> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute.md).

# Compute

| Rule Name                                                                                                                                                                                                       | AppSec Rule ID      | Severity |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | -------- |
| [Alibaba Cloud RDS instance is not set to perform auto upgrades for minor versions misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-ali-30.md)                                      | APPSEC\_ALI\_30     | LOW      |
| [Disabled Ansible URI certificate validation misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-ansible-1.md)                                                                         | APPSEC\_ANSIBLE\_1  | MEDIUM   |
| [Certificate validation disabled with Ansible get\_url module misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-ansible-2.md)                                                        | APPSEC\_ANSIBLE\_2  | MEDIUM   |
| [SSL certificate validation disabled with Ansible Yum misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-ansible-3.md)                                                                | APPSEC\_ANSIBLE\_3  | MEDIUM   |
| [SSL validation is disabled with yum misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-ansible-4.md)                                                                                 | APPSEC\_ANSIBLE\_4  | MEDIUM   |
| [Usage of packages with unauthenticated or missing signatures allowed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-ansible-5.md)                                                | APPSEC\_ANSIBLE\_5  | LOW      |
| [Usage of the force parameter disabling signature validation allowed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-ansible-6.md)                                                 | APPSEC\_ANSIBLE\_6  | LOW      |
| [AWS Lambda functions with tracing not enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-50.md)                                                                          | APPSEC\_AWS\_50     | LOW      |
| [API Gateway does not have X-Ray tracing enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-73.md)                                                                        | APPSEC\_AWS\_73     | LOW      |
| [AWS EC2 instance not configured with Instance Metadata Service v2 (IMDSv2) misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-79.md)                                             | APPSEC\_AWS\_79     | HIGH     |
| [AWS EMR cluster is not configured with Kerberos Authentication misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-114.md)                                                        | APPSEC\_AWS\_114    | LOW      |
| [AWS Lambda function is not configured for function-level concurrent execution Limit misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-115.md)                                   | APPSEC\_AWS\_115    | LOW      |
| [AWS Lambda function is not configured for a DLQ misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-116.md)                                                                       | APPSEC\_AWS\_116    | LOW      |
| [AWS Lambda Function is not assigned to access within VPC misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-117.md)                                                              | APPSEC\_AWS\_117    | LOW      |
| [AWS API Gateway caching is disabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-120.md)                                                                                   | APPSEC\_AWS\_120    | LOW      |
| [Autoscaling groups did not supply tags to launch configurations misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-153.md)                                                       | APPSEC\_AWS\_153    | LOW      |
| [ECR image scan on push is not enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-163.md)                                                                                 | APPSEC\_AWS\_163    | HIGH     |
| [AWS MQBroker's minor version updates are disabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-207.md)                                                                     | APPSEC\_AWS\_207    | LOW      |
| [AWS MQBroker version is not up to date misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-208.md)                                                                                | APPSEC\_AWS\_208    | LOW      |
| [AWS Batch Job is defined as a privileged container misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-210.md)                                                                    | APPSEC\_AWS\_210    | LOW      |
| [AWS API deployments do not enable Create before Destroy misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-217.md)                                                               | APPSEC\_AWS\_217    | LOW      |
| [AWS DMS replication instance automatic version upgrade disabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-222.md)                                                       | APPSEC\_AWS\_222    | LOW      |
| [AWS API Gateway method settings do not enable caching misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-225.md)                                                                 | APPSEC\_AWS\_225    | LOW      |
| [AWS DB instance does not get all minor upgrades automatically misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-226.md)                                                         | APPSEC\_AWS\_226    | LOW      |
| [AWS ACM certificate does not enable Create before Destroy misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-233.md)                                                             | APPSEC\_AWS\_233    | LOW      |
| [Ensure AWS API gateway enables Create before Destroy misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-237.md)                                                                  | APPSEC\_AWS\_237    | LOW      |
| [AWS HTTP and HTTPS target groups do not define health check misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-261.md)                                                           | APPSEC\_AWS\_261    | LOW      |
| [AWS Lambda function is not configured to validate code-signing misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-272.md)                                                        | APPSEC\_AWS\_272    | HIGH     |
| [API Gateway method setting is not set to encrypted caching misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-308.md)                                                            | APPSEC\_AWS\_308    | HIGH     |
| [RDS cluster is not configured to copy tags to snapshots misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-313.md)                                                               | APPSEC\_AWS\_313    | LOW      |
| [EC2 Auto Scaling groups are not utilizing EC2 launch templates misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-315.md)                                                        | APPSEC\_AWS\_315    | MEDIUM   |
| [AWS CodeBuild project environment privileged mode is enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-316.md)                                                          | APPSEC\_AWS\_316    | MEDIUM   |
| [Elasticsearch domains are not configured with a minimum of three dedicated master nodes misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-318.md)                               | APPSEC\_AWS\_318    | MEDIUM   |
| [Redshift clusters are not using the default database name. misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-320.md)                                                            | APPSEC\_AWS\_320    | MEDIUM   |
| [Redshift clusters are not using enhanced VPC routing misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-321.md)                                                                  | APPSEC\_AWS\_321    | MEDIUM   |
| [AWS ElastiCache Redis cluster automatic version upgrade disabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-322.md)                                                      | APPSEC\_AWS\_322    | LOW      |
| [ECS Fargate services are not ensured to run on the latest Fargate platform version misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-332.md)                                    | APPSEC\_AWS\_332    | MEDIUM   |
| [AWS ECS task definition elevated privileges enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-334.md)                                                                   | APPSEC\_AWS\_334    | MEDIUM   |
| [ECS task definitions have their own unique process namespace or share the host's process namespace misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-335.md)                    | APPSEC\_AWS\_335    | MEDIUM   |
| [AWS ECS task definition is not configured with read-only access to container root filesystems misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-336.md)                         | APPSEC\_AWS\_336    | LOW      |
| [AWS Elastic Beanstalk environment managed platform updates are not enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-340.md)                                            | APPSEC\_AWS\_340    | LOW      |
| [AWS Auto Scaling group launch configuration configured with Instance Metadata Service hop count greater than 1 misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-341.md)        | APPSEC\_AWS\_341    | MEDIUM   |
| [Runtime of Lambda is deprecated misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-363.md)                                                                                       | APPSEC\_AWS\_363    | MEDIUM   |
| [Hard-coded secrets found in Parameter Store values misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-384.md)                                                                    | APPSEC\_AWS\_384    | MEDIUM   |
| [Potential WhoAMI name confusion attack exposure misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-386.md)                                                                       | APPSEC\_AWS\_386    | LOW      |
| [AWS SQS queue access policy is overly permissive misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-aws-387.md)                                                                      | APPSEC\_AWS\_387    | LOW      |
| [Secrets are exposed in Azure VM customData misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-45.md)                                                                           | APPSEC\_AZURE\_45   | HIGH     |
| [Azure Linux scale set does not use an SSH key misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-49.md)                                                                        | APPSEC\_AZURE\_49   | HIGH     |
| [Virtual Machine extensions are installed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-50.md)                                                                             | APPSEC\_AZURE\_50   | MEDIUM   |
| [Azure App Service Web app doesn't use latest .Net framework version misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-80.md)                                                  | APPSEC\_AZURE\_80   | LOW      |
| [Azure App Service Web app does not use latest PHP version misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-81.md)                                                            | APPSEC\_AZURE\_81   | LOW      |
| [Azure App Service Web app does not use latest Python version misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-82.md)                                                         | APPSEC\_AZURE\_82   | LOW      |
| [Azure App Service Web app does not use latest Java version misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-83.md)                                                           | APPSEC\_AZURE\_83   | LOW      |
| [Azure Linux and Windows Virtual Machines does not utilize Managed Disks misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-92.md)                                              | APPSEC\_AZURE\_92   | LOW      |
| [Automatic OS image patching is disabled for Virtual Machine scale sets misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-95.md)                                               | APPSEC\_AZURE\_95   | LOW      |
| [Azure Data Factory does not use Git repository for source control misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-103.md)                                                   | APPSEC\_AZURE\_103  | LOW      |
| [Azure Service Fabric cluster not configured with cluster protection level security misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-126.md)                                  | APPSEC\_AZURE\_126  | LOW      |
| [Azure Container Registry (ACR) Isn't Configured to Use Signed/Trusted Images misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-164.md)                                        | APPSEC\_AZURE\_164  | MEDIUM   |
| [Azure Kubernetes Cluster (AKS) Nodes Don't Limit the Maximum Pods to Greater than 50 misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-168.md)                                | APPSEC\_AZURE\_168  | LOW      |
| [Azure Kubernetes Cluster (AKS) Nodes Do Not Use Scale Sets misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-169.md)                                                          | APPSEC\_AZURE\_169  | LOW      |
| [AKS Doesn't Use the Paid SKU for its SLA misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-170.md)                                                                            | APPSEC\_AZURE\_170  | LOW      |
| [AKS Cluster Without Upgrade Channel misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-171.md)                                                                                 | APPSEC\_AZURE\_171  | LOW      |
| [Windows VM Without Automatic Updates misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-177.md)                                                                                | APPSEC\_AZURE\_177  | MEDIUM   |
| [VM Without Azure VM Agent Installed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-179.md)                                                                                 | APPSEC\_AZURE\_179  | LOW      |
| [App Configuration Not Using Standard SKU misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-188.md)                                                                            | APPSEC\_AZURE\_188  | LOW      |
| [Azure App Service Plan is Not Suitable for Production misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-211.md)                                                               | APPSEC\_AZURE\_211  | LOW      |
| [Azure App Service Not Always On misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-214.md)                                                                                     | APPSEC\_AZURE\_214  | LOW      |
| [Operating system disks are not ephemeral disks misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-226.md)                                                                      | APPSEC\_AZURE\_226  | MEDIUM   |
| [Non-Critical System Pods Run on System Nodes misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-azure-232.md)                                                                        | APPSEC\_AZURE\_232  | HIGH     |
| [Healthcheck instructions have not been added to container images misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-2.md)                                                     | APPSEC\_DOCKER\_2   | LOW      |
| [A user for the container has not been created misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-3.md)                                                                        | APPSEC\_DOCKER\_3   | LOW      |
| [Copy is not used instead of Add in Dockerfiles misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-4.md)                                                                       | APPSEC\_DOCKER\_4   | LOW      |
| [Update instructions are used alone in a Dockerfile misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-5.md)                                                                   | APPSEC\_DOCKER\_5   | LOW      |
| [LABEL maintainer is used instead of MAINTAINER (deprecated) misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-6.md)                                                          | APPSEC\_DOCKER\_6   | LOW      |
| [Base image uses a latest version tag misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-7.md)                                                                                 | APPSEC\_DOCKER\_7   | LOW      |
| [Last USER is root misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-8.md)                                                                                                    | APPSEC\_DOCKER\_8   | LOW      |
| [Docker APT is used misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-9.md)                                                                                                   | APPSEC\_DOCKER\_9   | LOW      |
| [Docker WORKDIR values are not absolute paths misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-10.md)                                                                        | APPSEC\_DOCKER\_10  | LOW      |
| [Docker From alias is not unique for multistage builds misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-docker-11.md)                                                               | APPSEC\_DOCKER\_11  | LOW      |
| [GCP Kubernetes Engine Clusters not using Container-Optimized OS for Node image misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-gcp-22.md)                                         | APPSEC\_GCP\_22     | LOW      |
| [GCP Kubernetes Engine Clusters have legacy compute engine metadata endpoints enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-gcp-67.md)                                   | APPSEC\_GCP\_67     | LOW      |
| [GCP Kubernetes cluster shielded GKE node with Secure Boot disabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-gcp-68.md)                                                     | APPSEC\_GCP\_68     | LOW      |
| [GCP Kubernetes cluster Shielded GKE Nodes feature disabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-gcp-71.md)                                                             | APPSEC\_GCP\_71     | LOW      |
| [GCP SQL database does not use the latest Major version misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-gcp-79.md)                                                                 | APPSEC\_GCP\_79     | LOW      |
| [GKE NodePool configuration managed at cluster level misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-gcp-123.md)                                                                   | APPSEC\_GCP\_123    | LOW      |
| [Containers wishing to share host process ID namespace admitted misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-1.md)                                                          | APPSEC\_K8S\_1      | MEDIUM   |
| [Privileged containers are admitted misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-2.md)                                                                                      | APPSEC\_K8S\_2      | HIGH     |
| [Containers wishing to share host IPC namespace admitted misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-3.md)                                                                 | APPSEC\_K8S\_3      | MEDIUM   |
| [Root containers admitted misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-6.md)                                                                                                | APPSEC\_K8S\_6      | MEDIUM   |
| [Containers with NET\_RAW capability admitted misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-7.md)                                                                            | APPSEC\_K8S\_7      | LOW      |
| [CPU request is not set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-10.md)                                                                                                 | APPSEC\_K8S\_10     | LOW      |
| [CPU limits are not set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-11.md)                                                                                                 | APPSEC\_K8S\_11     | LOW      |
| [Memory requests are not set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-12.md)                                                                                            | APPSEC\_K8S\_12     | LOW      |
| [Memory limits are not set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-13.md)                                                                                              | APPSEC\_K8S\_13     | LOW      |
| [Image tag is not set to Fixed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-14.md)                                                                                          | APPSEC\_K8S\_14     | LOW      |
| [Image pull policy is not set to Always misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-15.md)                                                                                 | APPSEC\_K8S\_15     | LOW      |
| [Container is privileged misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-16.md)                                                                                                | APPSEC\_K8S\_16     | HIGH     |
| [Containers share host process ID namespace misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-17.md)                                                                             | APPSEC\_K8S\_17     | MEDIUM   |
| [Containers share host IPC namespace misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-18.md)                                                                                    | APPSEC\_K8S\_18     | MEDIUM   |
| [Containers run with AllowPrivilegeEscalation misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-20.md)                                                                           | APPSEC\_K8S\_20     | MEDIUM   |
| [Default namespace is used misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-21.md)                                                                                              | APPSEC\_K8S\_21     | LOW      |
| [Read-Only filesystem for containers is not used misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-22.md)                                                                        | APPSEC\_K8S\_22     | LOW      |
| [Admission of root containers not minimized misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-23.md)                                                                             | APPSEC\_K8S\_23     | MEDIUM   |
| [Containers with added capability are allowed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-24.md)                                                                           | APPSEC\_K8S\_24     | LOW      |
| [Admission of containers with added capability is not minimized misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-25.md)                                                         | APPSEC\_K8S\_25     | LOW      |
| [Mounting Docker socket daemon in a container is not limited misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-27.md)                                                            | APPSEC\_K8S\_27     | MEDIUM   |
| [Admission of containers with NET\_RAW capability is not minimized misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-28.md)                                                      | APPSEC\_K8S\_28     | LOW      |
| [securityContext is not applied to pods and containers misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-29.md)                                                                  | APPSEC\_K8S\_29     | LOW      |
| [securityContext is not applied to pods and containers in container context misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-30.md)                                             | APPSEC\_K8S\_30     | LOW      |
| [seccomp is not set to Docker/Default or Runtime/Default misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-31.md)                                                                | APPSEC\_K8S\_31     | LOW      |
| [seccomp profile is not set to Docker/Default or Runtime/Default misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-32.md)                                                        | APPSEC\_K8S\_32     | LOW      |
| [Kubernetes dashboard is deployed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-33.md)                                                                                       | APPSEC\_K8S\_33     | LOW      |
| [Tiller (Helm V2) is deployed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-34.md)                                                                                           | APPSEC\_K8S\_34     | LOW      |
| [Admission of containers with capabilities assigned is not minimised misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-36.md)                                                    | APPSEC\_K8S\_36     | LOW      |
| [Admission of containers with capabilities assigned is not limited misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-37.md)                                                      | APPSEC\_K8S\_37     | LOW      |
| [CAP\_SYS\_ADMIN Linux capability is used misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-39.md)                                                                               | APPSEC\_K8S\_39     | HIGH     |
| [Containers do not run with a high UID misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-40.md)                                                                                  | APPSEC\_K8S\_40     | LOW      |
| [Images are not selected using a digest misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-43.md)                                                                                 | APPSEC\_K8S\_43     | LOW      |
| [Tiller (Helm v2) service is not deleted misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-44.md)                                                                                | APPSEC\_K8S\_44     | LOW      |
| [The admission control plugin EventRateLimit is not set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-78.md)                                                                 | APPSEC\_K8S\_78     | MEDIUM   |
| [The admission control plugin AlwaysAdmit is set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-79.md)                                                                        | APPSEC\_K8S\_79     | MEDIUM   |
| [The admission control plugin AlwaysPullImages is not set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-80.md)                                                               | APPSEC\_K8S\_80     | MEDIUM   |
| [The admission control plugin NamespaceLifecycle is not set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-83.md)                                                             | APPSEC\_K8S\_83     | LOW      |
| [The --terminated-pod-gc-threshold argument for controller managers is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-106.md)                           | APPSEC\_K8S\_106    | MEDIUM   |
| [The --streaming-connection-idle-timeout argument is set to 0 misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-143.md)                                                          | APPSEC\_K8S\_143    | LOW      |
| [The --protect-kernel-defaults argument is not set to True misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-144.md)                                                             | APPSEC\_K8S\_144    | LOW      |
| [The --hostname-override argument is set misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-k8s-146.md)                                                                               | APPSEC\_K8S\_146    | LOW      |
| [OCI Compute Instance boot volume has in-transit data encryption is disabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-oci-4.md)                                             | APPSEC\_OCI\_4      | LOW      |
| [OCI Compute Instance has Legacy MetaData service endpoint enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-oci-5.md)                                                       | APPSEC\_OCI\_5      | MEDIUM   |
| [Operation objects do not have the 'produces' field defined for GET operations misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-openapi-16.md)                                      | APPSEC\_OPENAPI\_16 | LOW      |
| [Operation objects for PUT, POST, and PATCH operations do not have a 'consumes' field defined misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-openapi-17.md)                       | APPSEC\_OPENAPI\_17 | MEDIUM   |
| [Array does not have a maximum number of items misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec-openapi-21.md)                                                                      | APPSEC\_OPENAPI\_21 | MEDIUM   |
| [DNF usage of packages with untrusted or missing GPG signatures allowed misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-ansible-4.md)                                             | APPSEC2\_ANSIBLE\_4 | MEDIUM   |
| [SSL validation disabled within Ansible DNF module misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-ansible-5.md)                                                                  | APPSEC2\_ANSIBLE\_5 | MEDIUM   |
| [Certificate validation disabled within Ansible DNF module misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-ansible-6.md)                                                          | APPSEC2\_ANSIBLE\_6 | MEDIUM   |
| [AWS Elasticsearch domain has Dedicated master set to disabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-aws-59.md)                                                         | APPSEC2\_AWS\_59    | LOW      |
| [Azure Virtual Machines does not utilise Managed Disks misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-azure-9.md)                                                                | APPSEC2\_AZURE\_9   | LOW      |
| [Microsoft Antimalware is not configured to automatically update Virtual Machines misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-azure-10.md)                                    | APPSEC2\_AZURE\_10  | LOW      |
| [Dockerfile contains the use of 'sudo' misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-1.md)                                                                               | APPSEC2\_DOCKER\_1  | LOW      |
| [Dockerfile certificate validation is disabled with curl misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-2.md)                                                             | APPSEC2\_DOCKER\_2  | HIGH     |
| [Dockerfile certificate validation is disabled with wget misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-3.md)                                                             | APPSEC2\_DOCKER\_3  | HIGH     |
| [Dockerfile certificate validation is disabled with the pip '--trusted-host' option misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-4.md)                                  | APPSEC2\_DOCKER\_4  | HIGH     |
| [Dockerfile certificate validation is disabled with the PYTHONHTTPSVERIFY environment variable misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-5.md)                       | APPSEC2\_DOCKER\_5  | HIGH     |
| [Dockerfile Node.js certificate validation is disabled with the NODE\_TLS\_REJECT\_UNAUTHORIZED environment variable misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-6.md) | APPSEC2\_DOCKER\_6  | HIGH     |
| [Dockerfile APK package manager is configured to allow untrusted repositories misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-7.md)                                        | APPSEC2\_DOCKER\_7  | MEDIUM   |
| [Dockerfile APT package manager is configured to allow unauthenticated packages misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-8.md)                                      | APPSEC2\_DOCKER\_8  | MEDIUM   |
| [Dockerfile YUM package manager is configured to skip GPG signature checks misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-9.md)                                           | APPSEC2\_DOCKER\_9  | MEDIUM   |
| [Dockerfile RPM package manager is configured to skip package signature checks misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-10.md)                                      | APPSEC2\_DOCKER\_10 | HIGH     |
| [Dockerfile APT package manager is configured to force package installations without prompts or verifications misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-11.md)       | APPSEC2\_DOCKER\_11 | HIGH     |
| [Dockerfile configuration disables strict SSL for NPM misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-12.md)                                                               | APPSEC2\_DOCKER\_12 | HIGH     |
| [Dockerfile sets NPM configuration to disable strict SSL misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-13.md)                                                            | APPSEC2\_DOCKER\_13 | HIGH     |
| [Dockerfile configures GIT to disable SSL verification misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-14.md)                                                              | APPSEC2\_DOCKER\_14 | HIGH     |
| [Dockerfile sets YUM configuration to disable SSL verification misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-15.md)                                                      | APPSEC2\_DOCKER\_15 | HIGH     |
| [Dockerfile uses a trusted host with pip misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-docker-16.md)                                                                            | APPSEC2\_DOCKER\_16 | MEDIUM   |
| [GCP Kubernetes Engine Clusters have Alpha cluster feature enabled misconfiguration detected in code](/appsec-rules/iac-security/compute/appsec2-gcp-19.md)                                                     | APPSEC2\_GCP\_19    | LOW      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.