rules-cloud

User is port-forwarding to a pod. This could expose internal services externally.

Blocked 'kubectl delete namespace' to prevent accidental loss of cluster resources.

Blocked creation of privileged pods to prevent container escapes and host takeover.

Kubernetes manifest is missing resource CPU or Memory limits. This can lead to cluster instability.

Hardcoded AWS credentials detected in Terraform source (CWE-798). AKIA* access keys and 40-character secret keys embedded in .tf or .tfvars files will be committed to version control, exposing them to anyone with repo access. Use the AWS provider's default credential chain (environment variables, shared credentials file, or IAM instance roles) and never inline credentials. Rotate any key that was already committed.

Security group rule opens RDP (port 3389) to the entire internet (0.0.0.0/0). Publicly exposed RDP is one of the most exploited attack surfaces in cloud environments (BlueKeep CVE-2019-0708, DejaBlue). Restrict RDP ingress to known management CIDRs or use a VPN/bastion host.

Security group rule opens SSH (port 22) to the entire internet (0.0.0.0/0). This exposes instances to brute-force and exploitation of any SSH daemon vulnerabilities (CWE-284). Restrict SSH ingress to known management CIDR ranges, or use AWS Systems Manager Session Manager to eliminate the need for open SSH entirely.

Detected S3 bucket configuration with public access enabled. This is a critical security risk.

Blocked 'terraform destroy' to prevent accidental infrastructure deletion. Use targeted removal if necessary.

Terraform is force-detaching an IAM policy. This could result in unexpected permission loss.

Terraform plan contains a large number of resource changes. Please review carefully.

Terraform configuration lacks a remote backend for state storage. Local state files contain sensitive resource metadata (including secret outputs) and are not suitable for team use or disaster recovery. Configure an S3 (with DynamoDB lock), GCS, or Terraform Cloud backend to store state remotely and encrypted.