> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="ec2-imdsv1-optional">
    AWS EC2 Instance allowing use of the IMDSv1<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-918: Server-Side Request Forgery (SSRF)
    <br />**OWASP**: <br />- A10:2021 - Server-Side Request Forgery (SSRF)
  </Accordion>

  <Accordion title="s3-public-read-bucket">
    S3 bucket with public read access detected.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="s3-public-rw-bucket">
    S3 bucket with public read-write access detected.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="elastic-search-encryption-at-rest">
    Encryption at rest is not enabled for the elastic search domain resource<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-311: Missing Encryption of Sensitive Data
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A04:2021 - Insecure Design
  </Accordion>

  <Accordion title="ecr-image-scan-on-push">
    The ECR Repository isn't configured to scan images on push<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-1104: Use of Unmaintained Third Party Components
    <br />**OWASP**: <br />- A06:2021 - Vulnerable and Outdated Components
  </Accordion>

  <Accordion title="eks-insufficient-control-plane-logging">
    Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs ("api") and audit logs ("audit") of the EKS control plane through the enabled\_cluster\_log\_types attribute.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-778: Insufficient Logging
    <br />**OWASP**: <br />- A10:2017 - Insufficient Logging & Monitoring
    <br />- A09:2021 - Security Logging and Monitoring Failures
  </Accordion>

  <Accordion title="rds-public-access">
    RDS instance accessible from the Internet detected.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="rds-insecure-password-storage-in-source-code">
    RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random\_password resource.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-522: Insufficiently Protected Credentials
    <br />**OWASP**: <br />- A02:2017 - Broken Authentication
    <br />- A04:2021 - Insecure Design
  </Accordion>

  <Accordion title="all-origins-allowed">
    CORS rule on bucket permits any origin<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-942: Permissive Cross-domain Policy with Untrusted Domains
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="s3-unencrypted-bucket">
    This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3\_bucket\_server\_side\_encryption\_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) for more info.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-311: Missing Encryption of Sensitive Data
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A04:2021 - Insecure Design
  </Accordion>

  <Accordion title="eks-public-endpoint-enabled">
    The vpc\_config resource inside the eks cluster has not explicitly disabled public endpoint access<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>
</AccordionGroup>