tfsec.yml

---
exclude:
  - aws-api-gateway-enable-access-logging
  - aws-api-gateway-enable-cache-encryption
  - aws-api-gateway-enable-tracing
  - aws-api-gateway-no-public-access
  - aws-athena-enable-at-rest-encryption
  - aws-athena-no-encryption-override
  - aws-autoscaling-enable-at-rest-encryption
  - aws-autoscaling-enforce-http-token-imds
  - aws-autoscaling-no-public-ip
  - aws-autoscaling-no-secrets-in-user-data
  - aws-autoscaling-no-sensitive-info
  - aws-cloudfront-enable-logging
  - aws-cloudfront-enable-waf
  - aws-cloudtrail-enable-all-regions
  - aws-cloudtrail-enable-at-rest-encryption
  - aws-cloudtrail-enable-log-validation
  - aws-cloudwatch-log-group-customer-key
  - aws-codebuild-enable-encryption
  - aws-config-aggregate-all-regions
  - aws-documentdb-enable-log-export
  - aws-documentdb-enable-storage-encryption
  - aws-documentdb-encryption-customer-key
  - aws-dynamodb-enable-at-rest-encryption
  - aws-dynamodb-enable-recovery
  - aws-dynamodb-table-customer-key
  - aws-ebs-enable-volume-encryption
  - aws-ebs-encryption-customer-key
  - aws-ec2-enable-at-rest-encryption
  - aws-ec2-enforce-http-token-imds
  - aws-ec2-no-secrets-in-user-data
  - aws-ecr-enable-image-scans
  - aws-ecr-enforce-immutable-repository
  - aws-ecr-no-public-access
  - aws-ecr-repository-customer-key
  - aws-ecs-enable-container-insight
  - aws-ecs-enable-in-transit-encryption
  - aws-efs-enable-at-rest-encryption
  - aws-eks-enable-control-plane-logging
  - aws-eks-encrypt-secrets
  - aws-eks-no-public-cluster-access
  - aws-eks-no-public-cluster-access-to-cidr
  - aws-elastic-search-enable-domain-encryption
  - aws-elastic-search-enable-domain-logging
  - aws-elastic-search-enable-in-transit-encryption
  - aws-elasticache-add-description-for-security-group
  - aws-elasticache-enable-at-rest-encryption
  - aws-elasticache-enable-backup-retention
  - aws-elasticache-enable-in-transit-encryption
  - aws-elb-alb-not-public
  - aws-elb-drop-invalid-headers
  - aws-iam-enforce-mfa
  - aws-iam-no-password-reuse
  - aws-iam-no-policy-wildcards
  - aws-iam-require-lowercase-in-passwords
  - aws-iam-require-numbers-in-passwords
  - aws-iam-require-symbols-in-passwords
  - aws-iam-require-uppercase-in-passwords
  - aws-iam-set-max-password-age
  - aws-iam-set-minimum-password-length
  - aws-kinesis-enable-in-transit-encryption
  - aws-kms-auto-rotate-keys
  - aws-lambda-enable-tracing
  - aws-lambda-restrict-source-arn
  - aws-mq-enable-audit-logging
  - aws-mq-enable-general-logging
  - aws-mq-no-public-access
  - aws-msk-enable-in-transit-encryption
  - aws-msk-enable-logging
  - aws-neptune-enable-log-export
  - aws-neptune-enable-storage-encryption
  - aws-neptune-encryption-customer-key
  - aws-rds-enable-performance-insights
  - aws-rds-encrypt-cluster-storage-data
  - aws-rds-encrypt-instance-storage-data
  - aws-rds-specify-backup-retention
  - aws-redshift-encryption-customer-key
  - aws-redshift-use-vpc
  - aws-s3-block-public-acls
  - aws-s3-block-public-policy
  - aws-s3-enable-bucket-encryption
  - aws-s3-enable-bucket-logging
  - aws-s3-enable-versioning
  - aws-s3-encryption-customer-key
  - aws-s3-ignore-public-acls
  - aws-s3-no-public-access-with-acl
  - aws-s3-no-public-buckets
  - aws-s3-specify-public-access-block
  - aws-sns-enable-topic-encryption
  - aws-sqs-enable-queue-encryption
  - aws-sqs-no-wildcards-in-policy-documents
  - aws-ssm-secret-use-customer-key
  - aws-vpc-add-description-to-security-group
  - aws-vpc-add-description-to-security-group-rule
  - aws-vpc-no-default-vpc
  - aws-vpc-no-excessive-port-access
  - aws-vpc-no-public-egress-sgr
  - aws-vpc-no-public-ingress-acl
  - aws-vpc-no-public-ingress-sgr
  - aws-workspaces-enable-disk-encryption
  - azure-appservice-account-identity-registered
  - azure-appservice-authentication-enabled
  - azure-appservice-enable-http2
  - azure-appservice-require-client-cert
  - azure-authorization-limit-role-actions
  - azure-compute-disable-password-authentication
  - azure-compute-enable-disk-encryption
  - azure-compute-no-secrets-in-custom-data
  - azure-container-configured-network-policy
  - azure-container-limit-authorized-ips
  - azure-container-logging
  - azure-container-use-rbac-permissions
  - azure-database-all-threat-alerts-enabled
  - azure-database-enable-audit
  - azure-database-no-public-access
  - azure-database-no-public-firewall-access
  - azure-database-postgres-configuration-connection-throttling
  - azure-database-postgres-configuration-log-checkpoints
  - azure-database-postgres-configuration-log-connections
  - azure-database-retention-period-set
  - azure-database-threat-alert-email-set
  - azure-database-threat-alert-email-to-owner
  - azure-datafactory-no-public-access
  - azure-datalake-enable-at-rest-encryption
  - azure-keyvault-content-type-for-secret
  - azure-keyvault-ensure-key-expiry
  - azure-keyvault-ensure-secret-expiry
  - azure-keyvault-no-purge
  - azure-keyvault-specify-network-acl
  - azure-monitor-activity-log-retention-set
  - azure-monitor-capture-all-activities
  - azure-monitor-capture-all-regions
  - azure-network-no-public-egress
  - azure-network-no-public-ingress
  - azure-network-retention-policy-set
  - azure-security-center-alert-on-severe-notifications
  - azure-security-center-enable-standard-subscription
  - azure-security-center-set-required-contact-details
  - azure-storage-allow-microsoft-service-bypass
  - azure-storage-no-public-access
  - azure-storage-queue-services-logging-enabled
  - azure-synapse-virtual-network-enabled
  - cloudstack-compute-no-sensitive-info
  - digitalocean-compute-kubernetes-auto-upgrades-not-enabled
  - digitalocean-compute-no-public-egress
  - digitalocean-compute-no-public-ingress
  - digitalocean-compute-surge-upgrades-not-enabled
  - digitalocean-compute-use-ssh-keys
  - digitalocean-spaces-acl-no-public-read
  - digitalocean-spaces-disable-force-destroy
  - digitalocean-spaces-versioning-enabled
  - github-actions-no-plain-text-action-secrets
  - github-repositories-private
  - general-secrets-no-plaintext-exposure
  - google-bigquery-no-public-access
  - google-compute-disk-encryption-customer-key
  - google-compute-enable-shielded-vm-im
  - google-compute-enable-shielded-vm-vtpm
  - google-compute-enable-vpc-flow-logs
  - google-compute-no-default-service-account
  - google-compute-no-ip-forwarding
  - google-compute-no-oslogin-override
  - google-compute-no-project-wide-ssh-keys
  - google-compute-no-public-egress
  - google-compute-no-public-ingress
  - google-compute-no-public-ip
  - google-compute-no-serial-port
  - google-compute-project-level-oslogin
  - google-compute-vm-disk-encryption-customer-key
  - google-dns-enable-dnssec
  - google-dns-no-rsa-sha1
  - google-gke-enable-auto-repair
  - google-gke-enable-auto-upgrade
  - google-gke-enable-ip-aliasing
  - google-gke-enable-master-networks
  - google-gke-enable-network-policy
  - google-gke-enable-private-cluster
  - google-gke-enable-stackdriver-logging
  - google-gke-enable-stackdriver-monitoring
  - google-gke-enforce-pod-security-policy
  - google-gke-metadata-endpoints-disabled
  - google-gke-no-legacy-authentication
  - google-gke-no-public-control-plane
  - google-gke-node-metadata-security
  - google-gke-node-pool-uses-cos
  - google-gke-node-shielding-enabled
  - google-gke-use-cluster-labels
  - google-gke-use-rbac-permissions
  - google-gke-use-service-account
  - google-iam-no-default-network
  - google-iam-no-folder-level-default-service-account-assignment
  - google-iam-no-folder-level-service-account-impersonation
  - google-iam-no-org-level-default-service-account-assignment
  - google-iam-no-org-level-service-account-impersonation
  - google-iam-no-privileged-service-accounts
  - google-iam-no-project-level-default-service-account-assignment
  - google-iam-no-project-level-service-account-impersonation
  - google-iam-no-user-granted-permissions
  - google-kms-rotate-kms-keys
  - google-sql-enable-backup
  - google-sql-enable-pg-temp-file-logging
  - google-sql-encrypt-in-transit-data
  - google-sql-mysql-no-local-infile
  - google-sql-no-contained-db-auth
  - google-sql-no-cross-db-ownership-chaining
  - google-sql-no-public-access
  - google-sql-pg-log-checkpoints
  - google-sql-pg-log-connections
  - google-sql-pg-log-disconnections
  - google-sql-pg-log-errors
  - google-sql-pg-log-lock-waits
  - google-sql-pg-no-min-statement-logging
  - google-storage-enable-ubla
  - google-storage-no-public-access
  - kubernetes-network-no-public-egress
  - kubernetes-network-no-public-ingress
  - openstack-compute-no-public-access
  - oracle-compute-no-public-ip