Security Checks Matrix

All 100+ security checks DeployPilot AI performs across Kubernetes, Terraform, AWS CloudFormation, Azure ARM, GCP, Docker, and CI/CD — mapped to industry compliance frameworks with automated fix suggestions.

Kubernetes

Terraform

AWS CF

Kubernetes Security

CIS Kubernetes Benchmark 1.8 22 checks

Severity	Check	Description
CRITICAL	Container Running as Root	Detects containers without runAsNonRoot: true in securityContext
CRITICAL	Privileged Container Detected	Flags containers running in privileged mode with full host access
CRITICAL	ClusterRoleBinding to cluster-admin	Detects overly permissive RBAC bindings granting cluster-admin
HIGH	Missing Resource Limits	Containers without CPU/memory limits that can exhaust node resources
HIGH	Privilege Escalation Not Disabled	allowPrivilegeEscalation not explicitly set to false
HIGH	Host Network Enabled	Pod using host network namespace, bypassing network isolation
HIGH	Host PID Namespace Shared	Pod sharing host PID namespace, exposing host processes
HIGH	Potential Secret in Plain Text	Sensitive values hardcoded in env vars instead of using Kubernetes Secrets
MEDIUM	Missing Liveness Probe	No liveness probe to detect broken application state
MEDIUM	Missing Readiness Probe	No readiness probe to prevent traffic to unready pods
MEDIUM	Using :latest Image Tag	Mutable image tag that causes non-deterministic deployments
MEDIUM	No NetworkPolicy Defined	No network segmentation — all pods can communicate freely
MEDIUM	Writable Root Filesystem	readOnlyRootFilesystem not set, allowing file system modifications
LOW	No Namespace Specified	Resources deployed to default namespace without explicit namespace
LOW	No PodDisruptionBudget	Multi-replica deployment without PDB for disruption protection
MEDIUM	Service Account Token Auto-Mounted	Service account token auto-mounted, potentially exposing API access
MEDIUM	Using Default Service Account	Pod uses default service account which may have excessive permissions
LOW	Privileged Port Used	Container uses privileged port (<1024) requiring elevated privileges
LOW	No Pod Anti-Affinity	Multi-replica deployment without anti-affinity for high availability
LOW	No Startup Probe	Slow-starting application without startupProbe configured
HIGH	hostPath Volume Mount	Pod mounts host filesystem path, breaking container isolation
MEDIUM	Linux Capabilities Not Dropped	Container does not drop all Linux capabilities

Terraform / AWS

AWS Well-Architected Framework 20 checks

Severity	Check	Description
CRITICAL	Security Group Open to World	Ingress allows 0.0.0.0/0 — resource exposed to entire internet
CRITICAL	Hardcoded Credentials Detected	Access keys, passwords, or tokens hardcoded in configuration
HIGH	No Remote Backend Configured	Terraform state stored locally, preventing collaboration and risking loss
HIGH	S3 Bucket Without Encryption	S3 bucket missing server-side encryption configuration
HIGH	S3 Backend Without State Locking	S3 backend without DynamoDB locking — concurrent operations may corrupt state
HIGH	RDS Without Deletion Protection	Database can be accidentally destroyed by terraform destroy
HIGH	RDS Without Encryption at Rest	Database storage not encrypted, data at rest unprotected
MEDIUM	S3 Bucket Without Versioning	No versioning — accidental deletions cannot be recovered
MEDIUM	Provider Without Version Constraint	Provider upgrades may introduce breaking changes
MEDIUM	Sensitive Variable Not Marked	Variables with sensitive data not marked sensitive = true
MEDIUM	Access Logging Not Enabled	Load balancer or CDN without access logging for audit trail
LOW	Resource Missing Tags	Resources without tags for cost allocation and management
MEDIUM	No CloudTrail Configuration	No CloudTrail resource found for API activity logging
HIGH	EBS Volume Not Encrypted	EBS volume without encryption enabled
LOW	Lambda Not in VPC	Lambda function not configured within a VPC
MEDIUM	No Lifecycle prevent_destroy	Critical resource without prevent_destroy lifecycle rule
CRITICAL	IAM Policy with Wildcard Actions	IAM policy grants all actions (*) violating least-privilege
CRITICAL	RDS Publicly Accessible	Database publicly accessible from the internet
MEDIUM	No Backup Retention Period	RDS instance without specified backup retention
HIGH	S3 Public Access Not Blocked	S3 bucket without public access block configured

AWS CloudFormation

AWS Well-Architected Framework 12 checks

Severity	Check	Description
HIGH	CFN: S3 Bucket Without Encryption	S3 bucket missing server-side encryption in CloudFormation template
HIGH	CFN: S3 Public Access Not Blocked	S3 bucket without PublicAccessBlockConfiguration
CRITICAL	CFN: Security Group Open to World	Security group ingress allows 0.0.0.0/0 — exposed to internet
CRITICAL	CFN: IAM Policy with Wildcard Actions	IAM policy grants all actions (*) violating least-privilege
HIGH	CFN: IAM Policy with Wildcard Resource	IAM policy applies to all resources (*) instead of specific ARNs
HIGH	CFN: No DeletionPolicy on Critical Resource	Critical resource without DeletionPolicy — stack delete destroys data
HIGH	CFN: RDS Without Encryption	RDS instance without StorageEncrypted enabled
CRITICAL	CFN: RDS Publicly Accessible	RDS instance publicly accessible from the internet
MEDIUM	CFN: No Logging Configuration	No CloudTrail or CloudWatch Logs for audit and monitoring
HIGH	CFN: EBS Volume Not Encrypted	EBS volume without encryption enabled
LOW	CFN: Lambda Not in VPC	Lambda function not configured within a VPC
CRITICAL	CFN: Hardcoded Secret Detected	Sensitive values hardcoded instead of using NoEcho or Secrets Manager

Azure ARM Templates

Azure Security Benchmark 10 checks

Severity	Check	Description
HIGH	ARM: Storage Account Without HTTPS Enforcement	Storage account allows unencrypted HTTP connections
HIGH	ARM: Storage Account Without Encryption	Storage account without explicit encryption configuration
MEDIUM	ARM: Public IP Address Assigned	Resource has public IP increasing attack surface
HIGH	ARM: No Network Security Group	Network interface or VNet without associated NSG
CRITICAL	ARM: NSG Rule Open to World	NSG rule allows inbound from any source (0.0.0.0/0 or *)
MEDIUM	ARM: No Diagnostic Settings	Resources without diagnostic settings for monitoring
MEDIUM	ARM: SQL Server Without Auditing	Azure SQL Server without auditing for security monitoring
HIGH	ARM: SQL Server Public Network Access	SQL Server with public network access enabled
HIGH	ARM: VM Without Disk Encryption	Virtual machine without disk encryption configured
CRITICAL	ARM: Hardcoded Secret Detected	Sensitive values hardcoded instead of using secureString or Key Vault

GCP Infrastructure

GCP Security Best Practices 12 checks

Severity	Check	Description
CRITICAL	GCP: Firewall Rule Open to World	Firewall rule allows ingress from 0.0.0.0/0 — exposed to internet
CRITICAL	GCP: Bucket Publicly Accessible	GCS bucket grants access to allUsers or allAuthenticatedUsers
CRITICAL	GCP: Cloud SQL Publicly Accessible	Cloud SQL has public IP or allows connections from 0.0.0.0/0
CRITICAL	GCP: Hardcoded Secret Detected	Sensitive values hardcoded instead of using Secret Manager or KMS
CRITICAL	GCP: Overly Permissive IAM Role	Service account granted Owner or Editor role — violates least privilege
HIGH	GCP: Cloud SQL Without SSL	Cloud SQL instance does not enforce SSL connections
HIGH	GCP: GKE Cluster Without Private Nodes	GKE cluster nodes have public IPs exposed to internet
MEDIUM	GCP: Instance with External IP	Compute instance has external IP increasing attack surface
MEDIUM	GCP: Bucket Without Uniform Access	GCS bucket uses legacy ACLs instead of uniform IAM access
MEDIUM	GCP: No Audit Logging Configured	Template does not configure audit logging for resources
MEDIUM	GCP: GKE Without Network Policy	GKE cluster without network policy — pods communicate freely
LOW	GCP: Resources Without Labels	Resources without labels for cost allocation and organization

Dockerfile

Docker CIS Benchmark 12 checks

Severity	Check	Description
CRITICAL	Secret Exposed in Dockerfile	Sensitive values in ARG/ENV baked into image layers permanently
HIGH	Container Runs as Root	No USER instruction — container runs as root by default
MEDIUM	Broad COPY Statement	COPY . . includes sensitive files (.env, .git) in image
MEDIUM	Base Image Uses :latest Tag	Non-reproducible builds from mutable base image tag
MEDIUM	Base Image Without Version Tag	FROM without tag defaults to :latest implicitly
LOW	Use COPY Instead of ADD	ADD has implicit behaviors — COPY is more explicit and predictable
LOW	No HEALTHCHECK Instruction	Container health cannot be determined by orchestrators
LOW	Consider Multi-Stage Build	Single-stage build includes build tools in final image
LOW	Too Many Ports Exposed	Excessive ports exposed increasing attack surface
LOW	apt-get Without --no-install-recommends	Installing unnecessary recommended packages
LOW	Ensure .dockerignore Exists	Broad COPY without .dockerignore may include sensitive files
LOW	Downloaded Files Not Cleaned Up	Files from curl/wget not removed, increasing image size

CI/CD Pipelines

CI/CD Security Best Practices 12 checks

Severity	Check	Description
CRITICAL	Hardcoded Secret in Pipeline	Passwords, tokens, or keys hardcoded in pipeline configuration
HIGH	No Container Image Scanning	Images pushed without vulnerability scanning (Trivy, Snyk, Grype)
HIGH	No Environment Protection for Deployment	Production deployments without manual approval or environment protection
MEDIUM	No Test Step in Pipeline	Code deployed without running tests — no quality gate
MEDIUM	No Pull Request Trigger	Changes not validated before merge to main branch
MEDIUM	Unpinned GitHub Action	Actions using branch/tag reference instead of SHA — supply chain risk
LOW	No Caching Configured	Dependencies downloaded fresh every build — slow pipelines
LOW	No Pipeline Timeout	Stuck pipelines consume resources indefinitely
MEDIUM	No Static Analysis (SAST/Lint)	No code quality or security analysis step in pipeline
HIGH	Auto-Deploy Without Approval	Production deployment without manual approval gate
MEDIUM	Self-Hosted Runner Used	Self-hosted runners may have persistent state and security risks
LOW	No Artifact Signing	Artifacts published without signing or checksum verification

Run All 100+ Checks on Your Code

Supports Kubernetes, Terraform, AWS CloudFormation, Azure ARM, GCP Deployment Manager, Docker, and CI/CD pipelines — get results in seconds with fix suggestions.

Start Free — 7 Day Pro Trial Try Demo Scan