections too.

SQL Server includes a firewall to block access to unauthorized connections. More granular IP addresses can be defined by referencing the range of addresses available from specific data centers. By default, for a SQL server, a Firewall exists with StartIP of 0.0.0.0 and EndIP of 0.0.0.0, allowing access to all the Azure services. Additionally, a custom rule can be set up with StartIP of 0.0.0.0 and EndIP of 255.255.255.255, allowing access from ANY IP over the Internet. In order to reduce the potential attack surface for a SQL server, firewall rules should be defined with more granular IP addresses by referencing the range of addresses available from specific datacenters. By default, setting "Allow" access to Azure Services is set to ON, allowing access to all Windows Azure IP ranges.