> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure.md).

# Public Exposure

| Rule Name                                                                                                                                                                                                        | AppSec Rule ID       | Severity |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | -------- |
| [Alibaba Cloud OSS bucket accessible to public misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-1.md)                                                                    | APPSEC\_ALI\_1       | HIGH     |
| [Alibaba Cloud Security group allow internet traffic to SSH port (22) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-2.md)                                             | APPSEC\_ALI\_2       | LOW      |
| [Alibaba Cloud Security group allow internet traffic to RDP port (3389) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-3.md)                                           | APPSEC\_ALI\_3       | LOW      |
| [Alibaba Cloud database instance accessible to public misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-9.md)                                                             | APPSEC\_ALI\_9       | LOW      |
| [Alibaba Cloud RDS instance does not use SSL misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-20.md)                                                                     | APPSEC\_ALI\_20      | LOW      |
| [Alibaba Cloud API Gateway API Protocol does not use HTTPS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-21.md)                                                       | APPSEC\_ALI\_21      | LOW      |
| [Alibaba cloud ALB ACL does not restrict public access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-29.md)                                                           | APPSEC\_ALI\_29      | LOW      |
| [Alibaba Cloud Mongodb instance does not use SSL misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-42.md)                                                                 | APPSEC\_ALI\_42      | LOW      |
| [Alibaba Cloud MongoDB instance is public misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-ali-43.md)                                                                        | APPSEC\_ALI\_43      | LOW      |
| [AWS Elastic Load Balancer v2 (ELBv2) listener that allow connection requests over HTTP misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-2.md)                           | APPSEC\_AWS\_2       | MEDIUM   |
| [AWS Elasticsearch does not have node-to-node encryption enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-6.md)                                                  | APPSEC\_AWS\_6       | MEDIUM   |
| [AWS RDS database instance is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-17.md)                                                                | APPSEC\_AWS\_17      | MEDIUM   |
| [Not every Security Group rule has a description misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-23.md)                                                                 | APPSEC\_AWS\_23      | LOW      |
| [AWS Security Group allows all traffic on SSH port (22) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-24.md)                                                          | APPSEC\_AWS\_24      | LOW      |
| [AWS Security Group allows all traffic on RDP port (3389) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-25.md)                                                        | APPSEC\_AWS\_25      | LOW      |
| [AWS ElastiCache Redis cluster with in-transit encryption disabled (Replication group) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-30.md)                           | APPSEC\_AWS\_30      | LOW      |
| [AWS ElastiCache Redis cluster with Redis AUTH feature disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-31.md)                                                  | APPSEC\_AWS\_31      | LOW      |
| [AWS CloudFront viewer protocol policy is not configured with HTTPS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-34.md)                                              | APPSEC\_AWS\_34      | MEDIUM   |
| [AWS EKS cluster endpoint access publicly enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-39.md)                                                                | APPSEC\_AWS\_39      | LOW      |
| [AWS access keys and secrets are hard coded in infrastructure misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-41.md)                                                    | APPSEC\_AWS\_41      | HIGH     |
| [Lambda function's environment variables expose secrets misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-45.md)                                                          | APPSEC\_AWS\_45      | MEDIUM   |
| [EC2 user data exposes secrets misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-46.md)                                                                                   | APPSEC\_AWS\_46      | HIGH     |
| [AWS API gateway methods are publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-59.md)                                                                 | APPSEC\_AWS\_59      | LOW      |
| [AWS MQ is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-69.md)                                                                                   | APPSEC\_AWS\_69      | LOW      |
| [AWS Elasticsearch domain is not configured with HTTPS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-83.md)                                                           | APPSEC\_AWS\_83      | MEDIUM   |
| [AWS Redshift cluster instance with public access setting enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-87.md)                                                | APPSEC\_AWS\_87      | MEDIUM   |
| [AWS EC2 instances with public IP and associated with security groups have Internet access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-88.md)                       | APPSEC\_AWS\_88      | HIGH     |
| [AWS DMS replication instance is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-89.md)                                                             | APPSEC\_AWS\_89      | LOW      |
| [Neptune cluster instance is publicly available misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-102.md)                                                                 | APPSEC\_AWS\_102     | HIGH     |
| [AWS Load Balancer is not using TLS 1.2 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-103.md)                                                                         | APPSEC\_AWS\_103     | HIGH     |
| [AWS VPC subnets should not allow automatic public IP assignment misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-130.md)                                                | APPSEC\_AWS\_130     | LOW      |
| [AWS Elasticsearch is not configured inside a VPC misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-137.md)                                                               | APPSEC\_AWS\_137     | LOW      |
| [Redshift is deployed outside of a VPC misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-154.md)                                                                          | APPSEC\_AWS\_154     | LOW      |
| [AWS Transfer Server is publicly exposed misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-164.md)                                                                        | APPSEC\_AWS\_164     | MEDIUM   |
| [AWS CloudFront web distribution using insecure TLS version misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-174.md)                                                     | APPSEC\_AWS\_174     | LOW      |
| [AWS Elasticache security groups are not defined misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-196.md)                                                                | APPSEC\_AWS\_196     | LOW      |
| [AWS API Gateway Domain does not use a modern security policy misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-206.md)                                                   | APPSEC\_AWS\_206     | LOW      |
| [AWS Cloudsearch does not use the latest (Transport Layer Security) TLS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-218.md)                                         | APPSEC\_AWS\_218     | LOW      |
| [AWS Cloudsearch does not use HTTPs misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-220.md)                                                                             | APPSEC\_AWS\_220     | LOW      |
| [AWS Elasticsearch domain does not use an updated TLS policy misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-228.md)                                                    | APPSEC\_AWS\_228     | LOW      |
| [AWS NACL allows ingress from 0.0.0.0/0 to port 21 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-229.md)                                                              | APPSEC\_AWS\_229     | LOW      |
| [AWS NACL allows ingress from 0.0.0.0/0 to port 20 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-230.md)                                                              | APPSEC\_AWS\_230     | LOW      |
| [AWS NACL allows ingress from 0.0.0.0/0 to port 3389 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-231.md)                                                            | APPSEC\_AWS\_231     | LOW      |
| [AWS NACL allows ingress from 0.0.0.0/0 to port 22 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-232.md)                                                              | APPSEC\_AWS\_232     | LOW      |
| [AWS DAX cluster endpoint does not use TLS (Transport Layer Security) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-239.md)                                           | APPSEC\_AWS\_239     | LOW      |
| [AWS CloudFront response header policy does not enforce Strict Transport Security misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-259.md)                               | APPSEC\_AWS\_259     | LOW      |
| [AWS security groups allow ingress from 0.0.0.0/0 to port 80 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-260.md)                                                    | APPSEC\_AWS\_260     | LOW      |
| [AWS Security Group allows all traffic on all ports misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-277.md)                                                             | APPSEC\_AWS\_277     | MEDIUM   |
| [MSK nodes are not private misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-291.md)                                                                                      | APPSEC\_AWS\_291     | HIGH     |
| [AWS RDS snapshots are accessible to public misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-302.md)                                                                     | APPSEC\_AWS\_302     | MEDIUM   |
| [AWS SSM documents are public misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-303.md)                                                                                   | APPSEC\_AWS\_303     | MEDIUM   |
| [AWS CloudFront distributions does not have a default root object configured misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-305.md)                                    | APPSEC\_AWS\_305     | MEDIUM   |
| [AWS SageMaker notebook instance is not placed in VPC misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-306.md)                                                           | APPSEC\_AWS\_306     | LOW      |
| [CloudFront distributions do not have origin failover configured misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-310.md)                                                | APPSEC\_AWS\_310     | MEDIUM   |
| [ElastiCache cluster is using the default subnet group misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-323.md)                                                          | APPSEC\_AWS\_323     | LOW      |
| [AWS Transit Gateway auto accept vpc attachment is enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-331.md)                                                      | APPSEC\_AWS\_331     | LOW      |
| [WAF rule does not have any actions misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-342.md)                                                                             | APPSEC\_AWS\_342     | LOW      |
| [NACL ingress allows all ports misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-352.md)                                                                                  | APPSEC\_AWS\_352     | HIGH     |
| [TLS not enforced in SES configuration set misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-365.md)                                                                      | APPSEC\_AWS\_365     | MEDIUM   |
| [AWS Elastic Load Balancer with listener TLS/SSL is not configured misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-376.md)                                              | APPSEC\_AWS\_376     | LOW      |
| [AWS Load Balancer uses HTTP protocol misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-378.md)                                                                           | APPSEC\_AWS\_378     | MEDIUM   |
| [AWS S3 bucket not configured with secure data transport policy misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-379.md)                                                 | APPSEC\_AWS\_379     | MEDIUM   |
| [AWS Transfer Server not using latest Security Policy misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-aws-380.md)                                                           | APPSEC\_AWS\_380     | LOW      |
| [Azure Virtual Machine (Linux) does not authenticate using SSH keys misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-1.md)                                             | APPSEC\_AZURE\_1     | LOW      |
| [Kubernetes dashboard is not disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-8.md)                                                                           | APPSEC\_AZURE\_8     | LOW      |
| [Azure Network Security Group allows all traffic on SSH port 22 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-10.md)                                                | APPSEC\_AZURE\_10    | LOW      |
| [Azure SQL Servers Firewall rule allow ingress access from 0.0.0.0/0 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-11.md)                                           | APPSEC\_AZURE\_11    | HIGH     |
| [Azure App Service Web app doesn't redirect HTTP to HTTPS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-14.md)                                                      | APPSEC\_AZURE\_14    | MEDIUM   |
| [Azure App Service Web app doesn't use latest TLS version misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-15.md)                                                      | APPSEC\_AZURE\_15    | LOW      |
| [Azure App Service Web app client certificate is disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-17.md)                                                      | APPSEC\_AZURE\_17    | LOW      |
| [Azure App Service Web app doesn't use HTTP 2.0 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-18.md)                                                                | APPSEC\_AZURE\_18    | LOW      |
| [Azure MySQL Database Server SSL connection is disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-28.md)                                                        | APPSEC\_AZURE\_28    | LOW      |
| [Azure PostgreSQL database server with SSL connection disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-29.md)                                                 | APPSEC\_AZURE\_29    | LOW      |
| [Azure storage account has a blob container that is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-34.md)                                        | APPSEC\_AZURE\_34    | HIGH     |
| [Azure Storage Account default network access is set to 'Allow' misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-35.md)                                                | APPSEC\_AZURE\_35    | LOW      |
| [Azure MariaDB database server with SSL connection disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-47.md)                                                    | APPSEC\_AZURE\_47    | LOW      |
| [MariaDB servers do not have public network access enabled set to False misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-48.md)                                        | APPSEC\_AZURE\_48    | HIGH     |
| ['public network access enabled' is not set to 'False' for mySQL servers misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-53.md)                                       | APPSEC\_AZURE\_53    | MEDIUM   |
| [MySQL is not using the latest version of TLS encryption misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-54.md)                                                       | APPSEC\_AZURE\_54    | MEDIUM   |
| [CORS allows resource to access app services misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-57.md)                                                                   | APPSEC\_AZURE\_57    | LOW      |
| [Azure storage account does allow public access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-59.md)                                                                | APPSEC\_AZURE\_59    | LOW      |
| [Azure file sync enables public network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-64.md)                                                                 | APPSEC\_AZURE\_64    | LOW      |
| [PostgreSQL server does not disable public network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-68.md)                                                      | APPSEC\_AZURE\_68    | LOW      |
| [Azure Function App doesn't redirect HTTP to HTTPS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-70.md)                                                             | APPSEC\_AZURE\_70    | MEDIUM   |
| [Azure Network Security Group having Inbound rule overly permissive to all traffic on UDP protocol misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-77.md)             | APPSEC\_AZURE\_77    | MEDIUM   |
| [Azure App Services FTP deployment is All allowed misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-78.md)                                                              | APPSEC\_AZURE\_78    | LOW      |
| [Azure cache for Redis has public network access enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-89.md)                                                       | APPSEC\_AZURE\_89    | LOW      |
| [Cosmos DB accounts do not have restricted access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-99.md)                                                              | APPSEC\_AZURE\_99    | LOW      |
| [Azure Cosmos DB enables public network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-101.md)                                                                | APPSEC\_AZURE\_101   | LOW      |
| [Azure Data Factory (V2) configured with overly permissive network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-104.md)                                     | APPSEC\_AZURE\_104   | MEDIUM   |
| [Azure Event Grid domain public network access is enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-106.md)                                                     | APPSEC\_AZURE\_106   | MEDIUM   |
| [Azure IoT Hub enables public network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-108.md)                                                                  | APPSEC\_AZURE\_108   | MEDIUM   |
| [SQL Server is enabled for public network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-113.md)                                                              | APPSEC\_AZURE\_113   | LOW      |
| [Azure Virtual machine NIC has IP forwarding enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-118.md)                                                          | APPSEC\_AZURE\_118   | LOW      |
| [Network interfaces use public IPs misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-119.md)                                                                            | APPSEC\_AZURE\_119   | LOW      |
| [Azure cognitive search does not disable public network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-124.md)                                                | APPSEC\_AZURE\_124   | LOW      |
| [Azure Container registries Public access to All networks is enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-139.md)                                          | APPSEC\_AZURE\_139   | MEDIUM   |
| [Azure AKS cluster nodes have public IP addresses misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-143.md)                                                             | APPSEC\_AZURE\_143   | LOW      |
| [Azure Function App doesn't use latest TLS version misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-145.md)                                                            | APPSEC\_AZURE\_145   | LOW      |
| [Azure Redis Cache does not use the latest version of TLS encryption misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-148.md)                                          | APPSEC\_AZURE\_148   | LOW      |
| [Azure Client Certificates are not enforced for API management misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-152.md)                                                | APPSEC\_AZURE\_152   | LOW      |
| [Azure web app does not redirect all HTTP traffic to HTTPS in Azure App Service Slot misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-153.md)                          | APPSEC\_AZURE\_153   | LOW      |
| [Azure App's service slot does not use the latest version of TLS encryption misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-154.md)                                   | APPSEC\_AZURE\_154   | LOW      |
| [Azure App service slot does not have debugging disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-155.md)                                                      | APPSEC\_AZURE\_155   | LOW      |
| [Azure HTTP (port 80) access from the internet is not restricted misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-160.md)                                              | APPSEC\_AZURE\_160   | LOW      |
| [Azure Spring Cloud API Portal is not enabled for HTTPS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-161.md)                                                       | APPSEC\_AZURE\_161   | LOW      |
| [Azure Spring Cloud API Portal Public Access Is Enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-162.md)                                                       | APPSEC\_AZURE\_162   | LOW      |
| [API Management Without Minimum TLS 1.2 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-173.md)                                                                       | APPSEC\_AZURE\_173   | MEDIUM   |
| [API Management with Public Access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-174.md)                                                                            | APPSEC\_AZURE\_174   | MEDIUM   |
| [Web PubSub Without SLA SKU misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-175.md)                                                                                   | APPSEC\_AZURE\_175   | LOW      |
| [VNET With Only One DNS Endpoint misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-182.md)                                                                              | APPSEC\_AZURE\_182   | LOW      |
| [VNET Using External DNS Addresses misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-183.md)                                                                            | APPSEC\_AZURE\_183   | MEDIUM   |
| [App Configuration Public Access Enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-185.md)                                                                      | APPSEC\_AZURE\_185   | HIGH     |
| [Azure Key Vault Public Network Access Control misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-189.md)                                                                | APPSEC\_AZURE\_189   | HIGH     |
| [Azure storage account has a blob container with public access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-190.md)                                                | APPSEC\_AZURE\_190   | HIGH     |
| [Azure Event Grid Topic Public Network Access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-193.md)                                                                 | APPSEC\_AZURE\_193   | MEDIUM   |
| [Azure SignalR Service not Using Paid SKU for its SLA misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-196.md)                                                         | APPSEC\_AZURE\_196   | LOW      |
| [Azure CDN Doesn't Disable HTTP Endpoint misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-197.md)                                                                      | APPSEC\_AZURE\_197   | MEDIUM   |
| [Azure CDN Endpoint Custom domains is not configured with HTTPS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-198.md)                                               | APPSEC\_AZURE\_198   | MEDIUM   |
| [Azure CDN Using Outdated TLS Encryption misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-200.md)                                                                      | APPSEC\_AZURE\_200   | MEDIUM   |
| [Azure Service Bus with Public Network Access Enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-204.md)                                                         | APPSEC\_AZURE\_204   | MEDIUM   |
| [Azure Service Bus Without Latest TLS Encryption misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-205.md)                                                              | APPSEC\_AZURE\_205   | MEDIUM   |
| [Azure Cognitive Search With Global IP Allowance misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-210.md)                                                              | APPSEC\_AZURE\_210   | MEDIUM   |
| [Azure App Service Instance Lacks Redundancy misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-212.md)                                                                  | APPSEC\_AZURE\_212   | LOW      |
| [Backend of the API management system does not utilize HTTPS misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-215.md)                                                  | APPSEC\_AZURE\_215   | HIGH     |
| [DenyIntelMode for Azure Firewalls is not set to Deny misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-216.md)                                                         | APPSEC\_AZURE\_216   | HIGH     |
| [Azure Application gateways listener that allow connection requests over HTTP misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-217.md)                                 | APPSEC\_AZURE\_217   | MEDIUM   |
| [Azure Application Gateway is configured with SSL policy having TLS version 1.1 or lower misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-218.md)                      | APPSEC\_AZURE\_218   | LOW      |
| [Azure Firewall does not define a firewall policy misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-219.md)                                                             | APPSEC\_AZURE\_219   | MEDIUM   |
| [Azure Function app configured with public network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-221.md)                                                     | APPSEC\_AZURE\_221   | MEDIUM   |
| [Azure App Service web apps with public network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-222.md)                                                        | APPSEC\_AZURE\_222   | MEDIUM   |
| [Event Hub Namespace not using TLS 1.2 or greater misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-223.md)                                                             | APPSEC\_AZURE\_223   | HIGH     |
| [Azure Container Instance environment variable with regular value type misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-235.md)                                        | APPSEC\_AZURE\_235   | LOW      |
| [Azure Container Instance is not configured with virtual network misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-245.md)                                              | APPSEC\_AZURE\_245   | LOW      |
| [Azure AKS cluster HTTP application routing enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-azure-246.md)                                                           | APPSEC\_AZURE\_246   | LOW      |
| [Port 22 is exposed misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-docker-1.md)                                                                                            | APPSEC\_DOCKER\_1    | LOW      |
| [GCP Firewall rule allows all traffic on SSH port (22) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-2.md)                                                            | APPSEC\_GCP\_2       | LOW      |
| [GCP Firewall rule allows all traffic on RDP port (3389) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-3.md)                                                          | APPSEC\_GCP\_3       | LOW      |
| [GCP HTTPS Load balancer is set with SSL policy having TLS version 1.1 or lower misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-4.md)                                   | APPSEC\_GCP\_4       | MEDIUM   |
| [GCP SQL Instances do not have SSL configured for incoming connections misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-6.md)                                            | APPSEC\_GCP\_6       | HIGH     |
| [GCP SQL database is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-11.md)                                                                         | APPSEC\_GCP\_11      | HIGH     |
| [GCP BigQuery dataset is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-15.md)                                                                     | APPSEC\_GCP\_15      | HIGH     |
| [GCP Cloud DNS has DNSSEC disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-16.md)                                                                               | APPSEC\_GCP\_16      | MEDIUM   |
| [RSASHA1 is used for Zone-Signing and Key-Signing Keys in Cloud DNS DNSSEC misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-17.md)                                       | APPSEC\_GCP\_17      | MEDIUM   |
| [GKE control plane is public misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-18.md)                                                                                     | APPSEC\_GCP\_18      | LOW      |
| [GCP project is using the default network misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-27.md)                                                                        | APPSEC\_GCP\_27      | MEDIUM   |
| [GCP Storage bucket is anonymously or publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-28.md)                                                        | APPSEC\_GCP\_28      | HIGH     |
| [GCP VM instances do have block project-wide SSH keys feature disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-32.md)                                           | APPSEC\_GCP\_32      | HIGH     |
| [GCP Projects do have OS Login disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-33.md)                                                                          | APPSEC\_GCP\_33      | HIGH     |
| [GCP Projects have OS Login disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-34.md)                                                                             | APPSEC\_GCP\_34      | LOW      |
| [GCP VM instances have serial port access enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-35.md)                                                                | APPSEC\_GCP\_35      | LOW      |
| [GCP VM instances have IP Forwarding enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-36.md)                                                                     | APPSEC\_GCP\_36      | LOW      |
| [GCP VM instance with Shielded VM features disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-39.md)                                                              | APPSEC\_GCP\_39      | LOW      |
| [GCP VM instance with the external IP address misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-40.md)                                                                    | APPSEC\_GCP\_40      | LOW      |
| [GCP Cloud SQL database instances have public IPs misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-60.md)                                                                | APPSEC\_GCP\_60      | LOW      |
| [GCP VPC Network subnets have Private Google access disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-74.md)                                                     | APPSEC\_GCP\_74      | LOW      |
| [GCP Firewall rule allows all traffic on FTP port (21) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-75.md)                                                           | APPSEC\_GCP\_75      | LOW      |
| [GCP VPC Network subnets have Private Google access for IPv6 disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-76.md)                                            | APPSEC\_GCP\_76      | LOW      |
| [GCP Google compute firewall ingress allow FTP port (20) access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-77.md)                                                  | APPSEC\_GCP\_77      | LOW      |
| [GCP cloud build workers are not private misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-86.md)                                                                         | APPSEC\_GCP\_86      | LOW      |
| [GCP data fusion instances are not private misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-87.md)                                                                       | APPSEC\_GCP\_87      | LOW      |
| [GCP Firewall rule allows all traffic on MySQL DB port (3306) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-88.md)                                                    | APPSEC\_GCP\_88      | LOW      |
| [GCP Vertex AI instances are not private misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-89.md)                                                                         | APPSEC\_GCP\_89      | HIGH     |
| [GCP Dataflow jobs are not private misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-94.md)                                                                               | APPSEC\_GCP\_94      | HIGH     |
| [GCP Dataproc clusters are anonymously or publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-98.md)                                                    | APPSEC\_GCP\_98      | HIGH     |
| [GCP Pub/Sub Topics are anonymously or publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-99.md)                                                       | APPSEC\_GCP\_99      | MEDIUM   |
| [GCP BigQuery Tables are anonymously or publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-100.md)                                                     | APPSEC\_GCP\_100     | HIGH     |
| [GCP Artifact Registry repositories are anonymously or publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-101.md)                                      | APPSEC\_GCP\_101     | HIGH     |
| [GCP Cloud Run services are anonymously or publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-102.md)                                                  | APPSEC\_GCP\_102     | MEDIUM   |
| [GCP Firewall rule allows all traffic on HTTP port (80) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-106.md)                                                         | APPSEC\_GCP\_106     | LOW      |
| [GCP Cloud Function is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-107.md)                                                                      | APPSEC\_GCP\_107     | MEDIUM   |
| [GCP Storage buckets are publicly accessible to all users misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-114.md)                                                       | APPSEC\_GCP\_114     | HIGH     |
| [GCP Cloud Function configured with overly permissive Ingress setting misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-gcp-124.md)                                           | APPSEC\_GCP\_124     | LOW      |
| [GitHub repository webhook defined in Terraform does not use a secure SSL misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-git-2.md)                                         | APPSEC\_GIT\_2       | MEDIUM   |
| [Tiller (Helm V2) deployment is accessible from within the cluster misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-k8s-45.md)                                               | APPSEC\_K8S\_45      | LOW      |
| [The --insecure-bind-address argument is set misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-k8s-86.md)                                                                     | APPSEC\_K8S\_86      | HIGH     |
| [The --insecure-port argument is not set to 0 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-k8s-88.md)                                                                    | APPSEC\_K8S\_88      | HIGH     |
| [The --secure-port argument is set to 0 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-k8s-89.md)                                                                          | APPSEC\_K8S\_89      | LOW      |
| [The --tls-cert-file and --tls-private-key-file arguments for API server are not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-k8s-100.md)              | APPSEC\_K8S\_100     | HIGH     |
| [The --read-only-port argument is not set to 0 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-k8s-141.md)                                                                  | APPSEC\_K8S\_141     | LOW      |
| [OCI VCN has no inbound security list misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-oci-16.md)                                                                            | APPSEC\_OCI\_16      | LOW      |
| [OCI VCN Security list has stateful security rules misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-oci-17.md)                                                               | APPSEC\_OCI\_17      | MEDIUM   |
| [OCI Security List allows all traffic on SSH port (22) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-oci-19.md)                                                           | APPSEC\_OCI\_19      | LOW      |
| [OCI security lists allows unrestricted ingress access to port 3389 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-oci-20.md)                                              | APPSEC\_OCI\_20      | LOW      |
| [OCI security group allows unrestricted ingress access to port 22 misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-oci-22.md)                                                | APPSEC\_OCI\_22      | LOW      |
| [OpenAPI Security Definitions Object should be set and not empty misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-openapi-1.md)                                              | APPSEC\_OPENAPI\_1   | HIGH     |
| [OpenAPI If the security scheme is not of type 'oauth2', the array value must be empty misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-openapi-2.md)                        | APPSEC\_OPENAPI\_2   | HIGH     |
| [Cleartext credentials over unencrypted channel should not be accepted for the operation misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-openapi-3.md)                      | APPSEC\_OPENAPI\_3   | HIGH     |
| [The path scheme is supports unencrypted HTTP connections misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-openapi-7.md)                                                     | APPSEC\_OPENAPI\_7   | HIGH     |
| [Global schemes use 'httpa' protocol instead of 'https' misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-openapi-18.md)                                                      | APPSEC\_OPENAPI\_18  | HIGH     |
| [API keys transmitted over cleartext misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-openapi-20.md)                                                                         | APPSEC\_OPENAPI\_20  | HIGH     |
| [OpenStack Security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-openstack-2.md)                              | APPSEC\_OPENSTACK\_2 | LOW      |
| [OpenStack Security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec-openstack-3.md)                            | APPSEC\_OPENSTACK\_3 | LOW      |
| [HTTPS url not used with Ansible uri misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-ansible-1.md)                                                                         | APPSEC2\_ANSIBLE\_1  | MEDIUM   |
| [HTTPS url not used with Ansible get\_url module misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-ansible-2.md)                                                             | APPSEC2\_ANSIBLE\_2  | MEDIUM   |
| [AWS Network ACL is not in use misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-1.md)                                                                                   | APPSEC2\_AWS\_1      | LOW      |
| [Security Groups are not attached to EC2 instances or ENIs misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-5.md)                                                       | APPSEC2\_AWS\_5      | LOW      |
| [S3 Bucket does not have public access blocks misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-6.md)                                                                    | APPSEC2\_AWS\_6      | LOW      |
| [Amazon EMR clusters' security groups are open to the world misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-7.md)                                                      | APPSEC2\_AWS\_7      | LOW      |
| [AWS Default Security Group does not restrict all traffic misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-12.md)                                                       | APPSEC2\_AWS\_12     | LOW      |
| [Auto scaling groups associated with a load balancer do not use elastic load balancing health checks misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-15.md)            | APPSEC2\_AWS\_15     | LOW      |
| [Not all EIP addresses allocated to a VPC are attached to EC2 instances misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-19.md)                                         | APPSEC2\_AWS\_19     | LOW      |
| [ALB does not redirect HTTP requests into HTTPS ones misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-20.md)                                                            | APPSEC2\_AWS\_20     | LOW      |
| [Route53 A Record does not have Attached Resource misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-23.md)                                                               | APPSEC2\_AWS\_23     | MEDIUM   |
| [AWS Application Load Balancer (ALB) not configured with AWS Web Application Firewall v2 (AWS WAFv2) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-28.md)            | APPSEC2\_AWS\_28     | LOW      |
| [Public API gateway not configured with AWS Web Application Firewall v2 (AWS WAFv2) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-29.md)                             | APPSEC2\_AWS\_29     | MEDIUM   |
| [AWS CloudFront distribution does not have a strict security headers policy attached misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-32.md)                            | APPSEC2\_AWS\_32     | LOW      |
| [AWS Terraform sends SSM secrets to untrusted domains over HTTP misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-36.md)                                                 | APPSEC2\_AWS\_36     | LOW      |
| [Domain Name System Security Extensions (DNSSEC) signing is not enabled for Amazon Route 53 public hosted zones misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-38.md) | APPSEC2\_AWS\_38     | HIGH     |
| [AWS CloudFront web distribution with default SSL certificate misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-42.md)                                                   | APPSEC2\_AWS\_42     | LOW      |
| [AWS route table with VPC peering overly permissive to all traffic misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-44.md)                                              | APPSEC2\_AWS\_44     | LOW      |
| [AWS Database Migration Service endpoint do not have SSL configured misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-49.md)                                             | APPSEC2\_AWS\_49     | LOW      |
| [AWS API Gateway endpoints without client certificate authentication misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-51.md)                                            | APPSEC2\_AWS\_51     | LOW      |
| [AWS API gateway request parameter is not validated misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-53.md)                                                             | APPSEC2\_AWS\_53     | LOW      |
| [AWS CloudFront distribution is using insecure SSL protocols for HTTPS communication misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-54.md)                            | APPSEC2\_AWS\_54     | MEDIUM   |
| [MWAA environment is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-66.md)                                                                        | APPSEC2\_AWS\_66     | HIGH     |
| [AWS CloudFront origin protocol policy does not enforce HTTPS-only misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-aws-72.md)                                              | APPSEC2\_AWS\_72     | MEDIUM   |
| [Azure PostgreSQL Database Server 'Allow access to Azure services' enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-6.md)                                     | APPSEC2\_AZURE\_6    | LOW      |
| [Azure Storage account container storing activity logs is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-8.md)                                  | APPSEC2\_AZURE\_8    | LOW      |
| [Azure Spring Cloud service is not configured with virtual network misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-23.md)                                            | APPSEC2\_AZURE\_23   | MEDIUM   |
| [Azure PostgreSQL database flexible server configured with overly permissive network access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-26.md)                   | APPSEC2\_AZURE\_26   | MEDIUM   |
| [Azure ACR HTTPS not enabled for webhook misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-28.md)                                                                      | APPSEC2\_AZURE\_28   | MEDIUM   |
| [Azure AKS cluster Azure CNI networking not enabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-29.md)                                                           | APPSEC2\_AZURE\_29   | LOW      |
| [Azure Virtual Network subnet is not configured with a Network Security Group misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-31.md)                                 | APPSEC2\_AZURE\_31   | LOW      |
| [Azure Key vault Private endpoint connection is not configured misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-32.md)                                                | APPSEC2\_AZURE\_32   | LOW      |
| [Azure Storage account is not configured with private endpoint connection misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-33.md)                                     | APPSEC2\_AZURE\_33   | MEDIUM   |
| [Azure SQL Server allow access to any Azure internal resources misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-34.md)                                                | APPSEC2\_AZURE\_34   | LOW      |
| [Azure Virtual machine configured with public IP and serial console access misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-39.md)                                    | APPSEC2\_AZURE\_39   | LOW      |
| [Azure PostgreSQL servers not configured with private endpoint misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-42.md)                                                | APPSEC2\_AZURE\_42   | MEDIUM   |
| [Azure Database for MariaDB not configured with private endpoint misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-43.md)                                              | APPSEC2\_AZURE\_43   | MEDIUM   |
| [Azure Database for MySQL server not configured with private endpoint misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-44.md)                                         | APPSEC2\_AZURE\_44   | MEDIUM   |
| [Azure SQL Database server not configured with private endpoint misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-45.md)                                               | APPSEC2\_AZURE\_45   | MEDIUM   |
| [Azure Spring Cloud app end-to-end TLS is disabled misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-azure-55.md)                                                            | APPSEC2\_AZURE\_55   | LOW      |
| [GCP KMS crypto key is anonymously accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-gcp-6.md)                                                                    | APPSEC2\_GCP\_6      | MEDIUM   |
| [GCP Cloud KMS Key Rings are anonymously or publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-gcp-8.md)                                                  | APPSEC2\_GCP\_8      | HIGH     |
| [GCP Container Registry repositories are anonymously or publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-gcp-9.md)                                      | APPSEC2\_GCP\_9      | HIGH     |
| [GCP Cloud Function HTTP trigger is not secured misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-gcp-10.md)                                                                 | APPSEC2\_GCP\_10     | MEDIUM   |
| [GCP Firewall with Inbound rule overly permissive to All Traffic misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-gcp-12.md)                                                | APPSEC2\_GCP\_12     | LOW      |
| [Google Cloud Platform network is not ensured to define a firewall misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-gcp-18.md)                                              | APPSEC2\_GCP\_18     | MEDIUM   |
| [TPU v2 VM is public misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-gcp-32.md)                                                                                            | APPSEC2\_GCP\_32     | MEDIUM   |
| [IBM Cloud Application Load Balancer for VPC has public access enabled in Terraform misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-ibm-1.md)                              | APPSEC2\_IBM\_1      | MEDIUM   |
| [IBM Cloud Kubernetes clusters are accessible by using public endpoint in Terraform misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-ibm-7.md)                              | APPSEC2\_IBM\_7      | MEDIUM   |
| [OCI Network Security Group allows all traffic on RDP port (3389) misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-oci-2.md)                                                | APPSEC2\_OCI\_2      | LOW      |
| [OCI Kubernetes Engine Cluster endpoint is not configured with Network Security Groups misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-oci-3.md)                           | APPSEC2\_OCI\_3      | LOW      |
| [OCI Kubernetes Engine Cluster pod security policy not enforced misconfiguration detected in code](/appsec-rules/iac-security/public-exposure/appsec2-oci-6.md)                                                  | APPSEC2\_OCI\_6      | LOW      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.