{"object":"iac_rules","ruleset_version":"2026.07.16","updated":"2026-07-16","rules_total":55,"rules":[{"id":"aws.s3.public_acl","provider":"aws","dimension":"data_exposure","severity":"high","kind":"declarative"},{"id":"aws.s3.unencrypted","provider":"aws","dimension":"encryption","severity":"medium","kind":"declarative"},{"id":"aws.rds.publicly_accessible","provider":"aws","dimension":"network_exposure","severity":"high","kind":"declarative"},{"id":"aws.rds.unencrypted","provider":"aws","dimension":"encryption","severity":"high","kind":"declarative"},{"id":"aws.rds.no_backup","provider":"aws","dimension":"availability","severity":"low","kind":"declarative"},{"id":"aws.ebs.unencrypted","provider":"aws","dimension":"encryption","severity":"medium","kind":"declarative"},{"id":"aws.dynamodb.no_sse","provider":"aws","dimension":"encryption","severity":"low","kind":"declarative"},{"id":"aws.efs.unencrypted","provider":"aws","dimension":"encryption","severity":"medium","kind":"declarative"},{"id":"aws.redshift.public","provider":"aws","dimension":"network_exposure","severity":"high","kind":"declarative"},{"id":"aws.redshift.unencrypted","provider":"aws","dimension":"encryption","severity":"medium","kind":"declarative"},{"id":"aws.iam.wildcard_action","provider":"aws","dimension":"access_control","severity":"high","kind":"declarative"},{"id":"aws.iam.wildcard_resource","provider":"aws","dimension":"access_control","severity":"medium","kind":"declarative"},{"id":"aws.cloudtrail.no_log_validation","provider":"aws","dimension":"logging","severity":"low","kind":"declarative"},{"id":"aws.s3.no_logging","provider":"aws","dimension":"logging","severity":"low","kind":"declarative"},{"id":"gcp.sql.public","provider":"gcp","dimension":"network_exposure","severity":"high","kind":"declarative"},{"id":"gcp.storage.uniform_access_off","provider":"gcp","dimension":"access_control","severity":"low","kind":"declarative"},{"id":"gcp.compute.public_ip","provider":"gcp","dimension":"network_exposure","severity":"medium","kind":"declarative"},{"id":"azure.storage.https_only_off","provider":"azure","dimension":"encryption","severity":"medium","kind":"declarative"},{"id":"azure.sql.public","provider":"azure","dimension":"network_exposure","severity":"high","kind":"declarative"},{"id":"azure.storage.public_blob","provider":"azure","dimension":"data_exposure","severity":"medium","kind":"declarative"},{"id":"k8s.privileged","provider":"k8s","dimension":"container_security","severity":"critical","kind":"declarative"},{"id":"k8s.allow_priv_escalation","provider":"k8s","dimension":"container_security","severity":"high","kind":"declarative"},{"id":"k8s.run_as_non_root_missing","provider":"k8s","dimension":"container_security","severity":"medium","kind":"declarative"},{"id":"k8s.host_network","provider":"k8s","dimension":"network_exposure","severity":"high","kind":"declarative"},{"id":"k8s.host_pid","provider":"k8s","dimension":"container_security","severity":"high","kind":"declarative"},{"id":"k8s.host_ipc","provider":"k8s","dimension":"container_security","severity":"medium","kind":"declarative"},{"id":"k8s.host_path_volume","provider":"k8s","dimension":"data_exposure","severity":"high","kind":"declarative"},{"id":"k8s.cap_sys_admin","provider":"k8s","dimension":"container_security","severity":"critical","kind":"declarative"},{"id":"k8s.cap_net_admin","provider":"k8s","dimension":"container_security","severity":"high","kind":"declarative"},{"id":"k8s.no_resource_limits","provider":"k8s","dimension":"availability","severity":"low","kind":"declarative"},{"id":"k8s.image_latest_tag","provider":"k8s","dimension":"supply_chain","severity":"low","kind":"declarative"},{"id":"k8s.automount_sa_token","provider":"k8s","dimension":"access_control","severity":"medium","kind":"declarative"},{"id":"k8s.read_only_root_fs_missing","provider":"k8s","dimension":"container_security","severity":"low","kind":"declarative"},{"id":"docker.user_root","provider":"docker","dimension":"container_security","severity":"high","kind":"declarative"},{"id":"docker.no_user","provider":"docker","dimension":"container_security","severity":"medium","kind":"declarative"},{"id":"docker.add_remote_url","provider":"docker","dimension":"supply_chain","severity":"medium","kind":"declarative"},{"id":"docker.curl_pipe_shell","provider":"docker","dimension":"supply_chain","severity":"high","kind":"declarative"},{"id":"docker.image_latest_tag","provider":"docker","dimension":"supply_chain","severity":"low","kind":"declarative"},{"id":"docker.secret_in_arg_env","provider":"docker","dimension":"secrets_posture","severity":"medium","kind":"declarative"},{"id":"docker.no_healthcheck","provider":"docker","dimension":"availability","severity":"info","kind":"declarative"},{"id":"compose.privileged","provider":"docker","dimension":"container_security","severity":"critical","kind":"declarative"},{"id":"compose.docker_sock_mount","provider":"docker","dimension":"container_security","severity":"critical","kind":"declarative"},{"id":"compose.host_root_volume","provider":"docker","dimension":"data_exposure","severity":"high","kind":"declarative"},{"id":"compose.cap_sys_admin","provider":"docker","dimension":"container_security","severity":"high","kind":"declarative"},{"id":"compose.network_host","provider":"docker","dimension":"network_exposure","severity":"medium","kind":"declarative"},{"id":"cfn.s3.public","provider":"aws","dimension":"data_exposure","severity":"high","kind":"declarative"},{"id":"cfn.rds.public","provider":"aws","dimension":"network_exposure","severity":"high","kind":"declarative"},{"id":"cfn.rds.unencrypted","provider":"aws","dimension":"encryption","severity":"high","kind":"declarative"},{"id":"cfn.ebs.unencrypted","provider":"aws","dimension":"encryption","severity":"medium","kind":"declarative"},{"id":"cfn.iam.wildcard_action","provider":"aws","dimension":"access_control","severity":"high","kind":"declarative"},{"id":"xr.security_group.world_open","provider":"aws","dimension":"network_exposure","severity":"high","kind":"cross_resource"},{"id":"xr.nsg.world_open","provider":"azure","dimension":"network_exposure","severity":"high","kind":"cross_resource"},{"id":"xr.s3.no_public_access_block","provider":"aws","dimension":"data_exposure","severity":"medium","kind":"cross_resource"},{"id":"xr.instance.public_open_sg","provider":"aws","dimension":"network_exposure","severity":"critical","kind":"cross_resource"},{"id":"xr.compose.public_port_bind","provider":"docker","dimension":"network_exposure","severity":"medium","kind":"cross_resource"}],"dimensions":["network_exposure","encryption","access_control","logging","container_security","data_exposure","supply_chain","secrets_posture","availability"],"counts_by_dimension":{"network_exposure":12,"encryption":9,"access_control":5,"logging":2,"container_security":13,"data_exposure":6,"supply_chain":4,"secrets_posture":1,"availability":3},"counts_by_provider":{"aws":22,"azure":4,"docker":13,"gcp":3,"k8s":13},"counts_by_severity":{"critical":5,"high":22,"medium":18,"low":9,"info":1},"providers":["aws","azure","docker","gcp","k8s"],"formats":["terraform","terraform-plan","kubernetes","dockerfile","docker-compose","cloudformation"],"verdicts":["pass","caution","block"],"severity_weights":{"critical":40,"high":25,"medium":12,"low":5,"info":1},"block_score_threshold":40,"limits":{"max_bytes":262144,"max_resources":2000,"max_findings":500},"provenance":"Curated by us from PUBLIC security taxonomies (CIS Benchmarks for AWS/GCP/Azure/Kubernetes/Docker, OWASP, and cloud-provider hardening guides). Rule LOGIC (facts like 'a public S3 ACL is risky') is not copyrightable; NO third-party rule code or dataset (Checkov/Trivy/tfsec) is copied — every reason/fix string is authored here.","disclaimer":"Automated security indicators, NOT a guarantee. A pass/clean verdict is not an endorsement and a block is not proof of exploitability — always review the configuration and your threat model before applying infrastructure changes.","note":"Freshness = a data update of the rule registry (no live daemon). The paid /iac/scan and /iac/inspect routes evaluate against this ruleset. Boundary: iacscan flags resource misconfiguration posture, not secret VALUES — a hardcoded credential is flagged as a posture nit pointing at /secret/scan."}