Compute

Rule Name	AppSec Rule ID	Severity
Alibaba Cloud RDS instance is not set to perform auto upgrades for minor versions misconfiguration detected in code	APPSEC_ALI_30	LOW
Disabled Ansible URI certificate validation misconfiguration detected in code	APPSEC_ANSIBLE_1	MEDIUM
Certificate validation disabled with Ansible get_url module misconfiguration detected in code	APPSEC_ANSIBLE_2	MEDIUM
SSL certificate validation disabled with Ansible Yum misconfiguration detected in code	APPSEC_ANSIBLE_3	MEDIUM
SSL validation is disabled with yum misconfiguration detected in code	APPSEC_ANSIBLE_4	MEDIUM
Usage of packages with unauthenticated or missing signatures allowed misconfiguration detected in code	APPSEC_ANSIBLE_5	LOW
Usage of the force parameter disabling signature validation allowed misconfiguration detected in code	APPSEC_ANSIBLE_6	LOW
AWS Lambda functions with tracing not enabled misconfiguration detected in code	APPSEC_AWS_50	LOW
API Gateway does not have X-Ray tracing enabled misconfiguration detected in code	APPSEC_AWS_73	LOW
AWS EC2 instance not configured with Instance Metadata Service v2 (IMDSv2) misconfiguration detected in code	APPSEC_AWS_79	HIGH
AWS EMR cluster is not configured with Kerberos Authentication misconfiguration detected in code	APPSEC_AWS_114	LOW
AWS Lambda function is not configured for function-level concurrent execution Limit misconfiguration detected in code	APPSEC_AWS_115	LOW
AWS Lambda function is not configured for a DLQ misconfiguration detected in code	APPSEC_AWS_116	LOW
AWS Lambda Function is not assigned to access within VPC misconfiguration detected in code	APPSEC_AWS_117	LOW
AWS API Gateway caching is disabled misconfiguration detected in code	APPSEC_AWS_120	LOW
Autoscaling groups did not supply tags to launch configurations misconfiguration detected in code	APPSEC_AWS_153	LOW
ECR image scan on push is not enabled misconfiguration detected in code	APPSEC_AWS_163	HIGH
AWS MQBroker's minor version updates are disabled misconfiguration detected in code	APPSEC_AWS_207	LOW
AWS MQBroker version is not up to date misconfiguration detected in code	APPSEC_AWS_208	LOW
AWS Batch Job is defined as a privileged container misconfiguration detected in code	APPSEC_AWS_210	LOW
AWS API deployments do not enable Create before Destroy misconfiguration detected in code	APPSEC_AWS_217	LOW
AWS DMS replication instance automatic version upgrade disabled misconfiguration detected in code	APPSEC_AWS_222	LOW
AWS API Gateway method settings do not enable caching misconfiguration detected in code	APPSEC_AWS_225	LOW
AWS DB instance does not get all minor upgrades automatically misconfiguration detected in code	APPSEC_AWS_226	LOW
AWS ACM certificate does not enable Create before Destroy misconfiguration detected in code	APPSEC_AWS_233	LOW
Ensure AWS API gateway enables Create before Destroy misconfiguration detected in code	APPSEC_AWS_237	LOW
AWS HTTP and HTTPS target groups do not define health check misconfiguration detected in code	APPSEC_AWS_261	LOW
AWS Lambda function is not configured to validate code-signing misconfiguration detected in code	APPSEC_AWS_272	HIGH
API Gateway method setting is not set to encrypted caching misconfiguration detected in code	APPSEC_AWS_308	HIGH
RDS cluster is not configured to copy tags to snapshots misconfiguration detected in code	APPSEC_AWS_313	LOW
EC2 Auto Scaling groups are not utilizing EC2 launch templates misconfiguration detected in code	APPSEC_AWS_315	MEDIUM
AWS CodeBuild project environment privileged mode is enabled misconfiguration detected in code	APPSEC_AWS_316	MEDIUM
Elasticsearch domains are not configured with a minimum of three dedicated master nodes misconfiguration detected in code	APPSEC_AWS_318	MEDIUM
Redshift clusters are not using the default database name. misconfiguration detected in code	APPSEC_AWS_320	MEDIUM
Redshift clusters are not using enhanced VPC routing misconfiguration detected in code	APPSEC_AWS_321	MEDIUM
AWS ElastiCache Redis cluster automatic version upgrade disabled misconfiguration detected in code	APPSEC_AWS_322	LOW
ECS Fargate services are not ensured to run on the latest Fargate platform version misconfiguration detected in code	APPSEC_AWS_332	MEDIUM
AWS ECS task definition elevated privileges enabled misconfiguration detected in code	APPSEC_AWS_334	MEDIUM
ECS task definitions have their own unique process namespace or share the host's process namespace misconfiguration detected in code	APPSEC_AWS_335	MEDIUM
AWS ECS task definition is not configured with read-only access to container root filesystems misconfiguration detected in code	APPSEC_AWS_336	LOW
AWS Elastic Beanstalk environment managed platform updates are not enabled misconfiguration detected in code	APPSEC_AWS_340	LOW
AWS Auto Scaling group launch configuration configured with Instance Metadata Service hop count greater than 1 misconfiguration detected in code	APPSEC_AWS_341	MEDIUM
Runtime of Lambda is deprecated misconfiguration detected in code	APPSEC_AWS_363	MEDIUM
Hard-coded secrets found in Parameter Store values misconfiguration detected in code	APPSEC_AWS_384	MEDIUM
Potential WhoAMI name confusion attack exposure misconfiguration detected in code	APPSEC_AWS_386	LOW
AWS SQS queue access policy is overly permissive misconfiguration detected in code	APPSEC_AWS_387	LOW
Secrets are exposed in Azure VM customData misconfiguration detected in code	APPSEC_AZURE_45	HIGH
Azure Linux scale set does not use an SSH key misconfiguration detected in code	APPSEC_AZURE_49	HIGH
Virtual Machine extensions are installed misconfiguration detected in code	APPSEC_AZURE_50	MEDIUM
Azure App Service Web app doesn't use latest .Net framework version misconfiguration detected in code	APPSEC_AZURE_80	LOW
Azure App Service Web app does not use latest PHP version misconfiguration detected in code	APPSEC_AZURE_81	LOW
Azure App Service Web app does not use latest Python version misconfiguration detected in code	APPSEC_AZURE_82	LOW
Azure App Service Web app does not use latest Java version misconfiguration detected in code	APPSEC_AZURE_83	LOW
Azure Linux and Windows Virtual Machines does not utilize Managed Disks misconfiguration detected in code	APPSEC_AZURE_92	LOW
Automatic OS image patching is disabled for Virtual Machine scale sets misconfiguration detected in code	APPSEC_AZURE_95	LOW
Azure Data Factory does not use Git repository for source control misconfiguration detected in code	APPSEC_AZURE_103	LOW
Azure Service Fabric cluster not configured with cluster protection level security misconfiguration detected in code	APPSEC_AZURE_126	LOW
Azure Container Registry (ACR) Isn't Configured to Use Signed/Trusted Images misconfiguration detected in code	APPSEC_AZURE_164	MEDIUM
Azure Kubernetes Cluster (AKS) Nodes Don't Limit the Maximum Pods to Greater than 50 misconfiguration detected in code	APPSEC_AZURE_168	LOW
Azure Kubernetes Cluster (AKS) Nodes Do Not Use Scale Sets misconfiguration detected in code	APPSEC_AZURE_169	LOW
AKS Doesn't Use the Paid SKU for its SLA misconfiguration detected in code	APPSEC_AZURE_170	LOW
AKS Cluster Without Upgrade Channel misconfiguration detected in code	APPSEC_AZURE_171	LOW
Windows VM Without Automatic Updates misconfiguration detected in code	APPSEC_AZURE_177	MEDIUM
VM Without Azure VM Agent Installed misconfiguration detected in code	APPSEC_AZURE_179	LOW
App Configuration Not Using Standard SKU misconfiguration detected in code	APPSEC_AZURE_188	LOW
Azure App Service Plan is Not Suitable for Production misconfiguration detected in code	APPSEC_AZURE_211	LOW
Azure App Service Not Always On misconfiguration detected in code	APPSEC_AZURE_214	LOW
Operating system disks are not ephemeral disks misconfiguration detected in code	APPSEC_AZURE_226	MEDIUM
Non-Critical System Pods Run on System Nodes misconfiguration detected in code	APPSEC_AZURE_232	HIGH
Healthcheck instructions have not been added to container images misconfiguration detected in code	APPSEC_DOCKER_2	LOW
A user for the container has not been created misconfiguration detected in code	APPSEC_DOCKER_3	LOW
Copy is not used instead of Add in Dockerfiles misconfiguration detected in code	APPSEC_DOCKER_4	LOW
Update instructions are used alone in a Dockerfile misconfiguration detected in code	APPSEC_DOCKER_5	LOW
LABEL maintainer is used instead of MAINTAINER (deprecated) misconfiguration detected in code	APPSEC_DOCKER_6	LOW
Base image uses a latest version tag misconfiguration detected in code	APPSEC_DOCKER_7	LOW
Last USER is root misconfiguration detected in code	APPSEC_DOCKER_8	LOW
Docker APT is used misconfiguration detected in code	APPSEC_DOCKER_9	LOW
Docker WORKDIR values are not absolute paths misconfiguration detected in code	APPSEC_DOCKER_10	LOW
Docker From alias is not unique for multistage builds misconfiguration detected in code	APPSEC_DOCKER_11	LOW
GCP Kubernetes Engine Clusters not using Container-Optimized OS for Node image misconfiguration detected in code	APPSEC_GCP_22	LOW
GCP Kubernetes Engine Clusters have legacy compute engine metadata endpoints enabled misconfiguration detected in code	APPSEC_GCP_67	LOW
GCP Kubernetes cluster shielded GKE node with Secure Boot disabled misconfiguration detected in code	APPSEC_GCP_68	LOW
GCP Kubernetes cluster Shielded GKE Nodes feature disabled misconfiguration detected in code	APPSEC_GCP_71	LOW
GCP SQL database does not use the latest Major version misconfiguration detected in code	APPSEC_GCP_79	LOW
GKE NodePool configuration managed at cluster level misconfiguration detected in code	APPSEC_GCP_123	LOW
Containers wishing to share host process ID namespace admitted misconfiguration detected in code	APPSEC_K8S_1	MEDIUM
Privileged containers are admitted misconfiguration detected in code	APPSEC_K8S_2	HIGH
Containers wishing to share host IPC namespace admitted misconfiguration detected in code	APPSEC_K8S_3	MEDIUM
Root containers admitted misconfiguration detected in code	APPSEC_K8S_6	MEDIUM
Containers with NET_RAW capability admitted misconfiguration detected in code	APPSEC_K8S_7	LOW
CPU request is not set misconfiguration detected in code	APPSEC_K8S_10	LOW
CPU limits are not set misconfiguration detected in code	APPSEC_K8S_11	LOW
Memory requests are not set misconfiguration detected in code	APPSEC_K8S_12	LOW
Memory limits are not set misconfiguration detected in code	APPSEC_K8S_13	LOW
Image tag is not set to Fixed misconfiguration detected in code	APPSEC_K8S_14	LOW
Image pull policy is not set to Always misconfiguration detected in code	APPSEC_K8S_15	LOW
Container is privileged misconfiguration detected in code	APPSEC_K8S_16	HIGH
Containers share host process ID namespace misconfiguration detected in code	APPSEC_K8S_17	MEDIUM
Containers share host IPC namespace misconfiguration detected in code	APPSEC_K8S_18	MEDIUM
Containers run with AllowPrivilegeEscalation misconfiguration detected in code	APPSEC_K8S_20	MEDIUM
Default namespace is used misconfiguration detected in code	APPSEC_K8S_21	LOW
Read-Only filesystem for containers is not used misconfiguration detected in code	APPSEC_K8S_22	LOW
Admission of root containers not minimized misconfiguration detected in code	APPSEC_K8S_23	MEDIUM
Containers with added capability are allowed misconfiguration detected in code	APPSEC_K8S_24	LOW
Admission of containers with added capability is not minimized misconfiguration detected in code	APPSEC_K8S_25	LOW
Mounting Docker socket daemon in a container is not limited misconfiguration detected in code	APPSEC_K8S_27	MEDIUM
Admission of containers with NET_RAW capability is not minimized misconfiguration detected in code	APPSEC_K8S_28	LOW
securityContext is not applied to pods and containers misconfiguration detected in code	APPSEC_K8S_29	LOW
securityContext is not applied to pods and containers in container context misconfiguration detected in code	APPSEC_K8S_30	LOW
seccomp is not set to Docker/Default or Runtime/Default misconfiguration detected in code	APPSEC_K8S_31	LOW
seccomp profile is not set to Docker/Default or Runtime/Default misconfiguration detected in code	APPSEC_K8S_32	LOW
Kubernetes dashboard is deployed misconfiguration detected in code	APPSEC_K8S_33	LOW
Tiller (Helm V2) is deployed misconfiguration detected in code	APPSEC_K8S_34	LOW
Admission of containers with capabilities assigned is not minimised misconfiguration detected in code	APPSEC_K8S_36	LOW
Admission of containers with capabilities assigned is not limited misconfiguration detected in code	APPSEC_K8S_37	LOW
CAP_SYS_ADMIN Linux capability is used misconfiguration detected in code	APPSEC_K8S_39	HIGH
Containers do not run with a high UID misconfiguration detected in code	APPSEC_K8S_40	LOW
Images are not selected using a digest misconfiguration detected in code	APPSEC_K8S_43	LOW
Tiller (Helm v2) service is not deleted misconfiguration detected in code	APPSEC_K8S_44	LOW
The admission control plugin EventRateLimit is not set misconfiguration detected in code	APPSEC_K8S_78	MEDIUM
The admission control plugin AlwaysAdmit is set misconfiguration detected in code	APPSEC_K8S_79	MEDIUM
The admission control plugin AlwaysPullImages is not set misconfiguration detected in code	APPSEC_K8S_80	MEDIUM
The admission control plugin NamespaceLifecycle is not set misconfiguration detected in code	APPSEC_K8S_83	LOW
The --terminated-pod-gc-threshold argument for controller managers is not set appropriately misconfiguration detected in code	APPSEC_K8S_106	MEDIUM
The --streaming-connection-idle-timeout argument is set to 0 misconfiguration detected in code	APPSEC_K8S_143	LOW
The --protect-kernel-defaults argument is not set to True misconfiguration detected in code	APPSEC_K8S_144	LOW
The --hostname-override argument is set misconfiguration detected in code	APPSEC_K8S_146	LOW
OCI Compute Instance boot volume has in-transit data encryption is disabled misconfiguration detected in code	APPSEC_OCI_4	LOW
OCI Compute Instance has Legacy MetaData service endpoint enabled misconfiguration detected in code	APPSEC_OCI_5	MEDIUM
Operation objects do not have the 'produces' field defined for GET operations misconfiguration detected in code	APPSEC_OPENAPI_16	LOW
Operation objects for PUT, POST, and PATCH operations do not have a 'consumes' field defined misconfiguration detected in code	APPSEC_OPENAPI_17	MEDIUM
Array does not have a maximum number of items misconfiguration detected in code	APPSEC_OPENAPI_21	MEDIUM
DNF usage of packages with untrusted or missing GPG signatures allowed misconfiguration detected in code	APPSEC2_ANSIBLE_4	MEDIUM
SSL validation disabled within Ansible DNF module misconfiguration detected in code	APPSEC2_ANSIBLE_5	MEDIUM
Certificate validation disabled within Ansible DNF module misconfiguration detected in code	APPSEC2_ANSIBLE_6	MEDIUM
AWS Elasticsearch domain has Dedicated master set to disabled misconfiguration detected in code	APPSEC2_AWS_59	LOW
Azure Virtual Machines does not utilise Managed Disks misconfiguration detected in code	APPSEC2_AZURE_9	LOW
Microsoft Antimalware is not configured to automatically update Virtual Machines misconfiguration detected in code	APPSEC2_AZURE_10	LOW
Dockerfile contains the use of 'sudo' misconfiguration detected in code	APPSEC2_DOCKER_1	LOW
Dockerfile certificate validation is disabled with curl misconfiguration detected in code	APPSEC2_DOCKER_2	HIGH
Dockerfile certificate validation is disabled with wget misconfiguration detected in code	APPSEC2_DOCKER_3	HIGH
Dockerfile certificate validation is disabled with the pip '--trusted-host' option misconfiguration detected in code	APPSEC2_DOCKER_4	HIGH
Dockerfile certificate validation is disabled with the PYTHONHTTPSVERIFY environment variable misconfiguration detected in code	APPSEC2_DOCKER_5	HIGH
Dockerfile Node.js certificate validation is disabled with the NODE_TLS_REJECT_UNAUTHORIZED environment variable misconfiguration detected in code	APPSEC2_DOCKER_6	HIGH
Dockerfile APK package manager is configured to allow untrusted repositories misconfiguration detected in code	APPSEC2_DOCKER_7	MEDIUM
Dockerfile APT package manager is configured to allow unauthenticated packages misconfiguration detected in code	APPSEC2_DOCKER_8	MEDIUM
Dockerfile YUM package manager is configured to skip GPG signature checks misconfiguration detected in code	APPSEC2_DOCKER_9	MEDIUM
Dockerfile RPM package manager is configured to skip package signature checks misconfiguration detected in code	APPSEC2_DOCKER_10	HIGH
Dockerfile APT package manager is configured to force package installations without prompts or verifications misconfiguration detected in code	APPSEC2_DOCKER_11	HIGH
Dockerfile configuration disables strict SSL for NPM misconfiguration detected in code	APPSEC2_DOCKER_12	HIGH
Dockerfile sets NPM configuration to disable strict SSL misconfiguration detected in code	APPSEC2_DOCKER_13	HIGH
Dockerfile configures GIT to disable SSL verification misconfiguration detected in code	APPSEC2_DOCKER_14	HIGH
Dockerfile sets YUM configuration to disable SSL verification misconfiguration detected in code	APPSEC2_DOCKER_15	HIGH
Dockerfile uses a trusted host with pip misconfiguration detected in code	APPSEC2_DOCKER_16	MEDIUM
GCP Kubernetes Engine Clusters have Alpha cluster feature enabled misconfiguration detected in code	APPSEC2_GCP_19	LOW