> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage.md). # Storage | Rule Name | AppSec Rule ID | Severity | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------- | | [Alibaba Cloud OSS bucket is not encrypted with Customer Master Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-ali-6.md) | APPSEC\_ALI\_6 | MEDIUM | | [Alibaba Cloud disk encryption is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-ali-7.md) | APPSEC\_ALI\_7 | LOW | | [Alibaba Cloud Disk is not encrypted with Customer Master Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-ali-8.md) | APPSEC\_ALI\_8 | LOW | | [Alibaba Cloud OSS bucket has versioning disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-ali-10.md) | APPSEC\_ALI\_10 | LOW | | [Alibaba Cloud OSS bucket has transfer Acceleration disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-ali-11.md) | APPSEC\_ALI\_11 | LOW | | [Alibaba Cloud Transparent Data Encryption is disabled on instance misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-ali-22.md) | APPSEC\_ALI\_22 | LOW | | [Alibaba Cloud launch template data disks are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-ali-32.md) | APPSEC\_ALI\_32 | LOW | | [Alibaba Cloud MongoDB does not have transparent data encryption enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-ali-44.md) | APPSEC\_ALI\_44 | LOW | | [AWS EBS volumes are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-3.md) | APPSEC\_AWS\_3 | HIGH | | [AWS Elasticsearch domain Encryption for data at rest is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-5.md) | APPSEC\_AWS\_5 | LOW | | [AWS EC2 Auto Scaling Launch Configuration is not using encrypted EBS volumes misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-8.md) | APPSEC\_AWS\_8 | LOW | | [AWS RDS DB cluster encryption is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-16.md) | APPSEC\_AWS\_16 | LOW | | [AWS Access logging not enabled on S3 buckets misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-18.md) | APPSEC\_AWS\_18 | LOW | | [AWS S3 buckets do not have server side encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-19.md) | APPSEC\_AWS\_19 | LOW | | [AWS S3 bucket ACL grants READ permission to everyone misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-20.md) | APPSEC\_AWS\_20 | HIGH | | [AWS S3 Object Versioning is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-21.md) | APPSEC\_AWS\_21 | LOW | | [AWS SNS topic has SSE disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-26.md) | APPSEC\_AWS\_26 | MEDIUM | | [AWS SQS Queue not configured with server side encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-27.md) | APPSEC\_AWS\_27 | LOW | | [DynamoDB PITR is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-28.md) | APPSEC\_AWS\_28 | HIGH | | [AWS ElastiCache Redis cluster with encryption for data at rest disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-29.md) | APPSEC\_AWS\_29 | LOW | | [AWS CloudTrail logs are not encrypted using Customer Master Keys (CMKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-35.md) | APPSEC\_AWS\_35 | LOW | | [AWS Elastic File System (EFS) with encryption for data at rest is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-42.md) | APPSEC\_AWS\_42 | LOW | | [AWS Kinesis streams are not encrypted using Server Side Encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-43.md) | APPSEC\_AWS\_43 | LOW | | [Neptune storage is not securely encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-44.md) | APPSEC\_AWS\_44 | MEDIUM | | [AWS DAX cluster not configured with encryption at rest misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-47.md) | APPSEC\_AWS\_47 | LOW | | [ECR image tags are not immutable misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-51.md) | APPSEC\_AWS\_51 | LOW | | [AWS S3 Bucket has the block public ACLs disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-53.md) | APPSEC\_AWS\_53 | MEDIUM | | [AWS S3 Bucket BlockPublicPolicy is not set to True misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-54.md) | APPSEC\_AWS\_54 | MEDIUM | | [AWS S3 bucket IgnorePublicAcls is not set to True misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-55.md) | APPSEC\_AWS\_55 | MEDIUM | | [AWS S3 bucket RestrictPublicBucket is not set to True misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-56.md) | APPSEC\_AWS\_56 | MEDIUM | | [AWS S3 Bucket has an ACL defined which allows public WRITE access misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-57.md) | APPSEC\_AWS\_57 | HIGH | | [AWS EKS cluster does not have secrets encryption enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-58.md) | APPSEC\_AWS\_58 | MEDIUM | | [AWS Redshift instances are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-64.md) | APPSEC\_AWS\_64 | LOW | | [AWS S3 bucket policy overly permissive to any principal misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-70.md) | APPSEC\_AWS\_70 | MEDIUM | | [DocumentDB is not encrypted at rest misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-74.md) | APPSEC\_AWS\_74 | MEDIUM | | [Athena Database is not encrypted at rest misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-77.md) | APPSEC\_AWS\_77 | MEDIUM | | [CodeBuild project encryption is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-78.md) | APPSEC\_AWS\_78 | MEDIUM | | [AWS MSK cluster encryption in transit is not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-81.md) | APPSEC\_AWS\_81 | MEDIUM | | [Athena workgroup does not prevent disabling encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-82.md) | APPSEC\_AWS\_82 | MEDIUM | | [DocDB TLS is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-90.md) | APPSEC\_AWS\_90 | MEDIUM | | [S3 bucket policy allows lockout all but root user misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-93.md) | APPSEC\_AWS\_93 | MEDIUM | | [Glue Data Catalog encryption is not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-94.md) | APPSEC\_AWS\_94 | HIGH | | [Not all data stored in Aurora is securely encrypted at rest misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-96.md) | APPSEC\_AWS\_96 | HIGH | | [EFS volumes in ECS task definitions do not have encryption in transit enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-97.md) | APPSEC\_AWS\_97 | HIGH | | [AWS Glue security configuration encryption is not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-99.md) | APPSEC\_AWS\_99 | HIGH | | [DocDB does not have audit logs enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-104.md) | APPSEC\_AWS\_104 | LOW | | [AWS Redshift does not have require\_ssl configured misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-105.md) | APPSEC\_AWS\_105 | LOW | | [AWS EBS volume region with encryption is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-106.md) | APPSEC\_AWS\_106 | LOW | | [Session Manager data is not encrypted in transit misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-112.md) | APPSEC\_AWS\_112 | MEDIUM | | [AWS DynamoDB encrypted using AWS owned CMK instead of AWS managed CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-119.md) | APPSEC\_AWS\_119 | LOW | | [AWS RDS instance without Automatic Backup setting misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-133.md) | APPSEC\_AWS\_133 | LOW | | [AWS ElastiCache Redis cluster is not configured with automatic backup misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-134.md) | APPSEC\_AWS\_134 | LOW | | [EC2 EBS is not optimized misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-135.md) | APPSEC\_AWS\_135 | LOW | | [Unencrypted ECR repositories misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-136.md) | APPSEC\_AWS\_136 | LOW | | [AWS RDS cluster delete protection is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-139.md) | APPSEC\_AWS\_139 | LOW | | [Unencrypted RDS global clusters misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-140.md) | APPSEC\_AWS\_140 | LOW | | [Redshift clusters version upgrade is not default misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-141.md) | APPSEC\_AWS\_141 | LOW | | [AWS Redshift Cluster not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-142.md) | APPSEC\_AWS\_142 | LOW | | [S3 bucket lock configuration disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-143.md) | APPSEC\_AWS\_143 | LOW | | [S3 bucket cross-region replication disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-144.md) | APPSEC\_AWS\_144 | LOW | | [S3 buckets are not encrypted with KMS misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-145.md) | APPSEC\_AWS\_145 | LOW | | [AWS RDS DB snapshot is not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-146.md) | APPSEC\_AWS\_146 | LOW | | [CodeBuild projects are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-147.md) | APPSEC\_AWS\_147 | MEDIUM | | [AWS Secrets Manager secret not encrypted by Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-149.md) | APPSEC\_AWS\_149 | LOW | | [Workspace user volumes are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-155.md) | APPSEC\_AWS\_155 | MEDIUM | | [Workspace root volumes are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-156.md) | APPSEC\_AWS\_156 | MEDIUM | | [RDS instances do not have Multi-AZ enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-157.md) | APPSEC\_AWS\_157 | LOW | | [Athena Workgroup is not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-159.md) | APPSEC\_AWS\_159 | MEDIUM | | [Timestream database is not encrypted with KMS CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-160.md) | APPSEC\_AWS\_160 | MEDIUM | | [Dynamodb point in time recovery is not enabled for global tables misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-165.md) | APPSEC\_AWS\_165 | MEDIUM | | [Backup Vault is not encrypted at rest using KMS CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-166.md) | APPSEC\_AWS\_166 | MEDIUM | | [QLDB ledger permissions mode is not set to STANDARD misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-170.md) | APPSEC\_AWS\_170 | MEDIUM | | [AWS EMR cluster is not configured with SSE KMS for data at rest encryption (Amazon S3 with EMRFS) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-171.md) | APPSEC\_AWS\_171 | LOW | | [AWS QLDB ledger has deletion protection is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-172.md) | APPSEC\_AWS\_172 | LOW | | [AWS Lambda encryption settings environmental variable is not set properly misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-173.md) | APPSEC\_AWS\_173 | LOW | | [AWS Kinesis Video Stream not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-177.md) | APPSEC\_AWS\_177 | LOW | | [AWS fx ontap file system not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-178.md) | APPSEC\_AWS\_178 | LOW | | [AWS FSX Windows filesystem not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-179.md) | APPSEC\_AWS\_179 | LOW | | [AWS Image Builder component not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-180.md) | APPSEC\_AWS\_180 | LOW | | [AWS S3 Object Copy not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-181.md) | APPSEC\_AWS\_181 | LOW | | [AWS Doc DB not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-182.md) | APPSEC\_AWS\_182 | LOW | | [AWS EBS Snapshot Copy not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-183.md) | APPSEC\_AWS\_183 | LOW | | [AWS Elastic File System (EFS) is not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-184.md) | APPSEC\_AWS\_184 | LOW | | [AWS Kinesis streams encryption is using default KMS keys instead of Customer's Managed Master Keys misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-185.md) | APPSEC\_AWS\_185 | LOW | | [AWS S3 bucket Object not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-186.md) | APPSEC\_AWS\_186 | LOW | | [AWS EBS Volume not encrypted using Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-189.md) | APPSEC\_AWS\_189 | LOW | | [AWS lustre file system not configured with CMK key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-190.md) | APPSEC\_AWS\_190 | LOW | | [AWS Elasticache replication group not configured with CMK key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-191.md) | APPSEC\_AWS\_191 | LOW | | [AWS Glue component is not associated with a security configuration misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-195.md) | APPSEC\_AWS\_195 | LOW | | [AWS Image Builder Distribution Configuration is not encrypting AMI by Key Management Service (KMS) using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-199.md) | APPSEC\_AWS\_199 | LOW | | [AWS Image Recipe EBS Disk are not encrypted using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-200.md) | APPSEC\_AWS\_200 | LOW | | [AWS MemoryDB is not encrypted at rest by AWS' Key Management Service KMS using CMKs misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-201.md) | APPSEC\_AWS\_201 | LOW | | [AWS MemoryDB data is not encrypted in transit misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-202.md) | APPSEC\_AWS\_202 | LOW | | [AWS FSX openzfs is not encrypted by AWS' Key Management Service (KMS) using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-203.md) | APPSEC\_AWS\_203 | LOW | | [AWS AMIs are not encrypted by Key Management Service (KMS) using Customer Managed Keys (CMKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-204.md) | APPSEC\_AWS\_204 | LOW | | [AWS MQ Broker is not encrypted by Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-209.md) | APPSEC\_AWS\_209 | LOW | | [AWS RDS does not use a modern CaCert misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-211.md) | APPSEC\_AWS\_211 | LOW | | [AWS EBS Volume is not encrypted by Key Management Service (KMS) using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-212.md) | APPSEC\_AWS\_212 | LOW | | [AWS Appsync API Cache is not encrypted at rest misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-214.md) | APPSEC\_AWS\_214 | LOW | | [AWS Appsync API Cache is not encrypted in transit misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-215.md) | APPSEC\_AWS\_215 | LOW | | [AWS CodePipeline artifactStore is not encrypted by Key Management Service (KMS) using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-219.md) | APPSEC\_AWS\_219 | LOW | | [AWS Code Artifact Domain is not encrypted by KMS using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-221.md) | APPSEC\_AWS\_221 | LOW | | [AWS copied AMIs are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-235.md) | APPSEC\_AWS\_235 | LOW | | [AWS AMI copying does not use a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-236.md) | APPSEC\_AWS\_236 | LOW | | [AWS Kinesis Firehose's delivery stream is not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-240.md) | APPSEC\_AWS\_240 | LOW | | [AWS Kinesis Firehose Delivery Streams are not encrypted with CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-241.md) | APPSEC\_AWS\_241 | LOW | | [AWS replicated backups are not encrypted at rest by Key Management Service (KMS) using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-245.md) | APPSEC\_AWS\_245 | LOW | | [AWS RDS Cluster activity streams are not encrypted by Key Management Service (KMS) using Customer Managed Keys (CMKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-246.md) | APPSEC\_AWS\_246 | LOW | | [AWS all data stored in the Elasticsearch domain is not encrypted using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-247.md) | APPSEC\_AWS\_247 | LOW | | [AWS RDS PostgreSQL exposed to local file read vulnerability misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-250.md) | APPSEC\_AWS\_250 | MEDIUM | | [AWS DLM cross-region events are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-253.md) | APPSEC\_AWS\_253 | LOW | | [AWS DLM cross-region events are not encrypted with a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-254.md) | APPSEC\_AWS\_254 | LOW | | [AWS DLM-cross region schedules are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-255.md) | APPSEC\_AWS\_255 | LOW | | [AWS DLM cross-region schedules are not encrypted using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-256.md) | APPSEC\_AWS\_256 | LOW | | [AWS App Flow flow does not use Customer Managed Keys (CMKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-263.md) | APPSEC\_AWS\_263 | LOW | | [AWS App Flow connector profile does not use Customer Managed Keys (CMKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-264.md) | APPSEC\_AWS\_264 | LOW | | [AWS Keyspace Table does not use Customer Managed Keys (CMKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-265.md) | APPSEC\_AWS\_265 | LOW | | [AWS RDS DB snapshot does not use Customer Managed Keys (CMKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-266.md) | APPSEC\_AWS\_266 | LOW | | [Comprehend Entity Recognizer's model is not encrypted by KMS using a customer managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-267.md) | APPSEC\_AWS\_267 | HIGH | | [Comprehend Entity Recognizer's volume is not encrypted by KMS using a customer managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-268.md) | APPSEC\_AWS\_268 | HIGH | | [Connect Instance Kinesis Video Stream Storage Config is not using CMK for encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-269.md) | APPSEC\_AWS\_269 | MEDIUM | | [The Connect Instance S3 Storage Configuration utilizes Customer Managed Key. misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-270.md) | APPSEC\_AWS\_270 | HIGH | | [DynamoDB table replica does not use CMK KMS encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-271.md) | APPSEC\_AWS\_271 | HIGH | | [MemoryDB snapshot is not encrypted by KMS using a customer managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-278.md) | APPSEC\_AWS\_278 | HIGH | | [Neptune snapshot is not securely encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-279.md) | APPSEC\_AWS\_279 | HIGH | | [Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-280.md) | APPSEC\_AWS\_280 | HIGH | | [RedShift snapshot copy is not encrypted by KMS using a customer managed Key (CMK). misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-281.md) | APPSEC\_AWS\_281 | HIGH | | [Redshift Serverless namespace is not encrypted by KMS using a customer managed key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-282.md) | APPSEC\_AWS\_282 | HIGH | | [DocDB Global Cluster is not encrypted at rest misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-292.md) | APPSEC\_AWS\_292 | HIGH | | [AWS database instances do not have deletion protection enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-293.md) | APPSEC\_AWS\_293 | MEDIUM | | [CloudTrail Event Data Store does not use Customer Managed Keys (CMKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-294.md) | APPSEC\_AWS\_294 | LOW | | [DataSync Location Object Storage exposes secrets misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-295.md) | APPSEC\_AWS\_295 | HIGH | | [DMS endpoint is not using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-296.md) | APPSEC\_AWS\_296 | HIGH | | [EventBridge Scheduler Schedule is not using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-297.md) | APPSEC\_AWS\_297 | HIGH | | [The DMS S3 does not use a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-298.md) | APPSEC\_AWS\_298 | HIGH | | [S3 lifecycle configuration does not set a period for aborting failed uploads misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-300.md) | APPSEC\_AWS\_300 | MEDIUM | | [Secrets Manager secrets are not rotated within 90 days misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-304.md) | APPSEC\_AWS\_304 | HIGH | | [CodeBuild S3 logs are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-311.md) | APPSEC\_AWS\_311 | HIGH | | [RDS Aurora Clusters do not have backtracking enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-326.md) | APPSEC\_AWS\_326 | MEDIUM | | [AWS RDS DB cluster is encrypted using default KMS key instead of CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-327.md) | APPSEC\_AWS\_327 | LOW | | [EFS Access Points are not enforcing a root directory misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-329.md) | APPSEC\_AWS\_329 | HIGH | | [User identity should be enforced by EFS access points misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-330.md) | APPSEC\_AWS\_330 | MEDIUM | | [SSM parameters are not utilizing KMS CMK. misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-337.md) | APPSEC\_AWS\_337 | HIGH | | [Amazon Redshift clusters do not have automatic snapshots enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-343.md) | APPSEC\_AWS\_343 | HIGH | | [Network firewall encryption does not use a CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-345.md) | APPSEC\_AWS\_345 | HIGH | | [Network Firewall Policy does not define an encryption configuration that uses a CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-346.md) | APPSEC\_AWS\_346 | HIGH | | [Neptune is not encrypted with KMS using a customer managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-347.md) | APPSEC\_AWS\_347 | HIGH | | [AWS EMR cluster is not enabled with local disk encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-349.md) | APPSEC\_AWS\_349 | LOW | | [Security configuration of the EMR Cluster does not ensure the encryption of EBS disks misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-350.md) | APPSEC\_AWS\_350 | HIGH | | [AWS EMR cluster is not enabled with data encryption in transit misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-351.md) | APPSEC\_AWS\_351 | LOW | | [RDS Performance Insights are not encrypted using KMS CMKs misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-354.md) | APPSEC\_AWS\_354 | HIGH | | [AWS DocumentDB clusters have backup retention period less than 7 days misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-360.md) | APPSEC\_AWS\_360 | LOW | | [AWS Neptune DB clusters have backup retention period less than 7 days misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-361.md) | APPSEC\_AWS\_361 | LOW | | [Clusters of Neptune DB do not replicate tags to snapshots misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-362.md) | APPSEC\_AWS\_362 | LOW | | [Bedrock Agent not encrypted with Customer Master Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-373.md) | APPSEC\_AWS\_373 | MEDIUM | | [AWS S3 bucket has global view ACL permissions enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-375.md) | APPSEC\_AWS\_375 | LOW | | [AWS CodeGuru Reviewer repository association does not use a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-381.md) | APPSEC\_AWS\_381 | LOW | | [Not all data stored in the EBS snapshot is securely encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-aws-custom-3.md) | APPSEC\_AWS\_CUSTOM\_3 | MEDIUM | | [Azure VM data disk is not encrypted with ADE/CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-2.md) | APPSEC\_AZURE\_2 | LOW | | [Azure Storage Account without Secure transfer enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-3.md) | APPSEC\_AZURE\_3 | LOW | | [Azure PostgreSQL database server with log checkpoints parameter disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-30.md) | APPSEC\_AZURE\_30 | LOW | | [Azure PostgreSQL database server with log connections parameter disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-31.md) | APPSEC\_AZURE\_31 | LOW | | [Azure PostgreSQL database server with connection throttling parameter is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-32.md) | APPSEC\_AZURE\_32 | LOW | | [Azure Storage Account 'Trusted Microsoft Services' access not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-36.md) | APPSEC\_AZURE\_36 | LOW | | [Azure Key Vault Keys does not have expiration date misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-40.md) | APPSEC\_AZURE\_40 | HIGH | | [Azure Key Vault secrets does not have expiration date misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-41.md) | APPSEC\_AZURE\_41 | HIGH | | [Azure Key Vault is not recoverable misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-42.md) | APPSEC\_AZURE\_42 | LOW | | [Storage Account name does not follow naming rules misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-43.md) | APPSEC\_AZURE\_43 | LOW | | [Azure Storage Account using insecure TLS version misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-44.md) | APPSEC\_AZURE\_44 | LOW | | [MSSQL is not using the latest version of TLS encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-52.md) | APPSEC\_AZURE\_52 | MEDIUM | | [Azure Automation account variables are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-73.md) | APPSEC\_AZURE\_73 | LOW | | [Azure Data Explorer cluster disk encryption is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-74.md) | APPSEC\_AZURE\_74 | LOW | | [Azure Data Explorer cluster double encryption is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-75.md) | APPSEC\_AZURE\_75 | LOW | | [Azure Batch account does not use key vault to encrypt data misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-76.md) | APPSEC\_AZURE\_76 | LOW | | [App services do not use Azure files misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-88.md) | APPSEC\_AZURE\_88 | LOW | | [Not only SSL are enabled for cache for Redis misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-91.md) | APPSEC\_AZURE\_91 | LOW | | [Managed disks do not use a specific set of disk encryption sets for customer-managed key encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-93.md) | APPSEC\_AZURE\_93 | LOW | | [My SQL server disables geo-redundant backups misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-94.md) | APPSEC\_AZURE\_94 | LOW | | [MySQL server disables infrastructure encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-96.md) | APPSEC\_AZURE\_96 | LOW | | [Virtual machine scale sets do not have encryption at host enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-97.md) | APPSEC\_AZURE\_97 | LOW | | [Cosmos DB Accounts do not have CMKs encrypting data at rest misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-100.md) | APPSEC\_AZURE\_100 | LOW | | [PostgreSQL server enables geo-redundant backups misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-102.md) | APPSEC\_AZURE\_102 | LOW | | [Unencrypted Data Lake Store accounts misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-105.md) | APPSEC\_AZURE\_105 | MEDIUM | | [Azure Key Vault Purge protection is not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-110.md) | APPSEC\_AZURE\_110 | LOW | | [Key vault does not enable soft-delete misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-111.md) | APPSEC\_AZURE\_111 | LOW | | [Key vault key is not backed by HSM misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-112.md) | APPSEC\_AZURE\_112 | LOW | | [Key vault secrets do not have content\_type set misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-114.md) | APPSEC\_AZURE\_114 | LOW | | [Azure AKS cluster is not configured with disk encryption set misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-117.md) | APPSEC\_AZURE\_117 | LOW | | [MariaDB server does not enable geo-redundant backups misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-129.md) | APPSEC\_AZURE\_129 | LOW | | [PostgreSQL server does not enable infrastructure encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-130.md) | APPSEC\_AZURE\_130 | LOW | | [Azure Cosmos DB key based authentication is enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-132.md) | APPSEC\_AZURE\_132 | LOW | | [Azure PostgreSQL Flexible Server does not enable geo-redundant backups misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-136.md) | APPSEC\_AZURE\_136 | LOW | | [Azure PostgreSQL does not use the latest version of TLS encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-147.md) | APPSEC\_AZURE\_147 | LOW | | [Azure Windows VM does not enable encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-151.md) | APPSEC\_AZURE\_151 | LOW | | [Geo-Replicated Not Enabled for Azure Container Registry (ACR) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-165.md) | APPSEC\_AZURE\_165 | MEDIUM | | [Azure Container Registry (ACR) Does Not Have a Quarantine Policy Enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-166.md) | APPSEC\_AZURE\_166 | MEDIUM | | [Azure Container Registry (ACR) Doesn't Have a Retention Policy Set misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-167.md) | APPSEC\_AZURE\_167 | LOW | | [AKS Secrets Store Without Auto-Rotation misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-172.md) | APPSEC\_AZURE\_172 | MEDIUM | | [Azure Data Explorer without SLA misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-180.md) | APPSEC\_AZURE\_180 | LOW | | [App Configuration Encryption Block Not Set misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-186.md) | APPSEC\_AZURE\_186 | MEDIUM | | [App Configuration Without Purge Protection Enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-187.md) | APPSEC\_AZURE\_187 | MEDIUM | | [Azure Service Bus Doesn't Use Double Encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-199.md) | APPSEC\_AZURE\_199 | MEDIUM | | [Azure Service Bus Doesn't Use Customer-Managed Key Encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-201.md) | APPSEC\_AZURE\_201 | MEDIUM | | [Azure Storage Accounts Without Proper Replication misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-206.md) | APPSEC\_AZURE\_206 | LOW | | [Azure Cognitive Search Without SLA Index Updates misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-208.md) | APPSEC\_AZURE\_208 | LOW | | [Azure Cognitive Search Without SLA for Search Index Queries misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-209.md) | APPSEC\_AZURE\_209 | LOW | | [App Service Plan is not zone redundant misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-225.md) | APPSEC\_AZURE\_225 | MEDIUM | | [AKS cluster not encrypting temp disks, caches, and data flows misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-227.md) | APPSEC\_AZURE\_227 | HIGH | | [Azure Event Hub Namespace is not zone redundant misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-228.md) | APPSEC\_AZURE\_228 | MEDIUM | | [Azure SQL Database Namespace is not zone redundant misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-229.md) | APPSEC\_AZURE\_229 | HIGH | | [Standard Replication is not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-230.md) | APPSEC\_AZURE\_230 | HIGH | | [App Service Environment is not zone redundant misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-231.md) | APPSEC\_AZURE\_231 | MEDIUM | | [Azure Container Registry (ACR) not zone redundant misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-azure-233.md) | APPSEC\_AZURE\_233 | LOW | | [GCP SQL database instance does not have backup configuration enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-14.md) | APPSEC\_GCP\_14 | HIGH | | [GCP cloud storage bucket with uniform bucket-level access disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-29.md) | APPSEC\_GCP\_29 | LOW | | [GCP VM disks not encrypted with Customer-Supplied Encryption Keys (CSEK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-37.md) | APPSEC\_GCP\_37 | LOW | | [Boot disks for instances do not use CSEKs misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-38.md) | APPSEC\_GCP\_38 | HIGH | | [GCP KMS Symmetric key not rotating in every 90 days misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-43.md) | APPSEC\_GCP\_43 | LOW | | [GCP MySQL instance with local\_infile database flag is not disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-50.md) | APPSEC\_GCP\_50 | LOW | | [GCP SQL Server instance database flag 'cross db ownership chaining' is enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-58.md) | APPSEC\_GCP\_58 | LOW | | [GCP SQL Server instance database flag 'contained database authentication' is enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-59.md) | APPSEC\_GCP\_59 | LOW | | [GCP Storage Bucket does not have Access and Storage Logging enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-62.md) | APPSEC\_GCP\_62 | LOW | | [GCP storage bucket is logging to itself misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-63.md) | APPSEC\_GCP\_63 | LOW | | [GCP Cloud storage does not have versioning enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-78.md) | APPSEC\_GCP\_78 | LOW | | [GCP Big Query Tables are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-80.md) | APPSEC\_GCP\_80 | LOW | | [GCP Big Query Datasets are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-81.md) | APPSEC\_GCP\_81 | LOW | | [GCP KMS keys are not protected from deletion misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-82.md) | APPSEC\_GCP\_82 | LOW | | [GCP Pub/Sub Topics are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-83.md) | APPSEC\_GCP\_83 | LOW | | [GCP Artifact Registry repositories are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-84.md) | APPSEC\_GCP\_84 | LOW | | [GCP Big Table Instances are not encrypted with Customer Supplied Encryption Keys (CSEKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-85.md) | APPSEC\_GCP\_85 | LOW | | [GCP data flow jobs are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-90.md) | APPSEC\_GCP\_90 | LOW | | [GCP Dataproc Cluster not configured with Customer-Managed Encryption Key (CMEK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-91.md) | APPSEC\_GCP\_91 | LOW | | [GCP Spanner Database is not encrypted with Customer Supplied Encryption Keys (CSEKs) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-93.md) | APPSEC\_GCP\_93 | LOW | | [GCP Memorystore for Redis does not use intransit encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-97.md) | APPSEC\_GCP\_97 | LOW | | [Deletion protection for Spanner Database is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-119.md) | APPSEC\_GCP\_119 | MEDIUM | | [Spanner Database does not have drop protection enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-120.md) | APPSEC\_GCP\_120 | HIGH | | [BigQuery tables do not have deletion protection enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-121.md) | APPSEC\_GCP\_121 | MEDIUM | | [Big Table Instances do not have deletion protection enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-gcp-122.md) | APPSEC\_GCP\_122 | MEDIUM | | [GitHub Actions Environment Secrets defined in Terraform are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-git-4.md) | APPSEC\_GIT\_4 | HIGH | | [Gitlab project defined in Terraform does not prevent secrets misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-glb-3.md) | APPSEC\_GLB\_3 | MEDIUM | | [The --etcd-certfile and --etcd-keyfile arguments are not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-k8s-99.md) | APPSEC\_K8S\_99 | HIGH | | [Encryption providers are not appropriately configured misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-k8s-104.md) | APPSEC\_K8S\_104 | HIGH | | [The --cert-file and --key-file arguments are not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-k8s-116.md) | APPSEC\_K8S\_116 | HIGH | | [The --peer-cert-file and --peer-key-file arguments are not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-k8s-119.md) | APPSEC\_K8S\_119 | HIGH | | [OCI Block Storage Block Volume does not have backup enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-oci-2.md) | APPSEC\_OCI\_2 | LOW | | [OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-oci-3.md) | APPSEC\_OCI\_3 | LOW | | [OCI Object Storage bucket does not emit object events misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-oci-7.md) | APPSEC\_OCI\_7 | LOW | | [OCI Object Storage Bucket has object Versioning disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-oci-8.md) | APPSEC\_OCI\_8 | LOW | | [OCI Object Storage Bucket is not encrypted with a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-oci-9.md) | APPSEC\_OCI\_9 | LOW | | [OCI Object Storage bucket is publicly accessible misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-oci-10.md) | APPSEC\_OCI\_10 | HIGH | | [OCI File Storage File Systems are not encrypted with a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec-oci-15.md) | APPSEC\_OCI\_15 | LOW | | [Not only encrypted EBS volumes are attached to EC2 instances misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-2.md) | APPSEC2\_AWS\_2 | LOW | | [RDS clusters do not have an AWS Backup backup plan misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-8.md) | APPSEC2\_AWS\_8 | LOW | | [EBS does not have an AWS Backup backup plan misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-9.md) | APPSEC2\_AWS\_9 | LOW | | [AWS DynamoDB table Auto Scaling not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-16.md) | APPSEC2\_AWS\_16 | LOW | | [Amazon EFS does not have an AWS Backup backup plan misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-18.md) | APPSEC2\_AWS\_18 | LOW | | [AWS SSM Parameter is not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-34.md) | APPSEC2\_AWS\_34 | LOW | | [AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-50.md) | APPSEC2\_AWS\_50 | LOW | | [AWS EMR cluster is not configured with security configuration misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-55.md) | APPSEC2\_AWS\_55 | LOW | | [AWS Secret Manager Automatic Key Rotation is not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-57.md) | APPSEC2\_AWS\_57 | LOW | | [AWS Neptune cluster deletion protection is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-58.md) | APPSEC2\_AWS\_58 | LOW | | [AWS S3 bucket access control lists (ACLs) in use misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-65.md) | APPSEC2\_AWS\_65 | LOW | | [AWS RDS database instance not configured with encryption in transit misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-69.md) | APPSEC2\_AWS\_69 | MEDIUM | | [AWS SQS queue encryption using default KMS key instead of CMK misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-aws-73.md) | APPSEC2\_AWS\_73 | LOW | | [Storage for critical data are not encrypted with Customer Managed Key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-1.md) | APPSEC2\_AZURE\_1 | HIGH | | [Azure Data Explorer encryption at rest does not use a customer-managed key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-11.md) | APPSEC2\_AZURE\_11 | LOW | | [Virtual Machines are not backed up using Azure Backup misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-12.md) | APPSEC2\_AZURE\_12 | LOW | | [Unattached disks are not encrypted misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-14.md) | APPSEC2\_AZURE\_14 | LOW | | [Azure data factories are not encrypted with a customer-managed key misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-15.md) | APPSEC2\_AZURE\_15 | LOW | | [MySQL server does not enable customer-managed key for encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-16.md) | APPSEC2\_AZURE\_16 | LOW | | [PostgreSQL server does not enable customer-managed key for encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-17.md) | APPSEC2\_AZURE\_17 | LOW | | [Azure Storage account Encryption CMKs Disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-18.md) | APPSEC2\_AZURE\_18 | LOW | | [Azure SQL database Transparent Data Encryption (TDE) encryption disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-25.md) | APPSEC2\_AZURE\_25 | LOW | | [Azure MariaDB database server not using latest TLS version misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-37.md) | APPSEC2\_AZURE\_37 | LOW | | [Azure Storage account soft delete is disabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-azure-38.md) | APPSEC2\_AZURE\_38 | LOW | | [GCP SQL MySQL DB instance point-in-time recovery backup (Binary logs) is not enabled misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-gcp-20.md) | APPSEC2\_GCP\_20 | LOW | | [Vertex AI instance disks not encrypted with a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-gcp-21.md) | APPSEC2\_GCP\_21 | MEDIUM | | [Document AI Processors not encrypted with a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-gcp-22.md) | APPSEC2\_GCP\_22 | MEDIUM | | [Document AI Warehouse Location is not configured to use a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-gcp-23.md) | APPSEC2\_GCP\_23 | MEDIUM | | [Vertex AI workbench instance disks not encrypted with a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-gcp-27.md) | APPSEC2\_GCP\_27 | MEDIUM | | [OCI File Storage File System access is not restricted to root users misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-oci-4.md) | APPSEC2\_OCI\_4 | MEDIUM | | [OCI Kubernetes Engine Cluster boot volume is not configured with in-transit data encryption misconfiguration detected in code](/appsec-rules/iac-security/storage/appsec2-oci-5.md) | APPSEC2\_OCI\_5 | LOW | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.