terragoat

KO | EN

gitlite — search

#javascript #hacktoberfest #go #android #machine-learning #rust #deep-learning #docker #windows #awesome #awesome-list #pytorch #ios #mcp

(★ 1,305)

TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

File Explorer

Download Latest Version (.zip)

- - build.yaml
  - pull_request.yaml
  - semgrep.yml
- template.md
- bla.yml
- - METADATA
  - pom.xml
- pom.xml
- requirements.txt
- - bucket.tf
  - provider.tf
  - rds.tf
  - trail.tf
- - consts.tf
  - db-app.tf
  - ec2.tf
  - ecr.tf
  - eks.tf
  - elb.tf
  - es.tf
  - iam.tf
  - kms.tf
  - lambda.tf
  - neptune.tf
  - providers.tf
  - rds.tf
  - s3.tf
- - aks.tf
  - app_service.tf
  - application_gateway.tf
  - instance.tf
  - key_vault.tf
  - logging.tf
  - mssql.tf
  - networking.tf
  - policies.tf
  - provider.tf
  - random.tf
  - resource_group.tf
  - roles.tf
  - security_center.tf
  - sql.tf
  - storage.tf
  - variables.tf
- - big_data.tf
  - gcs.tf
  - gke.tf
  - instances.tf
  - networks.tf
  - provider.tf
  - README.md
  - variables.tf
- - bucket.tf
  - compartment.tf
  - data.tf
  - provider.tf
  - variables.tf
.gitignore
CODE_OF_CONDUCT.md
LICENSE
package-lock.json
README.md
terragoat-logo.png

# Installation Guide

1. Get the code

git clone https://github.com/bridgecrewio/terragoat

Downloads the entire project code from GitHub to your computer.

cd terragoat

Moves into the project folder you just downloaded.

2. Docker

Easy Recommended

Prerequisites

Git Needed to download the project code from GitHub.
Docker Desktop Needed to build and run containers. Install it and keep it running in the background.

⚠️ This is a large repository, so this method may point to an internal sub-package rather than the actual core product. Check the full README as well.

docker build -f terraform/aws/resources/Dockerfile -t terragoat .

Builds a runnable image based on the Dockerfile.

docker run -p 8080:80 terragoat

Runs the built image as an actual container.

✅ Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.

3. Maven (Java)

Medium

Prerequisites

Git Needed to download the project code from GitHub.
JDK (Java) Required to build and run Java projects.
Maven The build tool used for the mvn command.

cd packages

This project's files live in a subfolder, so move into it first.

mvn clean install

Installs dependencies and builds the project using Maven.

✅ A BUILD SUCCESS message means it worked. The output is created under target/.

4. Node.js

Easy

Prerequisites

Git Needed to download the project code from GitHub.
Node.js Node.js must be installed to use npm. The LTS version is recommended.

⚠️ This is a large repository, so this method may point to an internal sub-package rather than the actual core product. Check the full README as well.

cd packages/node/base

This project's files live in a subfolder, so move into it first.

npm install

Downloads and installs the libraries listed in package.json.

npm start

Starts the development/run server.

✅ After running the command, open the address shown in the terminal (usually something like http://localhost:3000) in your browser.

5. Python

Easy

Prerequisites

Git Needed to download the project code from GitHub.
Python 3 On Windows, be sure to check 'Add Python to PATH' during installation.

pip install -r packages/requirements.txt

Installs the Python libraries listed in requirements.txt (or similar).

python <실행할 파일명>.py # README에서 정확한 실행 파일명을 확인하세요

Runs the Python script (or module).

✅ If it runs without errors and prints output in the terminal, it worked.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# TerraGoat - Vulnerable Terraform Infrastructure

[![Maintained by Bridgecrew.io](https://img.shields.io/badge/maintained%20by-bridgecrew.io-blueviolet)](https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat)
[![Infrastructure Tests](https://www.bridgecrew.cloud/badges/github/bridgecrewio/terragoat/general)](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=bridgecrewio%2Fterragoat&benchmark=INFRASTRUCTURE+SECURITY)
[![CIS Azure](https://www.bridgecrew.cloud/badges/github/bridgecrewio/terragoat/cis_azure)](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=bridgecrewio%2Fterragoat&benchmark=CIS+AZURE+V1.1)
[![CIS GCP](https://www.bridgecrew.cloud/badges/github/bridgecrewio/terragoat/cis_gcp)](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=bridgecrewio%2Fterragoat&benchmark=CIS+GCP+V1.1)
[![CIS AWS](https://www.bridgecrew.cloud/badges/github/bridgecrewio/terragoat/cis_aws)](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=bridgecrewio%2Fterragoat&benchmark=CIS+AWS+V1.2)
[![PCI](https://www.bridgecrew.cloud/badges/github/bridgecrewio/terragoat/pci)](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=bridgecrewio%2Fterragoat&benchmark=PCI-DSS+V3.2)
![Terraform Version](https://img.shields.io/badge/tf-%3E%3D0.12.0-blue.svg) 
[![slack-community](https://img.shields.io/badge/Slack-4A154B?style=plastic&logo=slack&logoColor=white)](https://slack.bridgecrew.io/)

TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository.
![Terragoat](https://raw.githubusercontent.com/bridgecrewio/terragoat/master/terragoat-logo.png)

TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository.
TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

## Table of Contents

* [Introduction](#introduction)
* [Getting Started](#getting-started)
  * [AWS](#aws-setup)
  * [Azure](#azure-setup)
  * [GCP](#gcp-setup)
* [Contributing](#contributing)
* [Support](#support)

## Introduction

TerraGoat was built to enable DevSecOps design and implement a sustainable misconfiguration prevention strategy. It can be used to test a policy-as-code framework like [Bridgecrew](https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat) & [Checkov](https://github.com/bridgecrewio/checkov/), inline-linters, pre-commit hooks or other code scanning methods.

TerraGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development best practices for cloud infrastructure.

## Important notes

* **Where to get help:** the [Bridgecrew Community Slack](https://slack.bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat)

Before you proceed please take a not of these warning:
> :warning: TerraGoat creates intentionally vulnerable AWS resources into your account. **DO NOT deploy TerraGoat in a production environment or alongside any sensitive AWS resources.**

## Requirements

* Terraform 0.12
* aws cli
* azure cli

To prevent vulnerable infrastructure from arriving to production see: [Bridgecrew](https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat) & [checkov](https://github.com/bridgecrewio/checkov/), the open source static analysis tool for infrastructure as code.

## Getting started

### AWS Setup

#### Installation (AWS)

You can deploy multiple TerraGoat stacks in a single AWS account using the parameter `TF_VAR_environment`.

#### Create an S3 Bucket backend to keep Terraform state

```bash
export TERRAGOAT_STATE_BUCKET="mydevsecops-bucket"
export TF_VAR_company_name=acme
export TF_VAR_environment=mydevsecops
export TF_VAR_region="us-west-2"

aws s3api create-bucket --bucket $TERRAGOAT_STATE_BUCKET \
    --region $TF_VAR_region --create-bucket-configuration LocationConstraint=$TF_VAR_region

# Enable versioning
aws s3api put-bucket-versioning --bucket $TERRAGOAT_STATE_BUCKET --versioning-configuration Status=Enabled

# Enable encryption
aws s3api put-bucket-encryption --bucket $TERRAGOAT_STATE_BUCKET --server-side-encryption-configuration '{
  "Rules": [
    {
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms"
      }
    }
  ]
}'
```

#### Apply TerraGoat (AWS)

```bash
cd terraform/aws/
terraform init \
-backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
-backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
-backend-config="region=$TF_VAR_region"

terraform apply
```

#### Remove TerraGoat (AWS)

```bash
terraform destroy
```

#### Creating multiple TerraGoat AWS stacks

```bash
cd terraform/aws/
export TERRAGOAT_ENV=$TF_VAR_environment
export TERRAGOAT_STACKS_NUM=5
for i in $(seq 1 $TERRAGOAT_STACKS_NUM)
do
    export TF_VAR_environment=$TERRAGOAT_ENV$i
    terraform init \
    -backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
    -backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
    -backend-config="region=$TF_VAR_region"

terraform apply -auto-approve
done
```

#### Deleting multiple TerraGoat stacks (AWS)

```bash
cd terraform/aws/
export TF_VAR_environment = $TERRAGOAT_ENV
for i in $(seq 1 $TERRAGOAT_STACKS_NUM)
do
    export TF_VAR_environment=$TERRAGOAT_ENV$i
    terraform init \
    -backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
    -backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
    -backend-config="region=$TF_VAR_region"

terraform destroy -auto-approve
done
```

### Azure Setup

#### Installation (Azure)

You can deploy multiple TerraGoat stacks in a single Azure subscription using the parameter `TF_VAR_environment`.

#### Create an Azure Storage Account backend to keep Terraform state

```bash
export TERRAGOAT_RESOURCE_GROUP="TerraGoatRG"
export TERRAGOAT_STATE_STORAGE_ACCOUNT="mydevsecopssa"
export TERRAGOAT_STATE_CONTAINER="mydevsecops"
export TF_VAR_environment="dev"
export TF_VAR_region="westus"

# Create resource group
az group create --location $TF_VAR_region --name $TERRAGOAT_RESOURCE_GROUP

# Create storage account
az storage account create --name $TERRAGOAT_STATE_STORAGE_ACCOUNT --resource-group $TERRAGOAT_RESOURCE_GROUP --location $TF_VAR_region --sku Standard_LRS --kind StorageV2 --https-only true --encryption-services blob

# Get storage account key
ACCOUNT_KEY=$(az storage account keys list --resource-group $TERRAGOAT_RESOURCE_GROUP --account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT --query [0].value -o tsv)

# Create blob container
az storage container create --name $TERRAGOAT_STATE_CONTAINER --account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT --account-key $ACCOUNT_KEY
```

#### Apply TerraGoat (Azure)

```bash
cd terraform/azure/
terraform init -reconfigure -backend-config="resource_group_name=$TERRAGOAT_RESOURCE_GROUP" \
    -backend-config "storage_account_name=$TERRAGOAT_STATE_STORAGE_ACCOUNT" \
    -backend-config="container_name=$TERRAGOAT_STATE_CONTAINER" \
    -backend-config "key=$TF_VAR_environment.terraform.tfstate"

terraform apply
```

#### Remove TerraGoat (Azure)

```bash
terraform destroy
```

### GCP Setup

#### Installation (GCP)

You can deploy multiple TerraGoat stacks in a single GCP project using the parameter `TF_VAR_environment`.

#### Create a GCS backend to keep Terraform state

To use terraform, a Service Account and matching set of credentials are required.
If they do not exist, they must be manually created for the relevant project.
To create the Service Account:
1. Sign into your GCP project, go to `IAM` > `Service Accounts`.
2. Click the `CREATE SERVICE ACCOUNT`.
3. Give a name to your service account (for example - `terragoat`) and click `CREATE`.
4. Grant the Service Account the `Project` > `Editor` role and click `CONTINUE`.
5. Click `DONE`.

To create the credentials:
1. Sign into your GCP project, go to `IAM` > `Service Accounts` and click on the relevant Service Account.
2. Click `ADD KEY` > `Create new key` > `JSON` and click `CREATE`. This will create a `.json` file and download it to your computer.

We recommend saving the key with a nicer name than the auto-generated one (i.e. `terragoat_credentials.json`), and storing the resulting JSON file inside `terraform/gcp` directory of terragoat.
Once the credentials are set up, create the BE configuration as follows:

```bash
export TF_VAR_environment="dev"
export TF_TERRAGOAT_STATE_BUCKET=remote-state-bucket-terragoat
export TF_VAR_credentials_path=<PATH_TO_CREDNETIALS_FILE> # example: export TF_VAR_credentials_path=terragoat_credentials.json
export TF_VAR_project=<YOUR_PROJECT_NAME_HERE>

# Create storage bucket
gsutil mb gs://${TF_TERRAGOAT_STATE_BUCKET}
```

#### Apply TerraGoat (GCP)

```bash
cd terraform/gcp/
terraform init -reconfigure -backend-config="bucket=$TF_TERRAGOAT_STATE_BUCKET" \
    -backend-config "credentials=$TF_VAR_credentials_path" \
    -backend-config "prefix=terragoat/${TF_VAR_environment}"

terraform apply
```

#### Remove TerraGoat (GCP)

```bash
terraform destroy
```

## Bridgecrew's IaC herd of goats

* [CfnGoat](https://github.com/bridgecrewio/cfngoat) - Vulnerable by design Cloudformation template
* [TerraGoat](https://github.com/bridgecrewio/terragoat) - Vulnerable by design Terraform stack
* [CDKGoat](https://github.com/bridgecrewio/cdkgoat) - Vulnerable by design CDK application
* [kustomizegoat](https://github.com/bridgecrewio/kustomizegoat) - Vulnerable by design kustomize deployment
## Contributing

Contribution is welcomed!

We would love to hear about more ideas on how to find vulnerable infrastructure-as-code design patterns.

## Support

[Bridgecrew](https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat) builds and maintains TerraGoat to encourage the adoption of policy-as-code.

If you need direct support you can contact us at [info@bridgecrew.io](mailto:info@bridgecrew.io).

## Existing vulnerabilities (Auto-Generated)
### terraform scan results:

|     | check_id      | file                          | resource                                                | check_name                                                                                                                                                   | guideline                                                                                                                                    |
|-----|---------------|-------------------------------|---------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|
|   0 | CKV_ALI_10    | /alicloud/bucket.tf           | alicloud_oss_bucket.bad_bucket                          | Ensure OSS bucket has versioning enabled                                                                                                                     |                                                                                                                                              |
|   1 | CKV_ALI_12    | /alicloud/bucket.tf           | alicloud_oss_bucket.bad_bucket                          | Ensure the OSS bucket has access logging enabled                                                                                                             |                                                                                                                                              |
|   2 | CKV_ALI_11    | /alicloud/bucket.tf           | alicloud_oss_bucket.bad_bucket                          | Ensure OSS bucket has transfer Acceleration enabled                                                                                                          |                                                                                                                                              |
|   3 | CKV_ALI_1     | /alicloud/bucket.tf           | alicloud_oss_bucket.bad_bucket                          | Alibaba Cloud OSS bucket accessible to public                                                                                                                |                                                                                                                                              |
|   4 | CKV_ALI_6     | /alicloud/bucket.tf           | alicloud_oss_bucket.bad_bucket                          | Ensure OSS bucket is encrypted with Customer Master Key                                                                                                      |                                                                                                                                              |
|   5 | CKV_ALI_36    | /alicloud/rds.tf              | alicloud_db_instance.seeme                              | Ensure RDS instance has log_disconnections enabled                                                                                                           |                                                                                                                                              |
|   6 | CKV_ALI_37    | /alicloud/rds.tf              | alicloud_db_instance.seeme                              | Ensure RDS instance has log_connections enabled                                                                                                              |                                                                                                                                              |
|   7 | CKV_ALI_34    | /alicloud/rds.tf              | alicloud_db_instance.seeme                              | Ensure RDS instance is set to auto upgrade minor versions                                                                                                    |                                                                                                                                              |
|   8 | CKV_ALI_20    | /alicloud/rds.tf              | alicloud_db_instance.seeme                              | Ensure RDS instance uses SSL                                                                                                                                 |                                                                                                                                              |
|   9 | CKV_ALI_30    | /alicloud/rds.tf              | alicloud_db_instance.seeme                              | Ensure RDS instance auto upgrades for minor versions                                                                                                         |                                                                                                                                              |
|  10 | CKV_ALI_35    | /alicloud/rds.tf              | alicloud_db_instance.seeme                              | Ensure RDS instance has log_duration enabled                                                                                                                 |                                                                                                                                              |
|  11 | CKV_ALI_9     | /alicloud/rds.tf              | alicloud_db_instance.seeme                              | Ensure database instance is not public                                                                                                                       |                                                                                                                                              |
|  12 | CKV_ALI_25    | /alicloud/rds.tf              | alicloud_db_instance.seeme                              | Ensure RDS Instance SQL Collector Retention Period should be greater than 180                                                                                |                                                                                                                                              |
|  13 | CKV_ALI_4     | /alicloud/trail.tf            | alicloud_actiontrail_trail.fail                         | Ensure Action Trail Logging for all regions                                                                                                                  |                                                                                                                                              |
|  14 | CKV_ALI_5     | /alicloud/trail.tf            | alicloud_actiontrail_trail.fail                         | Ensure Action Trail Logging for all events                                                                                                                   |                                                                                                                                              |
|  15 | CKV_ALI_10    | /alicloud/trail.tf            | alicloud_oss_bucket.trail                               | Ensure OSS bucket has versioning enabled                                                                                                                     |                                                                                                                                              |
|  16 | CKV_ALI_12    | /alicloud/trail.tf            | alicloud_oss_bucket.trail                               | Ensure the OSS bucket has access logging enabled                                                                                                             |                                                                                                                                              |
|  17 | CKV_ALI_11    | /alicloud/trail.tf            | alicloud_oss_bucket.trail                               | Ensure OSS bucket has transfer Acceleration enabled                                                                                                          |                                                                                                                                              |
|  18 | CKV_ALI_6     | /alicloud/trail.tf            | alicloud_oss_bucket.trail                               | Ensure OSS bucket is encrypted with Customer Master Key                                                                                                      |                                                                                                                                              |
|  19 | CKV_AWS_157   | /aws/db-app.tf                | aws_db_instance.default                                 | Ensure that RDS instances have Multi-AZ enabled                                                                                                              | https://docs.bridgecrew.io/docs/general_73                                                                                                   |
|  20 | CKV_AWS_161   | /aws/db-app.tf                | aws_db_instance.default                                 | Ensure RDS database has IAM authentication enabled                                                                                                           | https://docs.bridgecrew.io/docs/ensure-rds-database-has-iam-authentication-enabled                                                           |
|  21 | CKV_AWS_16    | /aws/db-app.tf                | aws_db_instance.default                                 | Ensure all data stored in the RDS is securely encrypted at rest                                                                                              | https://docs.bridgecrew.io/docs/general_4                                                                                                    |
|  22 | CKV_AWS_226   | /aws/db-app.tf                | aws_db_instance.default                                 | Ensure DB instance gets all minor upgrades automatically                                                                                                     |                                                                                                                                              |
|  23 | CKV_AWS_17    | /aws/db-app.tf                | aws_db_instance.default                                 | Ensure all data stored in RDS is not publicly accessible                                                                                                     | https://docs.bridgecrew.io/docs/public_2                                                                                                     |
|  24 | CKV_AWS_118   | /aws/db-app.tf                | aws_db_instance.default                                 | Ensure that enhanced monitoring is enabled for Amazon RDS instances                                                                                          | https://docs.bridgecrew.io/docs/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances                                          |
|  25 | CKV_AWS_129   | /aws/db-app.tf                | aws_db_instance.default                                 | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled                                                                   | https://docs.bridgecrew.io/docs/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled                     |
|  26 | CKV_AWS_133   | /aws/db-app.tf                | aws_db_instance.default                                 | Ensure that RDS instances has backup policy                                                                                                                  | https://docs.bridgecrew.io/docs/ensure-that-rds-instances-have-backup-policy                                                                 |
|  27 | CKV_AWS_23    | /aws/db-app.tf                | aws_security_group.default                              | Ensure every security groups rule has a description                                                                                                          | https://docs.bridgecrew.io/docs/networking_31                                                                                                |
|  28 | CKV_AWS_23    | /aws/db-app.tf                | aws_security_group_rule.ingress                         | Ensure every security groups rule has a description                                                                                                          | https://docs.bridgecrew.io/docs/networking_31                                                                                                |
|  29 | CKV_AWS_23    | /aws/db-app.tf                | aws_security_group_rule.egress                          | Ensure every security groups rule has a description                                                                                                          | https://docs.bridgecrew.io/docs/networking_31                                                                                                |
|  30 | CKV_AWS_79    | /aws/db-app.tf                | aws_instance.db_app                                     | Ensure Instance Metadata Service Version 1 is not enabled                                                                                                    | https://docs.bridgecrew.io/docs/bc_aws_general_31                                                                                            |
|  31 | CKV_AWS_135   | /aws/db-app.tf                | aws_instance.db_app                                     | Ensure that EC2 is EBS optimized                                                                                                                             | https://docs.bridgecrew.io/docs/ensure-that-ec2-is-ebs-optimized                                                                             |
|  32 | CKV_AWS_8     | /aws/db-app.tf                | aws_instance.db_app                                     | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted                                                    | https://docs.bridgecrew.io/docs/general_13                                                                                                   |
|  33 | CKV_AWS_126   | /aws/db-app.tf                | aws_instance.db_app                                     | Ensure that detailed monitoring is enabled for EC2 instances                                                                                                 | https://docs.bridgecrew.io/docs/ensure-that-detailed-monitoring-is-enabled-for-ec2-instances                                                 |
|  34 | CKV_AWS_79    | /aws/ec2.tf                   | aws_instance.web_host                                   | Ensure Instance Metadata Service Version 1 is not enabled                                                                                                    | https://docs.bridgecrew.io/docs/bc_aws_general_31                                                                                            |
|  35 | CKV_AWS_135   | /aws/ec2.tf                   | aws_instance.web_host                                   | Ensure that EC2 is EBS optimized                                                                                                                             | https://docs.bridgecrew.io/docs/ensure-that-ec2-is-ebs-optimized                                                                             |
|  36 | CKV_AWS_8     | /aws/ec2.tf                   | aws_instance.web_host                                   | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted                                                    | https://docs.bridgecrew.io/docs/general_13                                                                                                   |
|  37 | CKV_AWS_46    | /aws/ec2.tf                   | aws_instance.web_host                                   | Ensure no hard-coded secrets exist in EC2 user data                                                                                                          | https://docs.bridgecrew.io/docs/bc_aws_secrets_1                                                                                             |
|  38 | CKV_AWS_126   | /aws/ec2.tf                   | aws_instance.web_host                                   | Ensure that detailed monitoring is enabled for EC2 instances                                                                                                 | https://docs.bridgecrew.io/docs/ensure-that-detailed-monitoring-is-enabled-for-ec2-instances                                                 |
|  39 | CKV_AWS_3     | /aws/ec2.tf                   | aws_ebs_volume.web_host_storage                         | Ensure all data stored in the EBS is securely encrypted                                                                                                      | https://docs.bridgecrew.io/docs/general_3-encrypt-eps-volume                                                                                 |
|  40 | CKV_AWS_189   | /aws/ec2.tf                   | aws_ebs_volume.web_host_storage                         | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)                                                                                     | https://docs.bridgecrew.io/docs/bc_aws_general_109                                                                                           |
|  41 | CKV_AWS_23    | /aws/ec2.tf                   | aws_security_group.web-node                             | Ensure every security groups rule has a description                                                                                                          | https://docs.bridgecrew.io/docs/networking_31                                                                                                |
|  42 | CKV_AWS_260   | /aws/ec2.tf                   | aws_security_group.web-node                             | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80                                                                                            |                                                                                                                                              |
|  43 | CKV_AWS_24    | /aws/ec2.tf                   | aws_security_group.web-node                             | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22                                                                                            | https://docs.bridgecrew.io/docs/networking_1-port-security                                                                                   |
|  44 | CKV_AWS_130   | /aws/ec2.tf                   | aws_subnet.web_subnet                                   | Ensure VPC subnets do not assign public IP by default                                                                                                        | https://docs.bridgecrew.io/docs/ensure-vpc-subnets-do-not-assign-public-ip-by-default                                                        |
|  45 | CKV_AWS_130   | /aws/ec2.tf                   | aws_subnet.web_subnet2                                  | Ensure VPC subnets do not assign public IP by default                                                                                                        | https://docs.bridgecrew.io/docs/ensure-vpc-subnets-do-not-assign-public-ip-by-default                                                        |
|  46 | CKV_AWS_136   | /aws/ecr.tf                   | aws_ecr_repository.repository                           | Ensure that ECR repositories are encrypted using KMS                                                                                                         | https://docs.bridgecrew.io/docs/ensure-that-ecr-repositories-are-encrypted                                                                   |
|  47 | CKV_AWS_51    | /aws/ecr.tf                   | aws_ecr_repository.repository                           | Ensure ECR Image Tags are immutable                                                                                                                          | https://docs.bridgecrew.io/docs/bc_aws_general_24                                                                                            |
|  48 | CKV_AWS_163   | /aws/ecr.tf                   | aws_ecr_repository.repository                           | Ensure ECR image scanning on push is enabled                                                                                                                 | https://docs.bridgecrew.io/docs/general_8                                                                                                    |
|  49 | CKV_AWS_130   | /aws/eks.tf                   | aws_subnet.eks_subnet1                                  | Ensure VPC subnets do not assign public IP by default                                                                                                        | https://docs.bridgecrew.io/docs/ensure-vpc-subnets-do-not-assign-public-ip-by-default                                                        |
|  50 | CKV_AWS_130   | /aws/eks.tf                   | aws_subnet.eks_subnet2                                  | Ensure VPC subnets do not assign public IP by default                                                                                                        | https://docs.bridgecrew.io/docs/ensure-vpc-subnets-do-not-assign-public-ip-by-default                                                        |
|  51 | CKV_AWS_39    | /aws/eks.tf                   | aws_eks_cluster.eks_cluster                             | Ensure Amazon EKS public endpoint disabled                                                                                                                   | https://docs.bridgecrew.io/docs/bc_aws_kubernetes_2                                                                                          |
|  52 | CKV_AWS_38    | /aws/eks.tf                   | aws_eks_cluster.eks_cluster                             | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0                                                                                                | https://docs.bridgecrew.io/docs/bc_aws_kubernetes_1                                                                                          |
|  53 | CKV_AWS_37    | /aws/eks.tf                   | aws_eks_cluster.eks_cluster                             | Ensure Amazon EKS control plane logging enabled for all log types                                                                                            | https://docs.bridgecrew.io/docs/bc_aws_kubernetes_4                                                                                          |
|  54 | CKV_AWS_58    | /aws/eks.tf                   | aws_eks_cluster.eks_cluster                             | Ensure EKS Cluster has Secrets Encryption Enabled                                                                                                            | https://docs.bridgecrew.io/docs/bc_aws_kubernetes_3                                                                                          |
|  55 | CKV_AWS_127   | /aws/elb.tf                   | aws_elb.weblb                                           | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager                                                               | https://docs.bridgecrew.io/docs/ensure-that-elastic-load-balancers-uses-ssl-certificates-provided-by-aws-certificate-manager                 |
|  56 | CKV_AWS_92    | /aws/elb.tf                   | aws_elb.weblb                                           | Ensure the ELB has access logging enabled                                                                                                                    | https://docs.bridgecrew.io/docs/bc_aws_logging_23                                                                                            |
|  57 | CKV_AWS_111   | /aws/es.tf                    | aws_iam_policy_document.policy                          | Ensure IAM policies does not allow write access without constraints                                                                                          | https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-write-access-without-constraint                                             |
|  58 | CKV_AWS_109   | /aws/es.tf                    | aws_iam_policy_document.policy                          | Ensure IAM policies does not allow permissions management / resource exposure without constraints                                                            | https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint                 |
|  59 | CKV_AWS_137   | /aws/es.tf                    | aws_elasticsearch_domain.monitoring-framework           | Ensure that Elasticsearch is configured inside a VPC                                                                                                         | https://docs.bridgecrew.io/docs/ensure-that-elasticsearch-is-configured-inside-a-vpc                                                         |
|  60 | CKV_AWS_247   | /aws/es.tf                    | aws_elasticsearch_domain.monitoring-framework           | Ensure all data stored in the Elasticsearch is encrypted with a CMK                                                                                          |                                                                                                                                              |
|  61 | CKV_AWS_248   | /aws/es.tf                    | aws_elasticsearch_domain.monitoring-framework           | Ensure that Elasticsearch is not using the default Security Group                                                                                            |                                                                                                                                              |
|  62 | CKV_AWS_228   | /aws/es.tf                    | aws_elasticsearch_domain.monitoring-framework           | Verify Elasticsearch domain is using an up to date TLS policy                                                                                                |                                                                                                                                              |
|  63 | CKV_AWS_84    | /aws/es.tf                    | aws_elasticsearch_domain.monitoring-framework           | Ensure Elasticsearch Domain Logging is enabled                                                                                                               | https://docs.bridgecrew.io/docs/elasticsearch_7                                                                                              |
|  64 | CKV_AWS_5     | /aws/es.tf                    | aws_elasticsearch_domain.monitoring-framework           | Ensure all data stored in the Elasticsearch is securely encrypted at rest                                                                                    | https://docs.bridgecrew.io/docs/elasticsearch_3-enable-encryptionatrest                                                                      |
|  65 | CKV_AWS_7     | /aws/kms.tf                   | aws_kms_key.logs_key                                    | Ensure rotation for customer created CMKs is enabled                                                                                                         | https://docs.bridgecrew.io/docs/logging_8                                                                                                    |
|  66 | CKV_AWS_115   | /aws/lambda.tf                | aws_lambda_function.analysis_lambda                     | Ensure that AWS Lambda function is configured for function-level concurrent execution limit                                                                  | https://docs.bridgecrew.io/docs/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit                  |
|  67 | CKV_AWS_45    | /aws/lambda.tf                | aws_lambda_function.analysis_lambda                     | Ensure no hard-coded secrets exist in lambda environment                                                                                                     | https://docs.bridgecrew.io/docs/bc_aws_secrets_3                                                                                             |
|  68 | CKV_AWS_50    | /aws/lambda.tf                | aws_lambda_function.analysis_lambda                     | X-ray tracing is enabled for Lambda                                                                                                                          | https://docs.bridgecrew.io/docs/bc_aws_serverless_4                                                                                          |
|  69 | CKV_AWS_117   | /aws/lambda.tf                | aws_lambda_function.analysis_lambda                     | Ensure that AWS Lambda function is configured inside a VPC                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1                                                 |
|  70 | CKV_AWS_173   | /aws/lambda.tf                | aws_lambda_function.analysis_lambda                     | Check encryption settings for Lambda environmental variable                                                                                                  | https://docs.bridgecrew.io/docs/bc_aws_serverless_5                                                                                          |
|  71 | CKV_AWS_116   | /aws/lambda.tf                | aws_lambda_function.analysis_lambda                     | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq                                    |
|  72 | CKV_AWS_44    | /aws/neptune.tf               | aws_neptune_cluster.default                             | Ensure Neptune storage is securely encrypted                                                                                                                 | https://docs.bridgecrew.io/docs/general_18                                                                                                   |
|  73 | CKV_AWS_101   | /aws/neptune.tf               | aws_neptune_cluster.default                             | Ensure Neptune logging is enabled                                                                                                                            | https://docs.bridgecrew.io/docs/bc_aws_logging_24                                                                                            |
|  74 | CKV_AWS_41    | /aws/providers.tf             | aws.plain_text_access_keys_provider                     | Ensure no hard coded AWS access key and secret key exists in provider                                                                                        | https://docs.bridgecrew.io/docs/bc_aws_secrets_5                                                                                             |
|  75 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app1-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
|  76 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app1-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
|  77 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app1-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
|  78 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app1-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
|  79 | CKV_AWS_133   | /aws/rds.tf                   | aws_rds_cluster.app1-rds-cluster                        | Ensure that RDS instances has backup policy                                                                                                                  | https://docs.bridgecrew.io/docs/ensure-that-rds-instances-have-backup-policy                                                                 |
|  80 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app2-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
|  81 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app2-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
|  82 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app2-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
|  83 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app2-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
|  84 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app3-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
|  85 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app3-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
|  86 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app3-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
|  87 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app3-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
|  88 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app4-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
|  89 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app4-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
|  90 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app4-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
|  91 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app4-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
|  92 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app5-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
|  93 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app5-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
|  94 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app5-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
|  95 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app5-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
|  96 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app6-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
|  97 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app6-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
|  98 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app6-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
|  99 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app6-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
| 100 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app7-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
| 101 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app7-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
| 102 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app7-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
| 103 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app7-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
| 104 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app8-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
| 105 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app8-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
| 106 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app8-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
| 107 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app8-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
| 108 | CKV_AWS_128   | /aws/rds.tf                   | aws_rds_cluster.app9-rds-cluster                        | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled                                                      | https://docs.bridgecrew.io/docs/ensure-that-an-amazon-rds-clusters-have-iam-authentication-enabled                                           |
| 109 | CKV_AWS_139   | /aws/rds.tf                   | aws_rds_cluster.app9-rds-cluster                        | Ensure that RDS clusters have deletion protection enabled                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled                                      |
| 110 | CKV_AWS_96    | /aws/rds.tf                   | aws_rds_cluster.app9-rds-cluster                        | Ensure all data stored in Aurora is securely encrypted at rest                                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_38                                                                                            |
| 111 | CKV_AWS_162   | /aws/rds.tf                   | aws_rds_cluster.app9-rds-cluster                        | Ensure RDS cluster has IAM authentication enabled                                                                                                            | https://docs.bridgecrew.io/docs/ensure-rds-cluster-has-iam-authentication-enabled                                                            |
| 112 | CKV_AWS_186   | /aws/s3.tf                    | aws_s3_bucket_object.data_object                        | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK)                                                                               | https://docs.bridgecrew.io/docs/bc_aws_general_106                                                                                           |
| 113 | CKV_AZURE_116 | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure that AKS uses Azure Policies Add-on                                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-aks-uses-azure-policies-add-on                                                                   |
| 114 | CKV_AZURE_8   | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure Kubernetes Dashboard is disabled                                                                                                                      | https://docs.bridgecrew.io/docs/bc_azr_kubernetes_5                                                                                          |
| 115 | CKV_AZURE_4   | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure AKS logging to Azure Monitoring is Configured                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_kubernetes_1                                                                                          |
| 116 | CKV_AZURE_117 | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure that AKS uses disk encryption set                                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-aks-uses-disk-encryption-set                                                                     |
| 117 | CKV_AZURE_115 | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure that AKS enables private clusters                                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-aks-enables-private-clusters                                                                     |
| 118 | CKV_AZURE_141 | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure AKS local admin account is disabled                                                                                                                   |                                                                                                                                              |
| 119 | CKV_AZURE_7   | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure AKS cluster has Network Policy configured                                                                                                             | https://docs.bridgecrew.io/docs/bc_azr_kubernetes_4                                                                                          |
| 120 | CKV_AZURE_6   | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure AKS has an API Server Authorized IP Ranges enabled                                                                                                    | https://docs.bridgecrew.io/docs/bc_azr_kubernetes_3                                                                                          |
| 121 | CKV_AZURE_5   | /azure/aks.tf                 | azurerm_kubernetes_cluster.k8s_cluster                  | Ensure RBAC is enabled on AKS clusters                                                                                                                       | https://docs.bridgecrew.io/docs/bc_azr_kubernetes_2                                                                                          |
| 122 | CKV_AZURE_15  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure web app is using the latest version of TLS encryption                                                                                                 | https://docs.bridgecrew.io/docs/bc_azr_networking_6                                                                                          |
| 123 | CKV_AZURE_78  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure FTP deployments are disabled                                                                                                                          | https://docs.bridgecrew.io/docs/ensure-ftp-deployments-are-disabled                                                                          |
| 124 | CKV_AZURE_18  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure that 'HTTP Version' is the latest if used to run the web app                                                                                          | https://docs.bridgecrew.io/docs/bc_azr_networking_8                                                                                          |
| 125 | CKV_AZURE_88  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure that app services use Azure Files                                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-app-services-use-azure-files                                                                     |
| 126 | CKV_AZURE_13  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure App Service Authentication is set on Azure App Service                                                                                                | https://docs.bridgecrew.io/docs/bc_azr_general_2                                                                                             |
| 127 | CKV_AZURE_71  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure that Managed identity provider is enabled for app services                                                                                            | https://docs.bridgecrew.io/docs/ensure-that-managed-identity-provider-is-enabled-for-app-services                                            |
| 128 | CKV_AZURE_80  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure that 'Net Framework' version is the latest, if used as a part of the web app                                                                          | https://docs.bridgecrew.io/docs/ensure-that-net-framework-version-is-the-latest-if-used-as-a-part-of-the-web-app                             |
| 129 | CKV_AZURE_65  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure that App service enables detailed error messages                                                                                                      | https://docs.bridgecrew.io/docs/tbdensure-that-app-service-enables-detailed-error-messages                                                   |
| 130 | CKV_AZURE_63  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure that App service enables HTTP logging                                                                                                                 | https://docs.bridgecrew.io/docs/ensure-that-app-service-enables-http-logging                                                                 |
| 131 | CKV_AZURE_17  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure the web app has 'Client Certificates (Incoming client certificates)' set                                                                              | https://docs.bridgecrew.io/docs/bc_azr_networking_7                                                                                          |
| 132 | CKV_AZURE_16  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure that Register with Azure Active Directory is enabled on App Service                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_iam_1                                                                                                 |
| 133 | CKV_AZURE_66  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure that App service enables failed request tracing                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-app-service-enables-failed-request-tracing                                                       |
| 134 | CKV_AZURE_14  | /azure/app_service.tf         | azurerm_app_service.app-service1                        | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service                                                                                      | https://docs.bridgecrew.io/docs/bc_azr_networking_5                                                                                          |
| 135 | CKV_AZURE_78  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure FTP deployments are disabled                                                                                                                          | https://docs.bridgecrew.io/docs/ensure-ftp-deployments-are-disabled                                                                          |
| 136 | CKV_AZURE_18  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure that 'HTTP Version' is the latest if used to run the web app                                                                                          | https://docs.bridgecrew.io/docs/bc_azr_networking_8                                                                                          |
| 137 | CKV_AZURE_88  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure that app services use Azure Files                                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-app-services-use-azure-files                                                                     |
| 138 | CKV_AZURE_13  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure App Service Authentication is set on Azure App Service                                                                                                | https://docs.bridgecrew.io/docs/bc_azr_general_2                                                                                             |
| 139 | CKV_AZURE_71  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure that Managed identity provider is enabled for app services                                                                                            | https://docs.bridgecrew.io/docs/ensure-that-managed-identity-provider-is-enabled-for-app-services                                            |
| 140 | CKV_AZURE_80  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure that 'Net Framework' version is the latest, if used as a part of the web app                                                                          | https://docs.bridgecrew.io/docs/ensure-that-net-framework-version-is-the-latest-if-used-as-a-part-of-the-web-app                             |
| 141 | CKV_AZURE_65  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure that App service enables detailed error messages                                                                                                      | https://docs.bridgecrew.io/docs/tbdensure-that-app-service-enables-detailed-error-messages                                                   |
| 142 | CKV_AZURE_63  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure that App service enables HTTP logging                                                                                                                 | https://docs.bridgecrew.io/docs/ensure-that-app-service-enables-http-logging                                                                 |
| 143 | CKV_AZURE_17  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure the web app has 'Client Certificates (Incoming client certificates)' set                                                                              | https://docs.bridgecrew.io/docs/bc_azr_networking_7                                                                                          |
| 144 | CKV_AZURE_16  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure that Register with Azure Active Directory is enabled on App Service                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_iam_1                                                                                                 |
| 145 | CKV_AZURE_66  | /azure/app_service.tf         | azurerm_app_service.app-service2                        | Ensure that App service enables failed request tracing                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-app-service-enables-failed-request-tracing                                                       |
| 146 | CKV_AZURE_1   | /azure/instance.tf            | azurerm_linux_virtual_machine.linux_machine             | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)                                                                                 | https://docs.bridgecrew.io/docs/bc_azr_networking_1                                                                                          |
| 147 | CKV_AZURE_50  | /azure/instance.tf            | azurerm_linux_virtual_machine.linux_machine             | Ensure Virtual Machine Extensions are not Installed                                                                                                          | https://docs.bridgecrew.io/docs/bc_azr_general_14                                                                                            |
| 148 | CKV_AZURE_149 | /azure/instance.tf            | azurerm_linux_virtual_machine.linux_machine             | Ensure that Virtual machine does not enable password authentication                                                                                          |                                                                                                                                              |
| 149 | CKV_AZURE_151 | /azure/instance.tf            | azurerm_windows_virtual_machine.windows_machine         | Ensure Windows VM enables encryption                                                                                                                         |                                                                                                                                              |
| 150 | CKV_AZURE_50  | /azure/instance.tf            | azurerm_windows_virtual_machine.windows_machine         | Ensure Virtual Machine Extensions are not Installed                                                                                                          | https://docs.bridgecrew.io/docs/bc_azr_general_14                                                                                            |
| 151 | CKV_AZURE_109 | /azure/key_vault.tf           | azurerm_key_vault.example                               | Ensure that key vault allows firewall rules settings                                                                                                         | https://docs.bridgecrew.io/docs/ensure-that-key-vault-allows-firewall-rules-settings                                                         |
| 152 | CKV_AZURE_42  | /azure/key_vault.tf           | azurerm_key_vault.example                               | Ensure the key vault is recoverable                                                                                                                          | https://docs.bridgecrew.io/docs/ensure-the-key-vault-is-recoverable                                                                          |
| 153 | CKV_AZURE_110 | /azure/key_vault.tf           | azurerm_key_vault.example                               | Ensure that key vault enables purge protection                                                                                                               | https://docs.bridgecrew.io/docs/ensure-that-key-vault-enables-purge-protection                                                               |
| 154 | CKV_AZURE_112 | /azure/key_vault.tf           | azurerm_key_vault_key.generated                         | Ensure that key vault key is backed by HSM                                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-key-vault-key-is-backed-by-hsm                                                                   |
| 155 | CKV_AZURE_40  | /azure/key_vault.tf           | azurerm_key_vault_key.generated                         | Ensure that the expiration date is set on all keys                                                                                                           | https://docs.bridgecrew.io/docs/set-an-expiration-date-on-all-keys                                                                           |
| 156 | CKV_AZURE_114 | /azure/key_vault.tf           | azurerm_key_vault_secret.secret                         | Ensure that key vault secrets have "content_type" set                                                                                                        | https://docs.bridgecrew.io/docs/ensure-that-key-vault-secrets-have-content_type-set                                                          |
| 157 | CKV_AZURE_41  | /azure/key_vault.tf           | azurerm_key_vault_secret.secret                         | Ensure that the expiration date is set on all secrets                                                                                                        | https://docs.bridgecrew.io/docs/set-an-expiration-date-on-all-secrets                                                                        |
| 158 | CKV_AZURE_38  | /azure/logging.tf             | azurerm_monitor_log_profile.logging_profile             | Ensure audit profile captures all the activities                                                                                                             | https://docs.bridgecrew.io/docs/ensure-audit-profile-captures-all-activities                                                                 |
| 159 | CKV_AZURE_37  | /azure/logging.tf             | azurerm_monitor_log_profile.logging_profile             | Ensure that Activity Log Retention is set 365 days or greater                                                                                                | https://docs.bridgecrew.io/docs/set-activity-log-retention-to-365-days-or-greater                                                            |
| 160 | CKV_AZURE_35  | /azure/mssql.tf               | azurerm_storage_account.security_storage_account        | Ensure default network access rule for Storage Accounts is set to deny                                                                                       | https://docs.bridgecrew.io/docs/set-default-network-access-rule-for-storage-accounts-to-deny                                                 |
| 161 | CKV_AZURE_33  | /azure/mssql.tf               | azurerm_storage_account.security_storage_account        | Ensure Storage logging is enabled for Queue service for read, write and delete requests                                                                      | https://docs.bridgecrew.io/docs/enable-requests-on-storage-logging-for-queue-service                                                         |
| 162 | CKV_AZURE_44  | /azure/mssql.tf               | azurerm_storage_account.security_storage_account        | Ensure Storage Account is using the latest version of TLS encryption                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_storage_2                                                                                             |
| 163 | CKV_AZURE_52  | /azure/mssql.tf               | azurerm_mssql_server.mssql1                             | Ensure MSSQL is using the latest version of TLS encryption                                                                                                   | https://docs.bridgecrew.io/docs/ensure-mssql-is-using-the-latest-version-of-tls-encryption                                                   |
| 164 | CKV_AZURE_113 | /azure/mssql.tf               | azurerm_mssql_server.mssql1                             | Ensure that SQL server disables public network access                                                                                                        | https://docs.bridgecrew.io/docs/ensure-that-sql-server-disables-public-network-access                                                        |
| 165 | CKV_AZURE_52  | /azure/mssql.tf               | azurerm_mssql_server.mssql2                             | Ensure MSSQL is using the latest version of TLS encryption                                                                                                   | https://docs.bridgecrew.io/docs/ensure-mssql-is-using-the-latest-version-of-tls-encryption                                                   |
| 166 | CKV_AZURE_113 | /azure/mssql.tf               | azurerm_mssql_server.mssql2                             | Ensure that SQL server disables public network access                                                                                                        | https://docs.bridgecrew.io/docs/ensure-that-sql-server-disables-public-network-access                                                        |
| 167 | CKV_AZURE_52  | /azure/mssql.tf               | azurerm_mssql_server.mssql3                             | Ensure MSSQL is using the latest version of TLS encryption                                                                                                   | https://docs.bridgecrew.io/docs/ensure-mssql-is-using-the-latest-version-of-tls-encryption                                                   |
| 168 | CKV_AZURE_113 | /azure/mssql.tf               | azurerm_mssql_server.mssql3                             | Ensure that SQL server disables public network access                                                                                                        | https://docs.bridgecrew.io/docs/ensure-that-sql-server-disables-public-network-access                                                        |
| 169 | CKV_AZURE_52  | /azure/mssql.tf               | azurerm_mssql_server.mssql4                             | Ensure MSSQL is using the latest version of TLS encryption                                                                                                   | https://docs.bridgecrew.io/docs/ensure-mssql-is-using-the-latest-version-of-tls-encryption                                                   |
| 170 | CKV_AZURE_113 | /azure/mssql.tf               | azurerm_mssql_server.mssql4                             | Ensure that SQL server disables public network access                                                                                                        | https://docs.bridgecrew.io/docs/ensure-that-sql-server-disables-public-network-access                                                        |
| 171 | CKV_AZURE_52  | /azure/mssql.tf               | azurerm_mssql_server.mssql5                             | Ensure MSSQL is using the latest version of TLS encryption                                                                                                   | https://docs.bridgecrew.io/docs/ensure-mssql-is-using-the-latest-version-of-tls-encryption                                                   |
| 172 | CKV_AZURE_113 | /azure/mssql.tf               | azurerm_mssql_server.mssql5                             | Ensure that SQL server disables public network access                                                                                                        | https://docs.bridgecrew.io/docs/ensure-that-sql-server-disables-public-network-access                                                        |
| 173 | CKV_AZURE_52  | /azure/mssql.tf               | azurerm_mssql_server.mssql6                             | Ensure MSSQL is using the latest version of TLS encryption                                                                                                   | https://docs.bridgecrew.io/docs/ensure-mssql-is-using-the-latest-version-of-tls-encryption                                                   |
| 174 | CKV_AZURE_113 | /azure/mssql.tf               | azurerm_mssql_server.mssql6                             | Ensure that SQL server disables public network access                                                                                                        | https://docs.bridgecrew.io/docs/ensure-that-sql-server-disables-public-network-access                                                        |
| 175 | CKV_AZURE_52  | /azure/mssql.tf               | azurerm_mssql_server.mssql7                             | Ensure MSSQL is using the latest version of TLS encryption                                                                                                   | https://docs.bridgecrew.io/docs/ensure-mssql-is-using-the-latest-version-of-tls-encryption                                                   |
| 176 | CKV_AZURE_113 | /azure/mssql.tf               | azurerm_mssql_server.mssql7                             | Ensure that SQL server disables public network access                                                                                                        | https://docs.bridgecrew.io/docs/ensure-that-sql-server-disables-public-network-access                                                        |
| 177 | CKV_AZURE_25  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy1 | Ensure that 'Threat Detection types' is set to 'All'                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_general_6                                                                                             |
| 178 | CKV_AZURE_27  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy1 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_8                                                                                             |
| 179 | CKV_AZURE_25  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy2 | Ensure that 'Threat Detection types' is set to 'All'                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_general_6                                                                                             |
| 180 | CKV_AZURE_27  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy2 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_8                                                                                             |
| 181 | CKV_AZURE_25  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy3 | Ensure that 'Threat Detection types' is set to 'All'                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_general_6                                                                                             |
| 182 | CKV_AZURE_27  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy3 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_8                                                                                             |
| 183 | CKV_AZURE_25  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy4 | Ensure that 'Threat Detection types' is set to 'All'                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_general_6                                                                                             |
| 184 | CKV_AZURE_27  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy4 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_8                                                                                             |
| 185 | CKV_AZURE_25  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy5 | Ensure that 'Threat Detection types' is set to 'All'                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_general_6                                                                                             |
| 186 | CKV_AZURE_26  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy5 | Ensure that 'Send Alerts To' is enabled for MSSQL servers                                                                                                    | https://docs.bridgecrew.io/docs/bc_azr_general_7                                                                                             |
| 187 | CKV_AZURE_27  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy5 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_8                                                                                             |
| 188 | CKV_AZURE_25  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy6 | Ensure that 'Threat Detection types' is set to 'All'                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_general_6                                                                                             |
| 189 | CKV_AZURE_27  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy6 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_8                                                                                             |
| 190 | CKV_AZURE_25  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy7 | Ensure that 'Threat Detection types' is set to 'All'                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_general_6                                                                                             |
| 191 | CKV_AZURE_27  | /azure/mssql.tf               | azurerm_mssql_server_security_alert_policy.alertpolicy7 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_8                                                                                             |
| 192 | CKV_AZURE_10  | /azure/networking.tf          | azurerm_network_security_group.bad_sg                   | Ensure that SSH access is restricted from the internet                                                                                                       | https://docs.bridgecrew.io/docs/bc_azr_networking_3                                                                                          |
| 193 | CKV_AZURE_9   | /azure/networking.tf          | azurerm_network_security_group.bad_sg                   | Ensure that RDP access is restricted from the internet                                                                                                       | https://docs.bridgecrew.io/docs/bc_azr_networking_2                                                                                          |
| 194 | CKV_AZURE_12  | /azure/networking.tf          | azurerm_network_watcher_flow_log.flow_log               | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'                                                                       | https://docs.bridgecrew.io/docs/bc_azr_logging_1                                                                                             |
| 195 | CKV_AZURE_39  | /azure/roles.tf               | azurerm_role_definition.example                         | Ensure that no custom subscription owner roles are created                                                                                                   | https://docs.bridgecrew.io/docs/do-not-create-custom-subscription-owner-roles                                                                |
| 196 | CKV_AZURE_19  | /azure/security_center.tf     | azurerm_security_center_subscription_pricing.pricing    | Ensure that standard pricing tier is selected                                                                                                                | https://docs.bridgecrew.io/docs/ensure-standard-pricing-tier-is-selected                                                                     |
| 197 | CKV_AZURE_20  | /azure/security_center.tf     | azurerm_security_center_contact.contact                 | Ensure that security contact 'Phone number' is set                                                                                                           | https://docs.bridgecrew.io/docs/bc_azr_general_3                                                                                             |
| 198 | CKV_AZURE_22  | /azure/security_center.tf     | azurerm_security_center_contact.contact                 | Ensure that 'Send email notification for high severity alerts' is set to 'On'                                                                                | https://docs.bridgecrew.io/docs/bc_azr_general_5                                                                                             |
| 199 | CKV_AZURE_21  | /azure/security_center.tf     | azurerm_security_center_contact.contact                 | Ensure that 'Send email notification for high severity alerts' is set to 'On'                                                                                | https://docs.bridgecrew.io/docs/bc_azr_general_4                                                                                             |
| 200 | CKV_AZURE_25  | /azure/sql.tf                 | azurerm_mssql_server_security_alert_policy.example      | Ensure that 'Threat Detection types' is set to 'All'                                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_general_6                                                                                             |
| 201 | CKV_AZURE_26  | /azure/sql.tf                 | azurerm_mssql_server_security_alert_policy.example      | Ensure that 'Send Alerts To' is enabled for MSSQL servers                                                                                                    | https://docs.bridgecrew.io/docs/bc_azr_general_7                                                                                             |
| 202 | CKV_AZURE_27  | /azure/sql.tf                 | azurerm_mssql_server_security_alert_policy.example      | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_8                                                                                             |
| 203 | CKV_AZURE_127 | /azure/sql.tf                 | azurerm_mysql_server.example                            | Ensure that My SQL server enables Threat detection policy                                                                                                    | https://docs.bridgecrew.io/docs/ensure-that-my-sql-server-enables-threat-detection-policy                                                    |
| 204 | CKV_AZURE_94  | /azure/sql.tf                 | azurerm_mysql_server.example                            | Ensure that My SQL server enables geo-redundant backups                                                                                                      | https://docs.bridgecrew.io/docs/ensure-that-my-sql-server-enables-geo-redundant-backups                                                      |
| 205 | CKV_AZURE_53  | /azure/sql.tf                 | azurerm_mysql_server.example                            | Ensure 'public network access enabled' is set to 'False' for mySQL servers                                                                                   | https://docs.bridgecrew.io/docs/ensure-public-network-access-enabled-is-set-to-false-for-mysql-servers                                       |
| 206 | CKV_AZURE_54  | /azure/sql.tf                 | azurerm_mysql_server.example                            | Ensure MySQL is using the latest version of TLS encryption                                                                                                   | https://docs.bridgecrew.io/docs/ensure-mysql-is-using-the-latest-version-of-tls-encryption                                                   |
| 207 | CKV_AZURE_28  | /azure/sql.tf                 | azurerm_mysql_server.example                            | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server                                                                                | https://docs.bridgecrew.io/docs/bc_azr_networking_9                                                                                          |
| 208 | CKV_AZURE_147 | /azure/sql.tf                 | azurerm_postgresql_server.example                       | Ensure PostgreSQL is using the latest version of TLS encryption                                                                                              |                                                                                                                                              |
| 209 | CKV_AZURE_130 | /azure/sql.tf                 | azurerm_postgresql_server.example                       | Ensure that PostgreSQL server enables infrastructure encryption                                                                                              | https://docs.bridgecrew.io/docs/ensure-that-postgresql-server-enables-infrastructure-encryption                                              |
| 210 | CKV_AZURE_29  | /azure/sql.tf                 | azurerm_postgresql_server.example                       | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server                                                                           | https://docs.bridgecrew.io/docs/bc_azr_networking_10                                                                                         |
| 211 | CKV_AZURE_128 | /azure/sql.tf                 | azurerm_postgresql_server.example                       | Ensure that PostgreSQL server enables Threat detection policy                                                                                                | https://docs.bridgecrew.io/docs/ensure-that-postgresql-server-enables-threat-detection-policy                                                |
| 212 | CKV_AZURE_102 | /azure/sql.tf                 | azurerm_postgresql_server.example                       | Ensure that PostgreSQL server enables geo-redundant backups                                                                                                  | https://docs.bridgecrew.io/docs/ensure-that-postgresql-server-enables-geo-redundant-backups                                                  |
| 213 | CKV_AZURE_68  | /azure/sql.tf                 | azurerm_postgresql_server.example                       | Ensure that PostgreSQL server disables public network access                                                                                                 | https://docs.bridgecrew.io/docs/ensure-that-postgresql-server-disables-public-network-access                                                 |
| 214 | CKV_AZURE_32  | /azure/sql.tf                 | azurerm_postgresql_configuration.thrtottling_config     | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server                                                                | https://docs.bridgecrew.io/docs/bc_azr_networking_13                                                                                         |
| 215 | CKV_AZURE_30  | /azure/sql.tf                 | azurerm_postgresql_configuration.example                | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server                                                                      | https://docs.bridgecrew.io/docs/bc_azr_networking_11                                                                                         |
| 216 | CKV_AZURE_2   | /azure/storage.tf             | azurerm_managed_disk.example                            | Ensure Azure managed disk has encryption enabled                                                                                                             | https://docs.bridgecrew.io/docs/bc_azr_general_1                                                                                             |
| 217 | CKV_AZURE_93  | /azure/storage.tf             | azurerm_managed_disk.example                            | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption                                                 | https://docs.bridgecrew.io/docs/ensure-that-managed-disks-use-a-specific-set-of-disk-encryption-sets-for-the-customer-managed-key-encryption |
| 218 | CKV_AZURE_35  | /azure/storage.tf             | azurerm_storage_account.example                         | Ensure default network access rule for Storage Accounts is set to deny                                                                                       | https://docs.bridgecrew.io/docs/set-default-network-access-rule-for-storage-accounts-to-deny                                                 |
| 219 | CKV_AZURE_3   | /azure/storage.tf             | azurerm_storage_account.example                         | Ensure that 'Secure transfer required' is set to 'Enabled'                                                                                                   |                                                                                                                                              |
| 220 | CKV_AZURE_33  | /azure/storage.tf             | azurerm_storage_account.example                         | Ensure Storage logging is enabled for Queue service for read, write and delete requests                                                                      | https://docs.bridgecrew.io/docs/enable-requests-on-storage-logging-for-queue-service                                                         |
| 221 | CKV_AZURE_44  | /azure/storage.tf             | azurerm_storage_account.example                         | Ensure Storage Account is using the latest version of TLS encryption                                                                                         | https://docs.bridgecrew.io/docs/bc_azr_storage_2                                                                                             |
| 222 | CKV_AZURE_36  | /azure/storage.tf             | azurerm_storage_account_network_rules.test              | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access                                                                                    | https://docs.bridgecrew.io/docs/enable-trusted-microsoft-services-for-storage-account-access                                                 |
| 223 | CKV_GCP_6     | /gcp/big_data.tf              | google_sql_database_instance.master_instance            | Ensure all Cloud SQL database instance requires all incoming connections to use SSL                                                                          | https://docs.bridgecrew.io/docs/bc_gcp_general_1                                                                                             |
| 224 | CKV_GCP_11    | /gcp/big_data.tf              | google_sql_database_instance.master_instance            | Ensure that Cloud SQL database Instances are not open to the world                                                                                           | https://docs.bridgecrew.io/docs/bc_gcp_networking_4                                                                                          |
| 225 | CKV_GCP_79    | /gcp/big_data.tf              | google_sql_database_instance.master_instance            | Ensure SQL database is using latest Major version                                                                                                            |                                                                                                                                              |
| 226 | CKV_GCP_60    | /gcp/big_data.tf              | google_sql_database_instance.master_instance            | Ensure Cloud SQL database does not have public IP                                                                                                            | https://docs.bridgecrew.io/docs/bc_gcp_sql_11                                                                                                |
| 227 | CKV_GCP_14    | /gcp/big_data.tf              | google_sql_database_instance.master_instance            | Ensure all Cloud SQL database instance have backup configuration enabled                                                                                     | https://docs.bridgecrew.io/docs/bc_gcp_general_2                                                                                             |
| 228 | CKV_GCP_15    | /gcp/big_data.tf              | google_bigquery_dataset.dataset                         | Ensure that BigQuery datasets are not anonymously or publicly accessible                                                                                     | https://docs.bridgecrew.io/docs/bc_gcp_general_3                                                                                             |
| 229 | CKV_GCP_81    | /gcp/big_data.tf              | google_bigquery_dataset.dataset                         | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)                                                                          |                                                                                                                                              |
| 230 | CKV_GCP_62    | /gcp/gcs.tf                   | google_storage_bucket.terragoat_website                 | Bucket should log access                                                                                                                                     | https://docs.bridgecrew.io/docs/bc_gcp_logging_2                                                                                             |
| 231 | CKV_GCP_78    | /gcp/gcs.tf                   | google_storage_bucket.terragoat_website                 | Ensure Cloud storage has versioning enabled                                                                                                                  |                                                                                                                                              |
| 232 | CKV_GCP_29    | /gcp/gcs.tf                   | google_storage_bucket.terragoat_website                 | Ensure that Cloud Storage buckets have uniform bucket-level access enabled                                                                                   | https://docs.bridgecrew.io/docs/bc_gcp_gcs_2                                                                                                 |
| 233 | CKV_GCP_28    | /gcp/gcs.tf                   | google_storage_bucket_iam_binding.allow_public_read     | Ensure that Cloud Storage bucket is not anonymously or publicly accessible                                                                                   | https://docs.bridgecrew.io/docs/bc_gcp_public_1                                                                                              |
| 234 | CKV_GCP_70    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure the GKE Release Channel is set                                                                                                                        | https://docs.bridgecrew.io/docs/ensure-the-gke-release-channel-is-set                                                                        |
| 235 | CKV_GCP_69    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure the GKE Metadata Server is Enabled                                                                                                                    | https://docs.bridgecrew.io/docs/ensure-the-gke-metadata-server-is-enabled                                                                    |
| 236 | CKV_GCP_67    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure legacy Compute Engine instance metadata APIs are Disabled                                                                                             | https://docs.bridgecrew.io/docs/ensure-legacy-compute-engine-instance-metadata-apis-are-disabled                                             |
| 237 | CKV_GCP_19    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure GKE basic auth is disabled                                                                                                                            | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_11                                                                                         |
| 238 | CKV_GCP_21    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure Kubernetes Clusters are configured with Labels                                                                                                        | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_13                                                                                         |
| 239 | CKV_GCP_66    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure use of Binary Authorization                                                                                                                           | https://docs.bridgecrew.io/docs/ensure-use-of-binary-authorization                                                                           |
| 240 | CKV_GCP_61    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Enable VPC Flow Logs and Intranode Visibility                                                                                                                | https://docs.bridgecrew.io/docs/enable-vpc-flow-logs-and-intranode-visibility                                                                |
| 241 | CKV_GCP_25    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure Kubernetes Cluster is created with Private cluster enabled                                                                                            | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_6                                                                                          |
| 242 | CKV_GCP_1     | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters                                                                                   | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_1                                                                                          |
| 243 | CKV_GCP_18    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure GKE Control Plane is not public                                                                                                                       | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_10                                                                                         |
| 244 | CKV_GCP_64    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure clusters are created with Private Nodes                                                                                                               | https://docs.bridgecrew.io/docs/ensure-clusters-are-created-with-private-nodes                                                               |
| 245 | CKV_GCP_13    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled                                                                           | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_8                                                                                          |
| 246 | CKV_GCP_12    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure Network Policy is enabled on Kubernetes Engine Clusters                                                                                               | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_7                                                                                          |
| 247 | CKV_GCP_65    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Manage Kubernetes RBAC users with Google Groups for GKE                                                                                                      | https://docs.bridgecrew.io/docs/manage-kubernetes-rbac-users-with-google-groups-for-gke                                                      |
| 248 | CKV_GCP_24    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters                                                                             | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_9                                                                                          |
| 249 | CKV_GCP_7     | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters                                                                                 | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_2                                                                                          |
| 250 | CKV_GCP_23    | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure Kubernetes Cluster is created with Alias IP ranges enabled                                                                                            | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_15                                                                                         |
| 251 | CKV_GCP_8     | /gcp/gke.tf                   | google_container_cluster.workload_cluster               | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters                                                                                | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_3                                                                                          |
| 252 | CKV_GCP_68    | /gcp/gke.tf                   | google_container_node_pool.custom_node_pool             | Ensure Secure Boot for Shielded GKE Nodes is Enabled                                                                                                         | https://docs.bridgecrew.io/docs/ensure-secure-boot-for-shielded-gke-nodes-is-enabled                                                         |
| 253 | CKV_GCP_22    | /gcp/gke.tf                   | google_container_node_pool.custom_node_pool             | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image                                                                        | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_14                                                                                         |
| 254 | CKV_GCP_69    | /gcp/gke.tf                   | google_container_node_pool.custom_node_pool             | Ensure the GKE Metadata Server is Enabled                                                                                                                    | https://docs.bridgecrew.io/docs/ensure-the-gke-metadata-server-is-enabled                                                                    |
| 255 | CKV_GCP_9     | /gcp/gke.tf                   | google_container_node_pool.custom_node_pool             | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters                                                                                            | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_4                                                                                          |
| 256 | CKV_GCP_10    | /gcp/gke.tf                   | google_container_node_pool.custom_node_pool             | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters                                                                                           | https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_5                                                                                          |
| 257 | CKV_GCP_38    | /gcp/instances.tf             | google_compute_instance.server                          | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)                                                                 | https://docs.bridgecrew.io/docs/encrypt-boot-disks-for-instances-with-cseks                                                                  |
| 258 | CKV_GCP_35    | /gcp/instances.tf             | google_compute_instance.server                          | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance                                                                                    | https://docs.bridgecrew.io/docs/bc_gcp_networking_11                                                                                         |
| 259 | CKV_GCP_40    | /gcp/instances.tf             | google_compute_instance.server                          | Ensure that Compute instances do not have public IP addresses                                                                                                | https://docs.bridgecrew.io/docs/bc_gcp_public_2                                                                                              |
| 260 | CKV_GCP_34    | /gcp/instances.tf             | google_compute_instance.server                          | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | https://docs.bridgecrew.io/docs/bc_gcp_networking_10                                                                                         |
| 261 | CKV_GCP_30    | /gcp/instances.tf             | google_compute_instance.server                          | Ensure that instances are not configured to use the default service account                                                                                  | https://docs.bridgecrew.io/docs/bc_gcp_iam_1                                                                                                 |
| 262 | CKV_GCP_36    | /gcp/instances.tf             | google_compute_instance.server                          | Ensure that IP forwarding is not enabled on Instances                                                                                                        | https://docs.bridgecrew.io/docs/bc_gcp_networking_12                                                                                         |
| 263 | CKV_GCP_32    | /gcp/instances.tf             | google_compute_instance.server                          | Ensure 'Block Project-wide SSH keys' is enabled for VM instances                                                                                             | https://docs.bridgecrew.io/docs/bc_gcp_networking_8                                                                                          |
| 264 | CKV_GCP_39    | /gcp/instances.tf             | google_compute_instance.server                          | Ensure Compute instances are launched with Shielded VM enabled                                                                                               | https://docs.bridgecrew.io/docs/bc_gcp_general_y                                                                                             |
| 265 | CKV_GCP_37    | /gcp/instances.tf             | google_compute_disk.unencrypted_disk                    | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)                                                                 | https://docs.bridgecrew.io/docs/bc_gcp_general_x                                                                                             |
| 266 | CKV_GCP_74    | /gcp/networks.tf              | google_compute_subnetwork.public-subnetwork             | Ensure that private_ip_google_access is enabled for Subnet                                                                                                   |                                                                                                                                              |
| 267 | CKV_GCP_26    | /gcp/networks.tf              | google_compute_subnetwork.public-subnetwork             | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network                                                                                       | https://docs.bridgecrew.io/docs/bc_gcp_logging_1                                                                                             |
| 268 | CKV_GCP_76    | /gcp/networks.tf              | google_compute_subnetwork.public-subnetwork             | Ensure that Private google access is enabled for IPV6                                                                                                        |                                                                                                                                              |
| 269 | CKV_GCP_88    | /gcp/networks.tf              | google_compute_firewall.allow_all                       | Ensure Google compute firewall ingress does not allow unrestricted mysql access                                                                              |                                                                                                                                              |
| 270 | CKV_GCP_106   | /gcp/networks.tf              | google_compute_firewall.allow_all                       | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access                                                                       |                                                                                                                                              |
| 271 | CKV_GCP_77    | /gcp/networks.tf              | google_compute_firewall.allow_all                       | Ensure Google compute firewall ingress does not allow on ftp port                                                                                            |                                                                                                                                              |
| 272 | CKV_GCP_3     | /gcp/networks.tf              | google_compute_firewall.allow_all                       | Ensure Google compute firewall ingress does not allow unrestricted rdp access                                                                                | https://docs.bridgecrew.io/docs/bc_gcp_networking_2                                                                                          |
| 273 | CKV_GCP_75    | /gcp/networks.tf              | google_compute_firewall.allow_all                       | Ensure Google compute firewall ingress does not allow unrestricted FTP access                                                                                |                                                                                                                                              |
| 274 | CKV_GCP_2     | /gcp/networks.tf              | google_compute_firewall.allow_all                       | Ensure Google compute firewall ingress does not allow unrestricted ssh access                                                                                | https://docs.bridgecrew.io/docs/bc_gcp_networking_1                                                                                          |
| 275 | CKV_OCI_9     | /oracle/bucket.tf             | oci_objectstorage_bucket.secretsquirrel                 | Ensure OCI Object Storage is encrypted with Customer Managed Key                                                                                             | https://docs.bridgecrew.io/docs/ensure-oci-object-storage-is-encrypted-with-customer-managed-key                                             |
| 276 | CKV_OCI_8     | /oracle/bucket.tf             | oci_objectstorage_bucket.secretsquirrel                 | Ensure OCI Object Storage has versioning enabled                                                                                                             | https://docs.bridgecrew.io/docs/ensure-oci-object-storage-has-versioning-enabled                                                             |
| 277 | CKV_OCI_7     | /oracle/bucket.tf             | oci_objectstorage_bucket.secretsquirrel                 | Ensure OCI Object Storage bucket can emit object events                                                                                                      | https://docs.bridgecrew.io/docs/ensure-oci-object-storage-bucket-can-emit-object-events                                                      |
| 278 | CKV_OCI_10    | /oracle/bucket.tf             | oci_objectstorage_bucket.secretsquirrel                 | Ensure OCI Object Storage is not Public                                                                                                                      | https://docs.bridgecrew.io/docs/ensure-oci-object-storage-is-not-public                                                                      |
| 279 | CKV2_AWS_12   | /aws/eks.tf                   | aws_vpc.eks_vpc                                         | Ensure the default security group of every VPC restricts all traffic                                                                                         | https://docs.bridgecrew.io/docs/networking_4                                                                                                 |
| 280 | CKV2_AWS_12   | /aws/ec2.tf                   | aws_vpc.web_vpc                                         | Ensure the default security group of every VPC restricts all traffic                                                                                         | https://docs.bridgecrew.io/docs/networking_4                                                                                                 |
| 281 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app8-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 282 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app4-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 283 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app7-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 284 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app1-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 285 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app3-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 286 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app9-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 287 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app5-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 288 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app6-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 289 | CKV2_AWS_8    | /aws/rds.tf                   | aws_rds_cluster.app2-rds-cluster                        | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-rds-clusters-has-backup-plan-of-aws-backup                                                       |
| 290 | CKV_AWS_145   | /aws/s3.tf                    | aws_s3_bucket.financials                                | Ensure that S3 buckets are encrypted with KMS by default                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default                                                     |
| 291 | CKV_AWS_145   | /aws/s3.tf                    | aws_s3_bucket.data_science                              | Ensure that S3 buckets are encrypted with KMS by default                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default                                                     |
| 292 | CKV_AWS_145   | /aws/s3.tf                    | aws_s3_bucket.data                                      | Ensure that S3 buckets are encrypted with KMS by default                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default                                                     |
| 293 | CKV_AWS_145   | /aws/ec2.tf                   | aws_s3_bucket.flowbucket                                | Ensure that S3 buckets are encrypted with KMS by default                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default                                                     |
| 294 | CKV_AWS_145   | /aws/s3.tf                    | aws_s3_bucket.operations                                | Ensure that S3 buckets are encrypted with KMS by default                                                                                                     | https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default                                                     |
| 295 | CKV_AWS_18    | /aws/s3.tf                    | aws_s3_bucket.financials                                | Ensure the S3 bucket has access logging enabled                                                                                                              | https://docs.bridgecrew.io/docs/s3_13-enable-logging                                                                                         |
| 296 | CKV_AWS_18    | /aws/s3.tf                    | aws_s3_bucket.data                                      | Ensure the S3 bucket has access logging enabled                                                                                                              | https://docs.bridgecrew.io/docs/s3_13-enable-logging                                                                                         |
| 297 | CKV_AWS_18    | /aws/ec2.tf                   | aws_s3_bucket.flowbucket                                | Ensure the S3 bucket has access logging enabled                                                                                                              | https://docs.bridgecrew.io/docs/s3_13-enable-logging                                                                                         |
| 298 | CKV_AWS_18    | /aws/s3.tf                    | aws_s3_bucket.operations                                | Ensure the S3 bucket has access logging enabled                                                                                                              | https://docs.bridgecrew.io/docs/s3_13-enable-logging                                                                                         |
| 299 | CKV_AWS_18    | /aws/s3.tf                    | aws_s3_bucket.logs                                      | Ensure the S3 bucket has access logging enabled                                                                                                              | https://docs.bridgecrew.io/docs/s3_13-enable-logging                                                                                         |
| 300 | CKV2_AWS_11   | /aws/eks.tf                   | aws_vpc.eks_vpc                                         | Ensure VPC flow logging is enabled in all VPCs                                                                                                               | https://docs.bridgecrew.io/docs/logging_9-enable-vpc-flow-logging                                                                            |
| 301 | CKV2_AWS_2    | /aws/ec2.tf                   | aws_ebs_volume.web_host_storage                         | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                         | https://docs.bridgecrew.io/docs/ensure-that-only-encrypted-ebs-volumes-are-attached-to-ec2-instances                                         |
| 302 | CKV2_AWS_6    | /aws/s3.tf                    | aws_s3_bucket.financials                                | Ensure that S3 bucket has a Public Access block                                                                                                              | https://docs.bridgecrew.io/docs/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached      |
| 303 | CKV2_AWS_6    | /aws/s3.tf                    | aws_s3_bucket.data_science                              | Ensure that S3 bucket has a Public Access block                                                                                                              | https://docs.bridgecrew.io/docs/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached      |
| 304 | CKV2_AWS_6    | /aws/s3.tf                    | aws_s3_bucket.data                                      | Ensure that S3 bucket has a Public Access block                                                                                                              | https://docs.bridgecrew.io/docs/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached      |
| 305 | CKV2_AWS_6    | /aws/ec2.tf                   | aws_s3_bucket.flowbucket                                | Ensure that S3 bucket has a Public Access block                                                                                                              | https://docs.bridgecrew.io/docs/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached      |
| 306 | CKV2_AWS_6    | /aws/s3.tf                    | aws_s3_bucket.operations                                | Ensure that S3 bucket has a Public Access block                                                                                                              | https://docs.bridgecrew.io/docs/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached      |
| 307 | CKV2_AWS_6    | /aws/s3.tf                    | aws_s3_bucket.logs                                      | Ensure that S3 bucket has a Public Access block                                                                                                              | https://docs.bridgecrew.io/docs/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached      |
| 308 | CKV_AWS_21    | /aws/s3.tf                    | aws_s3_bucket.financials                                | Ensure all data stored in the S3 bucket have versioning enabled                                                                                              | https://docs.bridgecrew.io/docs/s3_16-enable-versioning                                                                                      |
| 309 | CKV_AWS_21    | /aws/s3.tf                    | aws_s3_bucket.data                                      | Ensure all data stored in the S3 bucket have versioning enabled                                                                                              | https://docs.bridgecrew.io/docs/s3_16-enable-versioning                                                                                      |
| 310 | CKV_AWS_21    | /aws/ec2.tf                   | aws_s3_bucket.flowbucket                                | Ensure all data stored in the S3 bucket have versioning enabled                                                                                              | https://docs.bridgecrew.io/docs/s3_16-enable-versioning                                                                                      |
| 311 | CKV2_AZURE_7  | /azure/sql.tf                 | azurerm_sql_server.example                              | Ensure that Azure Active Directory Admin is configured                                                                                                       | https://docs.bridgecrew.io/docs/ensure-that-azure-active-directory-admin-is-configured                                                       |
| 312 | CKV2_AZURE_1  | /azure/storage.tf             | azurerm_storage_account.example                         | Ensure storage for critical data are encrypted with Customer Managed Key                                                                                     | https://docs.bridgecrew.io/docs/ensure-storage-for-critical-data-are-encrypted-with-customer-managed-key                                     |
| 313 | CKV2_AZURE_1  | /azure/mssql.tf               | azurerm_storage_account.security_storage_account        | Ensure storage for critical data are encrypted with Customer Managed Key                                                                                     | https://docs.bridgecrew.io/docs/ensure-storage-for-critical-data-are-encrypted-with-customer-managed-key                                     |
| 314 | CKV2_AZURE_16 | /azure/sql.tf                 | azurerm_mysql_server.example                            | Ensure that MySQL server enables customer-managed key for encryption                                                                                         | https://docs.bridgecrew.io/docs/ensure-that-mysql-server-enables-customer-managed-key-for-encryption                                         |
| 315 | CKV_AZURE_120 | /azure/application_gateway.tf | azurerm_application_gateway.network                     | Ensure that Application Gateway enables WAF                                                                                                                  | https://docs.bridgecrew.io/docs/ensure-that-application-gateway-enables-waf                                                                  |
| 316 | CKV_AWS_144   | /aws/s3.tf                    | aws_s3_bucket.financials                                | Ensure that S3 bucket has cross-region replication enabled                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled                                                   |
| 317 | CKV_AWS_144   | /aws/s3.tf                    | aws_s3_bucket.data_science                              | Ensure that S3 bucket has cross-region replication enabled                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled                                                   |
| 318 | CKV_AWS_144   | /aws/s3.tf                    | aws_s3_bucket.data                                      | Ensure that S3 bucket has cross-region replication enabled                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled                                                   |
| 319 | CKV_AWS_144   | /aws/ec2.tf                   | aws_s3_bucket.flowbucket                                | Ensure that S3 bucket has cross-region replication enabled                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled                                                   |
| 320 | CKV_AWS_144   | /aws/s3.tf                    | aws_s3_bucket.operations                                | Ensure that S3 bucket has cross-region replication enabled                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled                                                   |
| 321 | CKV_AWS_144   | /aws/s3.tf                    | aws_s3_bucket.logs                                      | Ensure that S3 bucket has cross-region replication enabled                                                                                                   | https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled                                                   |
| 322 | CKV2_AZURE_18 | /azure/storage.tf             | azurerm_storage_account.example                         | Ensure that Storage Accounts use customer-managed key for encryption                                                                                         | https://docs.bridgecrew.io/docs/ensure-that-storage-accounts-use-customer-managed-key-for-encryption                                         |
| 323 | CKV2_AZURE_18 | /azure/mssql.tf               | azurerm_storage_account.security_storage_account        | Ensure that Storage Accounts use customer-managed key for encryption                                                                                         | https://docs.bridgecrew.io/docs/ensure-that-storage-accounts-use-customer-managed-key-for-encryption                                         |
| 324 | CKV_AWS_19    | /aws/s3.tf                    | aws_s3_bucket.financials                                | Ensure all data stored in the S3 bucket is securely encrypted at rest                                                                                        | https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest                                                                                 |
| 325 | CKV_AWS_19    | /aws/s3.tf                    | aws_s3_bucket.data_science                              | Ensure all data stored in the S3 bucket is securely encrypted at rest                                                                                        | https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest                                                                                 |
| 326 | CKV_AWS_19    | /aws/s3.tf                    | aws_s3_bucket.data                                      | Ensure all data stored in the S3 bucket is securely encrypted at rest                                                                                        | https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest                                                                                 |
| 327 | CKV_AWS_19    | /aws/ec2.tf                   | aws_s3_bucket.flowbucket                                | Ensure all data stored in the S3 bucket is securely encrypted at rest                                                                                        | https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest                                                                                 |
| 328 | CKV_AWS_19    | /aws/s3.tf                    | aws_s3_bucket.operations                                | Ensure all data stored in the S3 bucket is securely encrypted at rest                                                                                        | https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest                                                                                 |
| 329 | CKV_AZURE_24  | /azure/sql.tf                 | azurerm_sql_server.example                              | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_logging_3                                                                                             |
| 330 | CKV_AZURE_24  | /azure/mssql.tf               | azurerm_mssql_server.mssql5                             | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_logging_3                                                                                             |
| 331 | CKV_AZURE_24  | /azure/mssql.tf               | azurerm_mssql_server.mssql1                             | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_logging_3                                                                                             |
| 332 | CKV_AZURE_24  | /azure/mssql.tf               | azurerm_mssql_server.mssql6                             | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_logging_3                                                                                             |
| 333 | CKV_AZURE_24  | /azure/mssql.tf               | azurerm_mssql_server.mssql2                             | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_logging_3                                                                                             |
| 334 | CKV_AZURE_24  | /azure/mssql.tf               | azurerm_mssql_server.mssql4                             | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_logging_3                                                                                             |
| 335 | CKV_AZURE_24  | /azure/mssql.tf               | azurerm_mssql_server.mssql7                             | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_logging_3                                                                                             |
| 336 | CKV_AZURE_24  | /azure/mssql.tf               | azurerm_mssql_server.mssql3                             | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                   | https://docs.bridgecrew.io/docs/bc_azr_logging_3                                                                                             |
| 337 | CKV_AZURE_23  | /azure/sql.tf                 | azurerm_sql_server.example                              | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                        | https://docs.bridgecrew.io/docs/bc_azr_logging_2                                                                                             |
| 338 | CKV_AZURE_23  | /azure/mssql.tf               | azurerm_mssql_server.mssql5                             | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                        | https://docs.bridgecrew.io/docs/bc_azr_logging_2                                                                                             |
| 339 | CKV_AZURE_23  | /azure/mssql.tf               | azurerm_mssql_server.mssql1                             | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                        | https://docs.bridgecrew.io/docs/bc_azr_logging_2                                                                                             |
| 340 | CKV_AZURE_23  | /azure/mssql.tf               | azurerm_mssql_server.mssql6                             | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                        | https://docs.bridgecrew.io/docs/bc_azr_logging_2                                                                                             |
| 341 | CKV_AZURE_23  | /azure/mssql.tf               | azurerm_mssql_server.mssql2                             | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                        | https://docs.bridgecrew.io/docs/bc_azr_logging_2                                                                                             |
| 342 | CKV_AZURE_23  | /azure/mssql.tf               | azurerm_mssql_server.mssql4                             | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                        | https://docs.bridgecrew.io/docs/bc_azr_logging_2                                                                                             |
| 343 | CKV_AZURE_23  | /azure/mssql.tf               | azurerm_mssql_server.mssql7                             | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                        | https://docs.bridgecrew.io/docs/bc_azr_logging_2                                                                                             |
| 344 | CKV_AZURE_23  | /azure/mssql.tf               | azurerm_mssql_server.mssql3                             | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                        | https://docs.bridgecrew.io/docs/bc_azr_logging_2                                                                                             |

---

### dockerfile scan results:

|    | check_id     | file                      | resource                   | check_name                                                               | guideline                                                                                                |
|----|--------------|---------------------------|----------------------------|--------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|
|  0 | CKV_DOCKER_3 | /aws/resources/Dockerfile | /aws/resources/Dockerfile. | Ensure that a user for the container has been created                    | https://docs.bridgecrew.io/docs/ensure-that-a-user-for-the-container-has-been-created                    |
|  1 | CKV_DOCKER_2 | /aws/resources/Dockerfile | /aws/resources/Dockerfile. | Ensure that HEALTHCHECK instructions have been added to container images | https://docs.bridgecrew.io/docs/ensure-that-healthcheck-instructions-have-been-added-to-container-images |

---

### secrets scan results:

|    | check_id     | file              | resource                                 | check_name                 | guideline                                     |
|----|--------------|-------------------|------------------------------------------|----------------------------|-----------------------------------------------|
|  0 | CKV_SECRET_2 | /aws/lambda.tf    | 25910f981e85ca04baf359199dd0bd4a3ae738b6 | AWS Access Key             | https://docs.bridgecrew.io/docs/git_secrets_2 |
|  1 | CKV_SECRET_6 | /aws/lambda.tf    | d70eab08607a4d05faa2d0d6647206599e9abc65 | Base64 High Entropy String | https://docs.bridgecrew.io/docs/git_secrets_6 |
|  2 | CKV_SECRET_2 | /aws/providers.tf | 25910f981e85ca04baf359199dd0bd4a3ae738b6 | AWS Access Key             | https://docs.bridgecrew.io/docs/git_secrets_2 |
|  3 | CKV_SECRET_6 | /aws/providers.tf | d70eab08607a4d05faa2d0d6647206599e9abc65 | Base64 High Entropy String | https://docs.bridgecrew.io/docs/git_secrets_6 |
|  4 | CKV_SECRET_6 | /azure/sql.tf     | a57ae0fe47084bc8a05f69f3f8083896f8b437b0 | Base64 High Entropy String | https://docs.bridgecrew.io/docs/git_secrets_6 |

---

terragoat

File Explorer

# Installation Guide

2. Docker

3. Maven (Java)

4. Node.js

5. Python

Today's picks

Was this content helpful?

Recent Feedback

terragoat

File Explorer

# Installation Guide

2. Docker

3. Maven (Java)

4. Node.js

5. Python

Today's picks

Was this content helpful?

Recent Feedback

Download README