Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

Terraform detectors (84/84)

Unsecured encryption of SageMaker data at rest Disabled AWS Glue security encryption Restrict IAM asterisk action Disabled AWS RDS Encryption Disabled domain logging for aws elastic search Exposed secrets in EC2 user data Unencrypted session manager logs Restrict public SNS topic policy Disabled block public acls Disabled Glue Data Catalog encryption S3 bucket restrict public bucket not true nonhttps viewer protocol policy Restrict log4j2 message lookup Restrict overly permissive VPC peering routes Restrict overly permissive access by AWS EKS to all traffic Secure AWS Database Migration Service endpoints S3 bucket block public policy not true Disabled logging for aws document db Unencrypted code build project Sns Topic Uses CMK Enabled RDS public access Disabled msk cluster logging Unsecure encryption of DAX at rest Disabled query logging Public READ bucket ACL Disabled amazon mq broker logging Unencrypted Athena workgroup Disabled neptune storage encryption disabled detailed monitoring for EC2 Undefined AWS security group ports Disabled iam authentication Unecrypted AWS Redshift using CMK Implicit SSH for AWS EKS node group Restrict IAM asterisk action Disabled doc db Disabled encryption on Aurora at rest Restrict assumed IAM role access Restrict AWS IAM policy with full administrative privileges Restrict actions with any Principal for S3 buckets Disabled ALB drops HTTP headers Timestream database not encrypted Restrict IAM policies with full 'asterisk-asterisk' administrative privileges Disabled msk cluster and in transit encryption Unencrypted workspace root volumes Disabled athena database encryption Use AWS certificate manager SSL certificate with Elastic Load Balancer Unencrypted backup vault Avoid hardcoded AWS access keys and secrets credentials Restrict IAM password reuse Disabled document db encryption Configure TLS 1.2 in AWS Load balancer Misconfigured data encryption at rest for AWS SageMaker instance Disabled configuration mfa delete Disabled AWS S3 object versioning Configure HTTPS for CloudFront distribution ViewerProtocolPolicy IAM user access console terraform Public access transfer server Unsecured Encryption in transit for EFS volumes unencryption not prevented by athena Unencrypted EBS Volumes Exposed secrets in Lambda function environment variables RDS postgresql file read vulnerability Undefined lambda function urls authtype Associate AWS Glue component with a security component Unencrypted workspace user volumes Authenticated users enable access Restrict public access on DMS replication instance S3 bucket ignore public acls not true DynamoDB Table Autoscaling Enabled Restrict Neptune cluster instance public access Disabled AWS configuration Restrict the use of asterisk actions for SQS policy documents Disabled Neptune logging Unattached Route53 A record Configure public api gateway with waf nonhttps load balancer terraform Unencryted Codebuild projects Unencrypted Secrets Manager using CMK AWS S3 public WRITE permission Restrict public IP association on EC2 instance Disabled DynamoDB Point-In-Time Recovery Missconfigured WAFv2-WEBACL with log4j Restrict public gv access policy unencrypted session manager in transit

Timestream database not encrypted Medium

Unencrypted Timestream database is detected with KMS CMK. Make sure that Timestream database is encrypted with KMS CMK.

Detector ID

terraform/timestream-database-not-encrypted-terraform@v1.0

Category

Common Weakness Enumeration (CWE)

Tags

# aws-terraform