Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

CloudFormation detectors (90/90)

Cloudfront Custom SSL Certificate DynamoDB Autoscaling Enabled CLOUD TRAIL CLOUD WATCH LOGS Cloudfront Origin Failover Sagemaker Notebook Direct Access Cloudwatch Alarm Action Check ELB Cross Zone Load Balancing Disabled domain logging Elasticsearch Primary Node S3 Bucket SSL Request Only Disabled pitr for global tables Redshift Backup Enabled Restrict log4j2 message lookup RDS instance logging enabled S3 Bucket replication enabled IAM Profile Not Attached.Setup Cloudformation Alarms Cloudfront Origin Access Identity S3 Bucket Default Encryption With AWS KMS Disabled encryption on Aurora at rest Restrict wildcard in KMS key CLOUDFRONT DEFAULT ROOT OBJECT CONFIGURED No unrestricted route to igw RDS Auto Version Upgrade Subnet Auto Assign Public IP Unecrypted AWS Redshift using CMK CW Loggroup Retention Period EMR Kerberos Enabled RedShift Enhanced VPC Routing Unencryption not prevented Disabled AWS S3 object versioning Ecs Task Definition Configure HTTPS for CloudFront distribution ViewerProtocolPolicy Sagemaker Endpoint Kms Configured Monitoring Disabled EC2 instances Disabled iam authentication AWS S3 public WRITE permission Over premissive aws private ecr Disabled AWS RDS Encryption Cloudtrail S3 Dataevents enabled Restrict IAM permissive role assumption Disabled node to node encryption Redshift Cluster Maintenance Settings DB instance backup enabled Api GW domain deny non-TLS traffic EKS Endpoint No Public Access More Restrictive CIDR enabled_rds_public_access_cloudformation disabled_msk_cluster_logging_cloudformation S3 bucket restrict public bucket not true Aurora MySQL Backtracking ELB ACM Certificate S3 default lock enabled Sagemaker NoteBook Instance Kms Exposed secrets in EC2 user data S3 ignore public acls not true Unencrypted code build ElastiCache Redis Cluster Automatic Backups Cloudfront SNI Enabled Elasticsearch Zone Awareness and Data Nodes Exposed secrets in Lambda function environment variables sns_topic_uses_cmk_cloudformation Opensearch Access Control Unencrypted backup vault API GW Resources Type Check Restricted Common Ports Disabled DynamoDB Point-In-Time Recovery EBS Optimization Disabled EC2 instances Restrict assumed IAM role access ELB Deletion Protection Autoscaling Launch Config Autoscaling Group ELB Health Checks Lambda Function Access Implicit SSH for AWS EKS node group Elasticsearch in VPS Disabled Glue Data Catalog encryption Unsecured Encryption in transit for EFS volumes ELB TLS HTTPS Listeners EFS Resources Protected By Backup Plan Disabled enforce https Unencrypted EBS Volumes Codebuild Environment Variable Restrict public IP association on EC2 instance ELBV2 ACM Certificate RDS Instance Deletion Protection Public READ bucket ACL nonhttps_load_balancer_cloudformation Disabled AWS Glue security encryption EC2 Instance In VPC TTL Specification Enabled

Cloudfront Origin Access Identity High

CloudFront Distribution Resources have an S3 Origin configured without an Origin Access Identity. Ensure that it have an S3 Origin configured with an OAI.

Detector ID

cloudformation/checkov-custom-cloudfront-origin-access@v1.0

Category

Common Weakness Enumeration (CWE)

-

Tags

# aws-cloudformation