AWS CDK security rules

Detects ACM certificates using email validation or with certificate transparency logging disabled.

Detects AWS::ApiGateway::Method and AWS::ApiGatewayV2::Route resources where AuthorizationType is missing or NONE (excluding OPTIONS preflight). Public-by-default endpoints expose backend Lambdas to anyone on the internet.

Detects API Gateway REST APIs configured with a non-PRIVATE endpoint, i.e. reachable from the public internet.

Detects REST APIs that leave the default execute-api endpoint enabled while a custom domain is configured, letting clients bypass the domain and its edge controls.

Detects API Gateway stages that configure no method-level rate or burst limits, leaving backends exposed to traffic spikes and uncontrolled cost.

Detects AppSync APIs using API key authentication or lacking additional authentication providers.

Detects AppSync APIs without logging, field-level logging, or X-Ray tracing.

Detects AWS::AutoScaling::LaunchConfiguration with AssociatePublicIpAddress=true. Instances launched from this configuration get a public IP and are internet-reachable directly.

Detects AWS::AutoScaling::AutoScalingGroup resources attached to a load balancer (LoadBalancerNames or TargetGroupARNs) but using EC2 health checks. EC2 health checks miss app-level outages the load balancer would otherwise detect.

Detects Backup plan rules without cross-region copy or lifecycle configuration.

Detects Backup vaults using AWS-managed keys or without a vault lock for compliance.

Detects CloudFront distributions allowing HTTP traffic.

Detects CloudFront distributions without access logging.

Detects CloudFront distributions using outdated TLS versions.

Detects CloudFront distributions without WAF association.

Flags stacks that define no CloudTrail Trail. CloudTrail is usually configured once at the account or organization level — suppress this rule if account-level logging is already in place.

Detects CloudWatch Alarms without alarm actions or missing-data handling.

Detects CloudWatch Log Groups without an explicit retention period (logs retained indefinitely).

Detects CloudWatch Log Groups not encrypted with a customer-managed KMS key.

Detects Cognito user pools with weak password policies.

Detects Cognito user pools without MFA enabled.

Detects Cognito user pools without advanced security features.

Detects misconfigurations only visible across multiple resources: Lambda functions referencing VPC-only resources without VpcConfig, S3 replication without encryption configuration, and security groups exposing non-standard ports to the public when used by sensitive services.

Detects launch templates and launch configurations that do not require IMDSv2 (MetadataOptions.HttpTokens is not "required"), leaving instances exposed to SSRF-based credential theft.

Detects AppSync APIs without an associated AWS WAF WebACL.

Detects architectural omissions across the stack: missing CloudWatch Alarms on critical resources, Lambda functions without X-Ray tracing, public-facing resources without WAF, RDS databases without Secrets Manager rotation, and excessive NAT Gateway usage.

Detects DynamoDB tables without auto-scaling enabled.

Detects DynamoDB tables without deletion protection, which can be destroyed by an accidental stack update or delete.

Detects DynamoDB tables without Point-in-Time Recovery enabled. PITR provides continuous backups for the last 35 days and is required for SOC2 / HIPAA data resilience.

Detects AWS::DynamoDB::Table resources without SSESpecification.SSEEnabled=true. DynamoDB always encrypts at rest, but the default AWS-owned key cannot be inspected, audited, or rotated by the customer — inadequate for HIPAA / PCI-DSS / FedRAMP workloads.

Detects DynamoDB tables without streams enabled.

Detects EBS volumes without encryption.

Detects EC2 instances whose NetworkInterfaces specify AssociatePublicIpAddress=true, exposing the instance directly to the internet.

Detects security groups with unrestricted ingress (0.0.0.0/0).

Detects EC2 instances using older generation instance types.

Detects AWS::EC2::Subnet resources with MapPublicIpOnLaunch=true. Instances launched into the subnet inherit a public IP by default, which makes them internet-reachable without an explicit opt-in at the ENI level.

Detects standalone security group rules attached to a VPC default security group (GroupId referencing Fn::GetAtt DefaultSecurityGroup). CIS requires the default group to have no rules.

Detects VPCs without flow logs configured.

Detects EBS volumes using gp2 where gp3 offers the same baseline for less.

Identifies NAT Gateway usage for cost awareness.

Detects security groups with no ingress or egress rules defined.

Detects security groups with egress open to the whole internet (0.0.0.0/0).

Detects ECR repositories without image vulnerability scanning on push.

Detects ECR repositories without a lifecycle policy to clean up old images.

Detects ECR repositories that allow image tags to be overwritten.

Detects ECS task definitions with a container running in privileged mode, which can access the host and escalate a container compromise into host compromise.

Detects ECS task definitions with sensitive data in plaintext environment variables.

Detects ECS services (rolling-update controller) that do not enable the deployment circuit breaker, so a failed deployment is not stopped or rolled back automatically.

Detects ECS task definitions without logging configured.

Detects ECS services with Service Connect enabled but no access log configuration, leaving inter-service traffic unaudited.

Detects ECS task definitions without CPU/memory limits.

Detects ECS task definition containers referencing an image by the mutable "latest" tag or no tag at all, so deployments are not reproducible and a changed upstream image can land without a code change.

Detects AWS::EFS::FileSystem resources without Encrypted=true. The CFN default is unencrypted (unlike the EFS console default), and encryption can only be enabled at filesystem creation.

Detects EKS clusters with the API endpoint reachable from 0.0.0.0/0 or only via the public network.

Detects EKS clusters without envelope encryption for Kubernetes secrets in etcd.

Detects EKS clusters with no control plane log types enabled.

Detects EKS clusters with public API access but no private endpoint access.

Detects ElastiCache clusters without at-rest or in-transit encryption.

Detects Redis replication groups with transit encryption but no AUTH token configured.

Detects ElastiCache replication groups without automatic failover or Multi-AZ.

Detects load balancers with HTTP listeners not redirecting to HTTPS.

Detects load balancers without deletion protection.

Detects load balancers without access logging.

Detects load balancers using outdated TLS security policies.

Detects AWS::Events::EventBusPolicy with an Allow statement targeting Principal=* (or AWS=*) without a Condition restricting access. Without the condition, any AWS account can publish events to the bus.

Detects EventBridge rules that are disabled or have no targets configured, so matched events are silently dropped.

Detects EventBridge rules with State DISABLED, which match no events.

Detects Glue JDBC connections without VPC subnet placement or SSL enforcement.

Detects Glue jobs without an attached SecurityConfiguration for encrypting bookmarks, S3 data, and CloudWatch logs.

Detects IAM roles whose trust policy allows a wildcard principal to assume them with no scoping condition — anyone with an AWS account can become the role.

An ECS container definition pulls Secrets[].ValueFrom from an in-template Secrets Manager secret or SSM parameter, but the task EXECUTION role (which the ECS agent uses to resolve secrets) lacks secretsmanager:GetSecretValue / ssm:GetParameters. Containers fail to start with ResourceInitializationError.

An AWS::Lambda::EventSourceMapping polls an in-template SQS queue, Kinesis stream, or DynamoDB stream but the function execution role lacks the documented required actions (e.g. sqs:ReceiveMessage / DeleteMessage / GetQueueAttributes). The mapping fails to create or the poller fails with AccessDenied.

Detects IAM policies with overly permissive actions like * wildcards.

An in-template trigger (EventBridge rule, SNS lambda subscription, S3 bucket notification) targets a Lambda function but no AWS::Lambda::Permission grants the service principal invoke access. The trigger silently never invokes the function. CDK custom-resource notification patterns are excluded.

A Step Functions definition declares a service integration (lambda:invoke, dynamodb:getItem, sqs:sendMessage, sns:publish, states:startExecution) targeting an in-template resource, but the state machine role lacks the required action. Task states fail at execution time. Statically unparseable definitions are skipped.

A Lambda function or ECS task definition references an in-template resource (DynamoDB table, S3 bucket, SQS queue, SNS topic, Kinesis stream, secret, event bus, state machine) through an environment variable, but its execution role grants no action in that service namespace on it — the forgotten-grant footgun. Calls fail with AccessDenied at runtime. Fires only on zero coverage; never guesses specific missing actions.

Detects IAM roles with cross-account trust relationships.

Detects IAM Users with policies attached directly (inline Policies or ManagedPolicyArns). CIS AWS Foundations 1.15 requires users to inherit permissions through groups.

Detects IAM roles without permission boundaries.

Detects Image Builder distribution configurations whose AMI launch permission includes the "all" user group, making the produced AMI public to every AWS account.

Detects Kinesis Data Streams without server-side KMS encryption.

Detects Kinesis Data Streams using the default 24-hour retention period.

Detects KMS keys whose key policy grants access to a wildcard or public principal.

Detects AWS::KMS::Key resources whose KeyPolicy contains a Deny statement on kms:*, kms:PutKeyPolicy, or * with a broad Principal and no carveout for the account root or admin role. Such a policy locks the account out of its own key — recovery requires breaking glass on the account root credentials AND scheduling a 7-30 day key deletion (which does not actually let you recover the key, just remove it). Effectively unrecoverable for any data the key has encrypted; AWS Support typically declines to intervene where customers have a self-service path via root.

Detects AWS::Lambda::Permission and AWS::Lambda::LayerVersionPermission resources that grant invoke / use rights with a wildcard Principal, or grant a service principal without a SourceArn / SourceAccount / PrincipalOrgID restriction (confused-deputy risk).

Detects Lambda functions using runtimes that have reached or are approaching end-of-life.

Detects Lambda Function URLs configured with AuthType NONE, which allows unauthenticated public invocation.

Detects Lambda functions with sensitive data in environment variables.

Detects Lambda functions using a variable runtime (Runtime.NODEJS_LATEST or useLatestRuntimeVersion) that resolves to the newest runtime at synth time, causing silent in-place runtime upgrades on the next deploy after a CDK bump.

Warns about potential NAT Gateway costs for VPC-attached Lambda functions.

Detects Lambda functions without dead letter queue configuration.

Detects Lambda functions with suboptimal memory configuration.

Detects Lambda permissions using a wildcard Principal scoped only by a source/org condition.

Detects Lambda functions without reserved concurrency.

Detects Lambda functions without active X-Ray tracing, reducing observability into latency and errors.

Detects MSK clusters without client authentication or that allow unauthenticated access.

Detects MSK clusters without TLS for client-broker traffic, without inter-broker encryption, or using AWS-managed keys for at-rest encryption.

Detects MSK clusters without broker logs configured.

Detects MSK clusters whose broker volumes are not encrypted with a customer-managed KMS key.

Detects OpenSearch domains without at-rest encryption or node-to-node encryption.

Detects OpenSearch domains without fine-grained access control or VPC placement.

Detects OpenSearch domains without audit logs or application logs published to CloudWatch.

Detects RDS instances that are publicly accessible.

Detects RDS instances and clusters whose MasterUserPassword is a literal string in the template rather than a Secrets Manager/SSM dynamic reference or managed credential.

Detects RDS instances with insufficient backup retention.

Detects RDS instances without deletion protection.

Detects RDS instances and clusters without storage encryption at rest. Aurora member instances and read replicas (which inherit encryption) are exempt.

Detects RDS instances without enhanced monitoring (MonitoringInterval missing or set to 0). OS-level metrics are not published to CloudWatch Logs.

Detects Multi-AZ RDS instances on gp2 storage; gp3 offers better baseline performance at lower cost.

Detects RDS DBInstance and DBCluster resources without EnableCloudwatchLogsExports configured. Engine logs (error, slow query, audit) are not exported to CloudWatch for retention or analysis.

Detects RDS instances/clusters using the native Secrets Manager integration (ManageMasterUserPassword) whose managed master-user secret is encrypted with the AWS-managed aws/secretsmanager key instead of a customer-managed KMS key.

Detects Redshift clusters reachable from the public internet.

Detects Redshift clusters without at-rest encryption.

Detects Redshift clusters without audit logging to S3 (connection, user, query activity).

Detects Route 53 hosted zones without DNSSEC signing enabled.

Detects Route 53 health checks using HTTP instead of HTTPS or the standard request interval.

Detects Route 53 hosted zones without query logging.

Detects S3 bucket policies that allow object reads to a wildcard principal with no scoping condition — the bucket contents are publicly downloadable.

Detects AWS::S3::BucketPolicy resources containing a Deny statement on s3:DeleteBucket, s3:*, or * with a broad Principal and no NotPrincipal or aws:PrincipalArn carveout for the account root or admin role. Such a policy locks the account out of its own bucket — recovery requires breaking glass on the account root credentials, since AWS Support typically declines to intervene where customers have a self-service path via root.

Detects AWS::S3::BucketPolicy resources that lack a Deny statement enforcing aws:SecureTransport. Without this, the bucket accepts plain HTTP requests in addition to HTTPS.

Detects S3 buckets without server access logging configured. Required by CIS AWS Foundations 2.1.2 and useful for incident forensics.

Detects S3 buckets without an explicit BucketEncryption configuration (SSE-S3 default applies, not customer-controlled).

Detects S3 buckets that do not explicitly enable all four Block Public Access settings. New buckets are protected by service defaults since April 2023; explicit configuration makes the protection visible and portable.

Detects S3 buckets without versioning enabled, leaving overwritten or deleted objects unrecoverable.

Detects S3 buckets without lifecycle policies.

Recommends S3 Intelligent Tiering for cost optimization.

Detects critical S3 buckets without cross-region replication.

Detects Secrets Manager secrets whose resource policy grants access to a wildcard or public principal.

Detects Secrets Manager secrets with no rotation schedule in the template — static credentials that never expire.

Detects AWS::SNS::TopicPolicy resources containing a Deny statement on sns:DeleteTopic, sns:RemovePermission, sns:*, or * with a broad Principal and no NotPrincipal or aws:PrincipalArn carveout for the account root or admin role. Such a policy locks the account out of its own topic — recovery requires breaking glass on the account root credentials to remove the topic policy, or delete-and-recreate the topic if no subscribers depend on its ARN. In fan-out architectures that is often a multi-stack rebuild.

Detects SNS topics without encryption.

Detects AWS::SQS::QueuePolicy resources containing a Deny statement on sqs:DeleteQueue, sqs:RemovePermission, sqs:*, or * with a broad Principal and no NotPrincipal or aws:PrincipalArn carveout for the account root or admin role. Such a policy locks the account out of its own queue — recovery requires breaking glass on the account root credentials to remove the queue policy, or delete-and-recreate the queue if nothing else depends on its ARN. In event-driven systems that is often a multi-stack rebuild.

Detects SQS queues without encryption.

Detects SQS queues with no RedrivePolicy, so messages that repeatedly fail processing are lost instead of captured for inspection.

Detects Step Functions state machines without logging.

Detects WAFv2 WebACLs without logging configuration for analysed requests.

Detects WAFv2 WebACLs with no rules, default Allow action, or CloudWatch metrics disabled.