> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam.md). # IAM | Rule Name | AppSec Rule ID | Severity | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | -------- | | [Alibaba Cloud RAM password policy does not have a minimum of 14 characters misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-13.md) | APPSEC\_ALI\_13 | LOW | | [Alibaba Cloud RAM password policy does not have a number misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-14.md) | APPSEC\_ALI\_14 | MEDIUM | | [Alibaba Cloud RAM password policy does not have a symbol misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-15.md) | APPSEC\_ALI\_15 | LOW | | [Alibaba Cloud RAM password policy does not expire in 90 days misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-16.md) | APPSEC\_ALI\_16 | LOW | | [Alibaba Cloud RAM password policy does not have a lowercase character misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-17.md) | APPSEC\_ALI\_17 | LOW | | [Alibaba Cloud RAM password policy does not prevent password reuse misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-18.md) | APPSEC\_ALI\_18 | MEDIUM | | [Alibaba Cloud RAM password policy does not have an uppercase character misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-19.md) | APPSEC\_ALI\_19 | MEDIUM | | [Alibaba Cloud RAM password policy maximal login attempts is more than 4 misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-23.md) | APPSEC\_ALI\_23 | MEDIUM | | [Alibaba Cloud RAM does not enforce MFA misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-24.md) | APPSEC\_ALI\_24 | LOW | | [Alibaba Cloud KMS Key Rotation is disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-27.md) | APPSEC\_ALI\_27 | LOW | | [Alibaba Cloud KMS Key is disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-ali-28.md) | APPSEC\_ALI\_28 | LOW | | [AWS IAM policies that allow full administrative privileges are created misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-1.md) | APPSEC\_AWS\_1 | LOW | | [AWS Customer Master Key (CMK) rotation is not enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-7.md) | APPSEC\_AWS\_7 | LOW | | [AWS IAM password policy does not expire in 90 days misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-9.md) | APPSEC\_AWS\_9 | LOW | | [AWS IAM password policy does not have a minimum of 14 characters misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-10.md) | APPSEC\_AWS\_10 | LOW | | [AWS IAM password policy does not have a lowercase character misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-11.md) | APPSEC\_AWS\_11 | LOW | | [AWS IAM password policy does not have a number misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-12.md) | APPSEC\_AWS\_12 | LOW | | [AWS IAM password policy does allow password reuse misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-13.md) | APPSEC\_AWS\_13 | HIGH | | [AWS IAM password policy does not have a symbol misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-14.md) | APPSEC\_AWS\_14 | LOW | | [AWS IAM password policy does not have an uppercase character misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-15.md) | APPSEC\_AWS\_15 | LOW | | [AWS Private ECR repository policy is overly permissive misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-32.md) | APPSEC\_AWS\_32 | MEDIUM | | [AWS KMS Key policy overly permissive misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-33.md) | APPSEC\_AWS\_33 | MEDIUM | | [AWS IAM policy attached to users misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-40.md) | APPSEC\_AWS\_40 | LOW | | [AWS IAM policy documents do not allow \* (asterisk) as a statement's action misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-49.md) | APPSEC\_AWS\_49 | HIGH | | [AWS IAM role allows all services or principals to be assumed misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-60.md) | APPSEC\_AWS\_60 | HIGH | | [AWS IAM policy allows all principals used by any AWS service from target account to assume role misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-61.md) | APPSEC\_AWS\_61 | HIGH | | [AWS IAM policies that allow full "*-*" administrative privileges are created misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-62.md) | APPSEC\_AWS\_62 | HIGH | | [AWS IAM policy documents allow \* (asterisk) as a statement's action misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-63.md) | APPSEC\_AWS\_63 | HIGH | | [SQS policy allows all actions misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-72.md) | APPSEC\_AWS\_72 | LOW | | [Credentials exposure actions return credentials in an API response misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-107.md) | APPSEC\_AWS\_107 | LOW | | [Data exfiltration allowed without resource constraints misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-108.md) | APPSEC\_AWS\_108 | LOW | | [Resource exposure allows modification of policies and exposes resources misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-109.md) | APPSEC\_AWS\_109 | LOW | | [IAM policies allow privilege escalation misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-110.md) | APPSEC\_AWS\_110 | MEDIUM | | [Write access allowed without constraint misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-111.md) | APPSEC\_AWS\_111 | LOW | | [Respective logs of Amazon RDS are disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-129.md) | APPSEC\_AWS\_129 | LOW | | [RDS database does not have IAM authentication enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-161.md) | APPSEC\_AWS\_161 | MEDIUM | | [AWS RDS cluster not configured with IAM authentication misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-162.md) | APPSEC\_AWS\_162 | LOW | | [Glacier Vault access policy is public and not restricted to specific services or principals misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-167.md) | APPSEC\_AWS\_167 | MEDIUM | | [SQS queue policy is public and access is not restricted to specific services or principals misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-168.md) | APPSEC\_AWS\_168 | HIGH | | [SNS topic policy is public and access is not restricted to specific services or principals misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-169.md) | APPSEC\_AWS\_169 | MEDIUM | | [AWS AMI launch permissions are not limited misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-205.md) | APPSEC\_AWS\_205 | LOW | | [AWS Key Management Service (KMS) key is disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-227.md) | APPSEC\_AWS\_227 | LOW | | [AWS Execution Role ARN and Task Role ARN are different in ECS Task definitions misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-249.md) | APPSEC\_AWS\_249 | LOW | | [AWS Codecommit branch changes has less than 2 approvals misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-257.md) | APPSEC\_AWS\_257 | LOW | | [AWS Lambda function URL AuthType set to NONE misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-258.md) | APPSEC\_AWS\_258 | MEDIUM | | [Access is not controlled through Single Sign-On (SSO) misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-273.md) | APPSEC\_AWS\_273 | LOW | | [AWS AdministratorAccess policy is used by IAM roles, users, or groups misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-274.md) | APPSEC\_AWS\_274 | HIGH | | [IAM policy uses the AWS AdministratorAccess policy misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-275.md) | APPSEC\_AWS\_275 | HIGH | | [IAM Policy Document Allows All or Any AWS Principal Permissions to Resources misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-283.md) | APPSEC\_AWS\_283 | HIGH | | [AWS IAM Policy permission may cause privilege escalation misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-286.md) | APPSEC\_AWS\_286 | MEDIUM | | [IAM policies allow exposure of credentials misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-287.md) | APPSEC\_AWS\_287 | HIGH | | [IAM policies allow data exfiltration misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-288.md) | APPSEC\_AWS\_288 | HIGH | | [IAM policies allow permissions management or resource exposure without constraints misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-289.md) | APPSEC\_AWS\_289 | HIGH | | [IAM policies allow write access without constraints misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-290.md) | APPSEC\_AWS\_290 | HIGH | | [AWS Lambda Function resource-based policy is overly permissive misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-301.md) | APPSEC\_AWS\_301 | LOW | | [Authorization type for API GatewayV2 routes is not specified misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-309.md) | APPSEC\_AWS\_309 | MEDIUM | | [AWS Access key enabled on root account misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-348.md) | APPSEC\_AWS\_348 | HIGH | | [IAM policy document allows all resources with restricted actions misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-355.md) | APPSEC\_AWS\_355 | HIGH | | [Data source IAM policy document allows all resources with restricted actions misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-356.md) | APPSEC\_AWS\_356 | HIGH | | [AWS GitHub Actions OIDC authorization policies allow for unsafe claims or claim order misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-358.md) | APPSEC\_AWS\_358 | HIGH | | [AWS Neptune Cluster not configured with IAM authentication misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-359.md) | APPSEC\_AWS\_359 | LOW | | [Permissions delegated to AWS services for AWS Lambda functions are not limited by SourceArn or SourceAccount misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-364.md) | APPSEC\_AWS\_364 | HIGH | | [AWS Cognito identity pool allows unauthenticated guest access misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-366.md) | APPSEC\_AWS\_366 | MEDIUM | | [AWS Security Group allows unrestricted egress traffic misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-382.md) | APPSEC\_AWS\_382 | LOW | | [AWS GitHub Actions OIDC authorization policies allow for unsafe claims or claim order on IAM role misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-aws-393.md) | APPSEC\_AWS\_393 | HIGH | | [Azure AKS enable role-based access control (RBAC) not enforced misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-5.md) | APPSEC\_AZURE\_5 | MEDIUM | | [Azure AKS cluster configured with overly permissive API server access misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-6.md) | APPSEC\_AZURE\_6 | LOW | | [Azure App Service Web app authentication is off misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-13.md) | APPSEC\_AZURE\_13 | LOW | | [App Service is not registered with an Azure Active Directory account misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-16.md) | APPSEC\_AZURE\_16 | MEDIUM | | [Azure subscriptions with custom roles does not have minimum permissions misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-39.md) | APPSEC\_AZURE\_39 | HIGH | | [Azure Function App authentication is off misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-56.md) | APPSEC\_AZURE\_56 | LOW | | [Azure App Service Web app doesn't have a Managed Service Identity misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-71.md) | APPSEC\_AZURE\_71 | LOW | | [AKS does not use Azure policies add-on misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-116.md) | APPSEC\_AZURE\_116 | LOW | | [Active Directory is not used for authentication for Service Fabric misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-125.md) | APPSEC\_AZURE\_125 | LOW | | [Azure ACR admin account is enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-137.md) | APPSEC\_AZURE\_137 | LOW | | [Azure ACR enables anonymous image pulling misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-138.md) | APPSEC\_AZURE\_138 | LOW | | [Azure CosmosDB does not have Local Authentication disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-140.md) | APPSEC\_AZURE\_140 | LOW | | [Azure Kubernetes Service (AKS) local admin account is enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-141.md) | APPSEC\_AZURE\_141 | LOW | | [Azure SQL on Virtual Machine (Linux) with basic authentication misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-149.md) | APPSEC\_AZURE\_149 | LOW | | [Web PubSub Without Managed Identities misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-176.md) | APPSEC\_AZURE\_176 | MEDIUM | | [Linux VM Without SSH Key misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-178.md) | APPSEC\_AZURE\_178 | HIGH | | [Data Explorer Not Using Managed Identities misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-181.md) | APPSEC\_AZURE\_181 | MEDIUM | | [App Configuration Using Local Authentication misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-184.md) | APPSEC\_AZURE\_184 | HIGH | | [Azure Event Grid Topic Managed Identity Provider misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-191.md) | APPSEC\_AZURE\_191 | MEDIUM | | [Azure Event Grid Topic Local Authentication Enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-192.md) | APPSEC\_AZURE\_192 | MEDIUM | | [Azure Event Grid Domain Managed Identity Provider is Disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-194.md) | APPSEC\_AZURE\_194 | MEDIUM | | [Azure Event Grid Domain Local Authentication Enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-195.md) | APPSEC\_AZURE\_195 | MEDIUM | | [Azure Service Bus Without Managed Identity Provider misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-202.md) | APPSEC\_AZURE\_202 | MEDIUM | | [Azure Service Bus with Local Authentication Enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-203.md) | APPSEC\_AZURE\_203 | LOW | | [Azure Cognitive Search Without Managed Identities misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-207.md) | APPSEC\_AZURE\_207 | MEDIUM | | [Local users used for Azure Storage misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-244.md) | APPSEC\_AZURE\_244 | LOW | | [Azure GitHub Actions OIDC trust policy is insecurely configured misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-azure-249.md) | APPSEC\_AZURE\_249 | HIGH | | [GCP Kubernetes Engine Clusters have Legacy Authorization enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-7.md) | APPSEC\_GCP\_7 | LOW | | [GCP Kubernetes engine clusters have client certificate disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-13.md) | APPSEC\_GCP\_13 | LOW | | [GCP Kubernetes Engine Clusters have pod security policy disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-24.md) | APPSEC\_GCP\_24 | LOW | | [GCP VM instance configured with default service account misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-30.md) | APPSEC\_GCP\_30 | LOW | | [GCP VM instance using a default service account with Cloud Platform access scope misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-31.md) | APPSEC\_GCP\_31 | MEDIUM | | [GCP IAM user are assigned Service Account User or Service Account Token creator roles at project level misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-41.md) | APPSEC\_GCP\_41 | HIGH | | [GCP IAM Service account does have admin privileges misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-42.md) | APPSEC\_GCP\_42 | HIGH | | [Roles impersonate or manage Service Accounts used at folder level misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-44.md) | APPSEC\_GCP\_44 | HIGH | | [Roles impersonate or manage Service Accounts used at organizational level misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-45.md) | APPSEC\_GCP\_45 | HIGH | | [Default Service Account is used at project level misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-46.md) | APPSEC\_GCP\_46 | HIGH | | [Default Service Account is used at organization level misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-47.md) | APPSEC\_GCP\_47 | HIGH | | [Default Service Account is used at folder level misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-48.md) | APPSEC\_GCP\_48 | HIGH | | [GCP IAM primitive roles are in use misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-49.md) | APPSEC\_GCP\_49 | LOW | | [Kubernetes RBAC users are not managed with Google Groups for GKE misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-65.md) | APPSEC\_GCP\_65 | LOW | | [GCP Kubernetes Engine Clusters have binary authorization disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-66.md) | APPSEC\_GCP\_66 | LOW | | [GCP Memorystore for Redis has AUTH disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-95.md) | APPSEC\_GCP\_95 | MEDIUM | | [KMS policy allows public access misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-112.md) | APPSEC\_GCP\_112 | HIGH | | [IAM policy defines public access misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-113.md) | APPSEC\_GCP\_113 | HIGH | | [Basic roles utilized at the organization level misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-115.md) | APPSEC\_GCP\_115 | HIGH | | [Basic roles used at the folder level misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-116.md) | APPSEC\_GCP\_116 | MEDIUM | | [Project level utilization of basic roles misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-117.md) | APPSEC\_GCP\_117 | HIGH | | [IAM workload identity pool provider is not restricted misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-118.md) | APPSEC\_GCP\_118 | HIGH | | [GCP GitHub Actions OIDC trust policy is insecurely configured misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-gcp-125.md) | APPSEC\_GCP\_125 | HIGH | | [GitHub pull request configurations defined in Terraform have less than 2 approvals misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-git-5.md) | APPSEC\_GIT\_5 | MEDIUM | | [GitHub repository defined in Terraform does not have GPG signatures for all commits misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-git-6.md) | APPSEC\_GIT\_6 | LOW | | [Gitlab project defined in Terraform requires fewer than 2 approvals misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-glb-1.md) | APPSEC\_GLB\_1 | MEDIUM | | [Gitlab branch protection rules defined in Terraform allow force push misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-glb-2.md) | APPSEC\_GLB\_2 | MEDIUM | | [Gitlab project defined in Terraform does not require signed commits misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-glb-4.md) | APPSEC\_GLB\_4 | LOW | | [Containers run with AllowPrivilegeEscalation based on Pod Security Policy setting misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-5.md) | APPSEC\_K8S\_5 | MEDIUM | | [Secrets used as environment variables misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-35.md) | APPSEC\_K8S\_35 | LOW | | [Service account tokens are not mounted where necessary misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-38.md) | APPSEC\_K8S\_38 | LOW | | [Default service accounts are actively used misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-41.md) | APPSEC\_K8S\_41 | LOW | | [Default Kubernetes service accounts are actively used by bounding to a role or cluster role misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-42.md) | APPSEC\_K8S\_42 | LOW | | [Wildcard use is not minimized in Roles and ClusterRoles misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-49.md) | APPSEC\_K8S\_49 | MEDIUM | | [The --anonymous-auth argument is not set to False for API server misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-68.md) | APPSEC\_K8S\_68 | LOW | | [The --basic-auth-file argument is Set misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-69.md) | APPSEC\_K8S\_69 | LOW | | [The --token-auth-file argument is Set misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-70.md) | APPSEC\_K8S\_70 | LOW | | [The --kubelet-client-certificate and --kubelet-client-key arguments are not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-72.md) | APPSEC\_K8S\_72 | HIGH | | [The --kubelet-certificate-authority argument is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-73.md) | APPSEC\_K8S\_73 | HIGH | | [The --authorization-mode argument is set to AlwaysAllow for Kubelet misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-74.md) | APPSEC\_K8S\_74 | MEDIUM | | [The --authorization-mode argument does not include node misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-75.md) | APPSEC\_K8S\_75 | MEDIUM | | [The --authorization-mode argument does not include RBAC misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-77.md) | APPSEC\_K8S\_77 | LOW | | [The admission control plugin SecurityContextDeny is set if PodSecurityPolicy is used misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-81.md) | APPSEC\_K8S\_81 | LOW | | [The admission control plugin ServiceAccount is not set misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-82.md) | APPSEC\_K8S\_82 | LOW | | [The admission control plugin PodSecurityPolicy is not set misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-84.md) | APPSEC\_K8S\_84 | LOW | | [The admission control plugin NodeRestriction is not set misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-85.md) | APPSEC\_K8S\_85 | MEDIUM | | [The --service-account-lookup argument is not set to true misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-96.md) | APPSEC\_K8S\_96 | HIGH | | [The --service-account-key-file argument is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-97.md) | APPSEC\_K8S\_97 | MEDIUM | | [The --etcd-cafile argument is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-102.md) | APPSEC\_K8S\_102 | HIGH | | [The --use-service-account-credentials argument for controller managers is not set to True misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-108.md) | APPSEC\_K8S\_108 | HIGH | | [The --service-account-private-key-file argument for controller managers is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-110.md) | APPSEC\_K8S\_110 | HIGH | | [The --root-ca-file argument for controller managers is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-111.md) | APPSEC\_K8S\_111 | HIGH | | [The RotateKubeletServerCertificate argument for controller managers is not set to True misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-112.md) | APPSEC\_K8S\_112 | MEDIUM | | [The --client-cert-auth argument is not set to True misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-117.md) | APPSEC\_K8S\_117 | MEDIUM | | [The --peer-client-cert-auth argument is not set to True misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-121.md) | APPSEC\_K8S\_121 | HIGH | | [The --anonymous-auth argument is not set to False for Kubelet misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-138.md) | APPSEC\_K8S\_138 | MEDIUM | | [The --authorization-mode argument is set to AlwaysAllow for API server misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-139.md) | APPSEC\_K8S\_139 | LOW | | [The --client-ca-file argument for API Servers is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-140.md) | APPSEC\_K8S\_140 | LOW | | [The --rotate-certificates argument is set to false misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-149.md) | APPSEC\_K8S\_149 | HIGH | | [Kubernetes ClusterRoles that grant control over validating or mutating admission webhook configurations are not minimized misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-155.md) | APPSEC\_K8S\_155 | HIGH | | [Kubernetes ClusterRoles that grant permissions to approve CertificateSigningRequests are not minimized misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-156.md) | APPSEC\_K8S\_156 | HIGH | | [Kubernetes Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings are not minimized misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-157.md) | APPSEC\_K8S\_157 | MEDIUM | | [Kubernetes Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRole are not minimized misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-k8s-158.md) | APPSEC\_K8S\_158 | MEDIUM | | [OCI private keys are hard coded in the provider misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-oci-1.md) | APPSEC\_OCI\_1 | LOW | | [OCI IAM password policy for local (non-federated) users does not have a lowercase character misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-oci-11.md) | APPSEC\_OCI\_11 | MEDIUM | | [OCI IAM password policy for local (non-federated) users does not have a number misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-oci-12.md) | APPSEC\_OCI\_12 | MEDIUM | | [OCI IAM password policy for local (non-federated) users does not have a symbol misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-oci-13.md) | APPSEC\_OCI\_13 | MEDIUM | | [OCI IAM password policy for local (non-federated) users does not have an uppercase character misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-oci-14.md) | APPSEC\_OCI\_14 | MEDIUM | | [OCI IAM password policy for local (non-federated) users does not have minimum 14 characters misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-oci-18.md) | APPSEC\_OCI\_18 | MEDIUM | | [OpenAPI Security object needs to have defined rules in its array and rules should be defined in the securityScheme misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-4.md) | APPSEC\_OPENAPI\_4 | HIGH | | [OpenAPI Security object for operations, if defined, must define a security scheme, otherwise it should be considered an error misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-5.md) | APPSEC\_OPENAPI\_5 | HIGH | | [OpenAPI Security requirement not defined in the security definitions misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-6.md) | APPSEC\_OPENAPI\_6 | HIGH | | [API spec includes a 'password' flow in OAuth2 authentication misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-8.md) | APPSEC\_OPENAPI\_8 | HIGH | | [Security scopes of operations are not defined in securityDefinition misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-9.md) | APPSEC\_OPENAPI\_9 | MEDIUM | | [OAuth2 security definitions includes password flow in OpenAPI 2.0 file misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-10.md) | APPSEC\_OPENAPI\_10 | HIGH | | [OAuth2 password flow in security definitions for OpenAPI 2.0 file misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-11.md) | APPSEC\_OPENAPI\_11 | HIGH | | [Security definition uses the deprecated implicit flow on OAuth2 misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-12.md) | APPSEC\_OPENAPI\_12 | MEDIUM | | [Security definitions uses basic auth misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-13.md) | APPSEC\_OPENAPI\_13 | HIGH | | [Operation Objects Uses 'Implicit' Flow misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-14.md) | APPSEC\_OPENAPI\_14 | MEDIUM | | [Operation Objects Uses Basic Auth misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-15.md) | APPSEC\_OPENAPI\_15 | HIGH | | [The global security scope is not defined in the securityDefinitions misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openapi-19.md) | APPSEC\_OPENAPI\_19 | MEDIUM | | [OpenStack hard coded password, token, or application\_credential\_secret exists in provider misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openstack-1.md) | APPSEC\_OPENSTACK\_1 | LOW | | [OpenStack instance use basic credentials misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec-openstack-4.md) | APPSEC\_OPENSTACK\_4 | LOW | | [AWS IAM group not in use misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-14.md) | APPSEC2\_AWS\_14 | LOW | | [Not all IAM users are members of at least one IAM group misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-21.md) | APPSEC2\_AWS\_21 | LOW | | [IAM User has access to the console misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-22.md) | APPSEC2\_AWS\_22 | MEDIUM | | [AWS IAM policy allows full administrative privileges misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-40.md) | APPSEC2\_AWS\_40 | MEDIUM | | [AWS EC2 Instance IAM Role not enabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-41.md) | APPSEC2\_AWS\_41 | LOW | | [AWS S3 buckets are accessible to any authenticated user misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-43.md) | APPSEC2\_AWS\_43 | MEDIUM | | [AWS Cloudfront Distribution with S3 have Origin Access set to disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-46.md) | APPSEC2\_AWS\_46 | LOW | | [AWS OpenSearch Fine-grained access control is disabled misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-52.md) | APPSEC2\_AWS\_52 | LOW | | [The AWS Managed IAMFullAccess IAM policy should not be used misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-56.md) | APPSEC2\_AWS\_56 | HIGH | | [A Policy is not Defined for KMS Key misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-64.md) | APPSEC2\_AWS\_64 | MEDIUM | | [AWS API Gateway method lacking authorization or API keys misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-aws-70.md) | APPSEC2\_AWS\_70 | MEDIUM | | [Azure SQL servers which doesn't have Azure Active Directory admin configured misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-azure-7.md) | APPSEC2\_AZURE\_7 | LOW | | [Azure SQL server not configured with Active Directory admin authentication misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-azure-27.md) | APPSEC2\_AZURE\_27 | LOW | | [Azure Container Instance not configured with the managed identity misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-azure-30.md) | APPSEC2\_AZURE\_30 | LOW | | [Azure Recovery Services vault is not configured with managed identity misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-azure-35.md) | APPSEC2\_AZURE\_35 | LOW | | [Azure Automation account is not configured with managed identity misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-azure-36.md) | APPSEC2\_AZURE\_36 | LOW | | [Azure Storage account configured with Shared Key authorization misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-azure-40.md) | APPSEC2\_AZURE\_40 | LOW | | [Azure Storage account not configured with SAS expiration policy misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-azure-41.md) | APPSEC2\_AZURE\_41 | LOW | | [Anonymous blob access configured in Azure storage account misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-azure-47.md) | APPSEC2\_AZURE\_47 | MEDIUM | | ['chpasswd' is used to set or remove passwords misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-docker-17.md) | APPSEC2\_DOCKER\_17 | MEDIUM | | [GCP Kubernetes Engine Cluster Nodes have default Service account for Project access misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-gcp-1.md) | APPSEC2\_GCP\_1 | LOW | | [There are not only GCP-managed service account keys for each service account misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-gcp-3.md) | APPSEC2\_GCP\_3 | LOW | | [A MySQL database instance allows anyone to connect with administrative privileges misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-gcp-7.md) | APPSEC2\_GCP\_7 | LOW | | [IBM Cloud API key creation is not restricted in account settings in Terraform misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-ibm-3.md) | APPSEC2\_IBM\_3 | MEDIUM | | [IBM Cloud Multi-Factor Authentication (MFA) not enabled at the account level in Terraform misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-ibm-4.md) | APPSEC2\_IBM\_4 | MEDIUM | | [IBM Cloud Service ID creation is not restricted in account settings in Terraform misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-ibm-5.md) | APPSEC2\_IBM\_5 | MEDIUM | | [RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-k8s-1.md) | APPSEC2\_K8S\_1 | HIGH | | [Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-k8s-2.md) | APPSEC2\_K8S\_2 | HIGH | | [No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-k8s-3.md) | APPSEC2\_K8S\_3 | HIGH | | [ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-k8s-4.md) | APPSEC2\_K8S\_4 | MEDIUM | | [No ServiceAccount/Node should be able to read all secrets misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-k8s-5.md) | APPSEC2\_K8S\_5 | HIGH | | [OCI tenancy administrator users are associated with API keys misconfiguration detected in code](/appsec-rules/iac-security/iam/appsec2-oci-1.md) | APPSEC2\_OCI\_1 | MEDIUM | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.