rules-cloudformation

AWS::IAM::AccessKey embeds long-term credentials in a stack. Prefer IAM Roles and instance profiles. If an access key is truly required, store the secret output in Secrets Manager — never output it as a plain CloudFormation Output value.

CloudFormation template detected. Verify the template is using current resource types and properties. Check for deprecated resource types (e.g., AWS::OpsWorks::*) and ensure drift detection is enabled on your stacks.

Hardcoded secret value detected in CloudFormation template. Secrets in templates are stored in CloudFormation state (S3/DynamoDB) in plaintext. Use AWS::SecretsManager::Secret or AWS Systems Manager Parameter Store (SecureString type) with dynamic references: '{{resolve:secretsmanager:MySecret:SecretString:password}}'. Never put real credentials in Default values or literal property strings.

RDS instance/cluster template does not set StorageEncrypted. Unencrypted RDS volumes expose data at rest if the underlying EBS volume is accessed. Add 'StorageEncrypted: true' and specify a KMSKeyId for customer-managed key control.

RDS/Redshift/ElastiCache with PubliclyAccessible: true exposes the database endpoint to the public internet. Remove internet access and instead route traffic through a VPC, bastion host, or AWS Session Manager. Exposed database ports are a critical attack surface.

S3 public block access is disabled. Public S3 buckets are a leading cause of data breaches. Unless this is a static website bucket with intentional public content, set all four BlockPublicAcls/BlockPublicPolicy/IgnorePublicAcls/RestrictPublicBuckets to true.

Wildcard IAM Action (Action: '*') grants every AWS action to the principal — equivalent to root access. Restrict to the minimum required actions (CWE-250, AWS Well-Architected least privilege). Replace with the specific action list needed.

Wildcard IAM Resource (Resource: '*') applies the policy to every resource in the account. Scope the resource ARN to the specific resource(s) the role actually manages (CWE-250). Use ARN conditions like 'arn:aws:s3:::my-bucket/*' instead.