tfsec.yml

---
exclude:
  - aws-api-gateway-enable-access-logging
  - aws-api-gateway-enable-tracing
  - aws-api-gateway-no-public-access
  - aws-cloudfront-enable-waf
  - aws-cloudtrail-enable-all-regions
  - aws-cloudtrail-enable-log-validation
  - aws-cloudwatch-log-group-customer-key
  - aws-codebuild-enable-encryption
  - aws-config-aggregate-all-regions
  - aws-documentdb-enable-log-export
  - aws-documentdb-encryption-customer-key
  - aws-dynamodb-enable-recovery
  - aws-dynamodb-table-customer-key
  - aws-ebs-encryption-customer-key
  - aws-ecr-repository-customer-key
  - aws-ecs-enable-container-insight
  - aws-eks-enable-control-plane-logging
  - aws-elastic-search-enable-domain-logging
  - aws-elastic-search-enable-logging
  - aws-elastic-search-enforce-https
  - aws-elasticache-add-description-for-security-group
  - aws-elasticache-enable-backup-retention
  - aws-elbv2-alb-not-public
  - aws-iam-no-password-reuse
  - aws-iam-no-policy-wildcards
  - aws-iam-require-lowercase-in-passwords
  - aws-iam-require-numbers-in-passwords
  - aws-iam-require-symbols-in-passwords
  - aws-iam-require-uppercase-in-passwords
  - aws-iam-set-max-password-age
  - aws-iam-set-minimum-password-length
  - aws-kinesis-enable-in-transit-encryption
  - aws-kms-auto-rotate-keys
  - aws-lambda-enable-tracing
  - aws-lambda-restrict-source-arn
  - aws-mq-enable-audit-logging
  - aws-mq-enable-general-logging
  - aws-msk-enable-logging
  - aws-neptune-enable-log-export
  - aws-rds-backup-retention-specified
  - aws-rds-enable-performance-insights
  - aws-rds-no-classic-resources
  - aws-rds-no-public-db-access
  - aws-redshift-add-description-to-security-group
  - aws-redshift-encryption-customer-key
  - aws-redshift-non-default-vpc-deployment
  - aws-s3-enable-bucket-logging
  - aws-s3-enable-versioning
  - aws-s3-ignore-public-acls
  - aws-s3-block-public-acls
  - aws-s3-no-public-access-with-acl
  - aws-s3-no-public-buckets
  - aws-s3-specify-public-access-block
  - aws-sns-enable-topic-encryption
  - aws-sqs-enable-queue-encryption
  - aws-sqs-no-wildcards-in-policy-documents
  - aws-ssm-secret-use-customer-key
  - aws-vpc-add-description-to-security-group
  - aws-vpc-no-default-vpc
  - aws-vpc-no-public-egress-sg
  - aws-vpc-no-public-egress-sgr
  - aws-vpc-no-public-ingress
  - aws-vpc-no-public-ingress-sg
  - aws-vpc-no-public-ingress-sgr
  - azure-appservice-account-identity-registered
  - azure-appservice-authentication-enabled
  - azure-appservice-require-client-cert
  - azure-authorization-limit-role-actions
  - azure-compute-disable-password-authentication
  - azure-compute-ssh-authentication
  - azure-container-logging
  - azure-container-use-rbac-permissions
  - azure-database-enable-audit
  - azure-database-no-public-access
  - azure-database-no-public-firewall-access
  - azure-database-postgres-configuration-log-checkpoints
  - azure-database-postgres-configuration-log-connection-throttling
  - azure-database-postgres-configuration-log-connections
  - azure-database-retention-period-set
  - azure-datafactory-no-public-access
  - azure-keyvault-content-type-for-secret
  - azure-keyvault-ensure-key-expiry
  - azure-keyvault-ensure-secret-expiry
  - azure-keyvault-no-purge
  - azure-monitor-activity-log-retention-set
  - azure-monitor-capture-all-activities
  - azure-monitor-capture-all-regions
  - azure-mssql-threat-alert-email-to-owner
  - azure-network-no-public-egress
  - azure-network-no-public-ingress
  - azure-network-retention-policy-set
  - azure-security-center-enable-standard-subscription
  - azure-security-center-set-required-contact-details
  - azure-storage-no-public-access
  - azure-storage-queue-services-logging-enabled
  - azure-synapse-virtual-network-enabled
  - azure-storage-container-activity-logs-not-public
  - azure-appservice-detailed-error-messages-enabled
  - azure-appservice-enable-https-only
  - azure-appservice-failed-request-tracing-enabled
  - azure-appservice-ftp-deployments-disabled
  - azure-appservice-http-logs-enabled
  - azure-functionapp-authentication-enabled
  - azure-securitycenter-defender-on-appservices
  - azure-securitycenter-defender-on-container-registry
  - azure-securitycenter-defender-on-keyvault
  - azure-securitycenter-defender-on-kubernetes
  - azure-securitycenter-defender-on-servers
  - azure-securitycenter-defender-on-sql-servers
  - azure-securitycenter-defender-on-sql-servers-vms
  - azure-securitycenter-defender-on-storage
  - digitalocean-compute-no-public-egress
  - digitalocean-compute-no-public-ingress
  - digitalocean-droplet-use-ssh-keys
  - digitalocean-spaces-acl-no-public-read
  - digitalocean-spaces-versioning-enabled
  - general-secrets-sensitive-in-attribute
  - general-secrets-sensitive-in-attribute-value
  - general-secrets-sensitive-in-local
  - general-secrets-sensitive-in-variable
  - github-repositories-private
  - github-repositories-vulnerability-alerts
  - github-repositories-require-signed-commits
  - google-bigquery-no-public-access
  - google-compute-disk-encryption-customer-key
  - google-compute-disk-encryption-required
  - google-compute-enable-shielded-vm
  - google-compute-enable-vpc-flow-logs
  - google-compute-no-default-service-account
  - google-compute-no-ip-forwarding
  - google-compute-no-project-wide-ssh-keys
  - google-compute-no-public-egress
  - google-compute-no-public-ingress
  - google-compute-no-public-ip
  - google-compute-no-serial-port
  - google-compute-vm-disk-encryption-customer-key
  - google-gke-enable-auto-upgrade
  - google-gke-enable-ip-aliasing
  - google-gke-enable-master-networks
  - google-gke-enable-network-policy
  - google-gke-enable-private-cluster
  - google-gke-enable-stackdriver-logging
  - google-gke-enable-stackdriver-monitoring
  - google-gke-enforce-pod-security-policy
  - google-gke-no-public-control-plane
  - google-gke-node-pool-uses-cos
  - google-gke-node-shielding-enabled
  - google-gke-use-cluster-labels
  - google-gke-use-service-account
  - google-iam-no-folder-level-default-service-account-assignment
  - google-iam-no-org-level-default-service-account-assignment
  - google-iam-no-project-level-default-service-account-assignment
  - google-iam-no-user-granted-permissions
  - google-kms-rotate-kms-keys
  - google-project-no-default-network
  - google-sql-enable-pg-temp-file-logging
  - google-sql-no-contained-db-auth
  - google-sql-no-cross-db-ownership-chaining
  - google-sql-no-public-access
  - google-sql-pg-log-checkpoints
  - google-sql-pg-log-connections
  - google-sql-pg-log-disconnections
  - google-sql-pg-log-errors
  - google-sql-pg-log-lock-waits
  - google-sql-pg-no-min-statement-logging
  - google-storage-enable-ubla
  - google-storage-no-public-access
  - kubernetes-network-no-public-egress
  - kubernetes-network-no-public-ingress
  - openstack-fw-no-public-access
  - oracle-compute-no-public-ip