Amazon Q
Detector Library
CloudFormation detectors (90/90)
Cloudfront Custom SSL CertificateDynamoDB Autoscaling EnabledCLOUD TRAIL CLOUD WATCH LOGSCloudfront Origin FailoverSagemaker Notebook Direct AccessCloudwatch Alarm Action CheckELB Cross Zone Load BalancingDisabled domain loggingElasticsearch Primary NodeS3 Bucket SSL Request OnlyDisabled pitr for global tablesRedshift Backup EnabledRestrict log4j2 message lookupRDS instance logging enabledS3 Bucket replication enabledIAM Profile Not Attached.Setup Cloudformation AlarmsCloudfront Origin Access IdentityS3 Bucket Default Encryption With AWS KMSDisabled encryption on Aurora at restRestrict wildcard in KMS keyCLOUDFRONT DEFAULT ROOT OBJECT CONFIGUREDNo unrestricted route to igwRDS Auto Version UpgradeSubnet Auto Assign Public IPUnecrypted AWS Redshift using CMKCW Loggroup Retention PeriodEMR Kerberos EnabledRedShift Enhanced VPC RoutingUnencryption not preventedDisabled AWS S3 object versioningEcs Task DefinitionConfigure HTTPS for CloudFront distribution ViewerProtocolPolicySagemaker Endpoint Kms ConfiguredMonitoring Disabled EC2 instancesDisabled iam authenticationAWS S3 public WRITE permissionOver premissive aws private ecrDisabled AWS RDS EncryptionCloudtrail S3 Dataevents enabledRestrict IAM permissive role assumptionDisabled node to node encryptionRedshift Cluster Maintenance SettingsDB instance backup enabledApi GW domain deny non-TLS trafficEKS Endpoint No Public AccessMore Restrictive CIDRenabled_rds_public_access_cloudformationdisabled_msk_cluster_logging_cloudformationS3 bucket restrict public bucket not trueAurora MySQL BacktrackingELB ACM CertificateS3 default lock enabledSagemaker NoteBook Instance KmsExposed secrets in EC2 user dataS3 ignore public acls not trueUnencrypted code buildElastiCache Redis Cluster Automatic BackupsCloudfront SNI EnabledElasticsearch Zone Awareness and Data NodesExposed secrets in Lambda function environment variablessns_topic_uses_cmk_cloudformationOpensearch Access ControlUnencrypted backup vaultAPI GW Resources Type CheckRestricted Common PortsDisabled DynamoDB Point-In-Time RecoveryEBS Optimization Disabled EC2 instancesRestrict assumed IAM role accessELB Deletion ProtectionAutoscaling Launch ConfigAutoscaling Group ELB Health ChecksLambda Function AccessImplicit SSH for AWS EKS node groupElasticsearch in VPSDisabled Glue Data Catalog encryptionUnsecured Encryption in transit for EFS volumesELB TLS HTTPS ListenersEFS Resources Protected By Backup PlanDisabled enforce httpsUnencrypted EBS VolumesCodebuild Environment VariableRestrict public IP association on EC2 instanceELBV2 ACM CertificateRDS Instance Deletion ProtectionPublic READ bucket ACLnonhttps_load_balancer_cloudformationDisabled AWS Glue security encryptionEC2 Instance In VPCTTL Specification Enabled
Medium
Showing all detectors for the CloudFormation language with medium severity.
Disabled domain logging
Disabled domain logging is detected for AWS Elasticsearch.
Disabled pitr for global tables
Disabled Dynamodb point in time recovery is detected for global tables.
No unrestricted route to igw
Checks if routes to an Internet Gateway have a destination CIDR block of '0.0.0.0/0' or '::/0'.
Unencryption not prevented
Unencryption is not prevented by Athena workgroup.
Ecs Task Definition
Amazon ECS task definitions ContainerDefinitions has User not present and Privileged set to false.
Disabled iam authentication
Disabled IAM authentication is detected for RDS database.
Over premissive aws private ecr
Overly permissive access is granted for AWS Private ECR repository policy.
Disabled node to node encryption
Disabled node-to-node encryption encryption for AWS Elasticsearch is detected.
enabled_rds_public_access_cloudformation
Enabled public accessibility for RDS database is detected.
disabled_msk_cluster_logging_cloudformation
Disabled amazon MSK cluster logging is detected.
S3 bucket restrict public bucket not true
S3 Bucket is not configured to RestrictPublicBucket.
S3 ignore public acls not true
S3 Bucket is not configured to IgnorePublicAcls.
Unencrypted code build
Unencryption is detected for CodeBuild project.
sns_topic_uses_cmk_cloudformation
Custom Master Key is not used in SNS topic for encryption of messages.
Unencrypted backup vault
Unencrypted Backup Vault is detected at rest using KMS CMK.
Disabled enforce https
Disabled EnforceHTTPS is detected for AWS Elasticsearch domains.
nonhttps_load_balancer_cloudformation
Application Load Balancer is not set to HTTPS.