Checkmarx logo
KICS REPORT10/24/2025 17:23KICS.IO
KICS development Scanned paths: /path/e2e/fixtures/samples/positive.yaml Platforms: CloudFormation, CommonStart time: 17:23:34, Oct 24 2025 End time: 17:23:53, Oct 24 2025

Vulnerabilities:

0 CRITICAL
9 HIGH
11 MEDIUM
5 LOW
3 INFO
28 TOTAL

DB Security Group Open To Large Scope

Platform: CloudFormation CWE: 668 Risk Score: 7.8 Category: Networking and Firewall
The IP address in a DB Security Group must not have more than 256 hosts.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html
Results (2)
File: /path/e2e/fixtures/samples/positive.yaml Line 32
Expected: 'Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp' should not have more than 256 hosts. Found: 'Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp' has more than 256 hosts.
31 ToPort: 22
32 CidrIp: 0.0.0.0/0
33 EcsSecurityGroupALBports:
File: /path/e2e/fixtures/samples/positive.yaml Line 24
Expected: 'Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp' should not have more than 256 hosts. Found: 'Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp' has more than 256 hosts.
23 ToPort: 80
24 CidrIp: 0.0.0.0/0
25 EcsSecurityGroupSSHinbound:

ELB Sensitive Port Is Exposed To Entire Network

Platform: CloudFormation CWE: 668 Risk Score: 7.7 Category: Networking and Firewall
The load balancer of the application with a sensitive port connection is exposed to the entire internet.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-elb.html
Results (2)
File: /path/e2e/fixtures/samples/positive.yaml Line 19
Expected: HTTP (TCP:80) should not be allowed in application load balancer 'ECSALB' Found: HTTP (TCP:80) is allowed in application load balancer 'ECSALB'
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'
File: /path/e2e/fixtures/samples/positive.yaml Line 27
Expected: SSH (TCP:22) should not be allowed in application load balancer 'ECSALB' Found: SSH (TCP:22) is allowed in application load balancer 'ECSALB'
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'

Passwords And Secrets - CloudFormation Secret Template

Platform: Common CWE: 798 Risk Score: 7.8 Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 273
Expected: Hardcoded secret key should not appear in source Found: Hardcoded secret key appears in source
272 GenerateSecretString:
273 SecretStringTemplate: <SECRET-MASKED-ON-PURPOSE>
274 GenerateStringKey: 'password'

Passwords And Secrets - Generic Password

Platform: Common CWE: 798 Risk Score: 7.8 Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 276
Expected: Hardcoded secret key should not appear in source Found: Hardcoded secret key appears in source
275 EncryptionKey: 'password'
276 Password: <SECRET-MASKED-ON-PURPOSE>
277 PasswordLength: 16

Security Groups With Exposed Admin Ports

Platform: CloudFormation CWE: 668 Risk Score: 7.7 Category: Networking and Firewall
Security Groups should not have ports 20, 21, 22, 23, 115, 137, 138, 139, 2049 or 3389 openhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 27
Expected: No exposed ingress rule should contain admin ports: 20, 21, 22, 23, 115, 137, 138, 139, 2049 or 3389 Found: 'Resources.EcsSecurityGroupSSHinbound.Properties' is exposed and contains port(s): 22
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'

Unrestricted Security Group Ingress

Platform: CloudFormation CWE: 668 Risk Score: 7.2 Category: Networking and Firewall
AWS Security Group Ingress CIDR should not be open to the worldhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html
Results (2)
File: /path/e2e/fixtures/samples/positive.yaml Line 24
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp should not be open to the world (0.0.0.0/0) Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is open to the world (0.0.0.0/0)
23 ToPort: 80
24 CidrIp: 0.0.0.0/0
25 EcsSecurityGroupSSHinbound:
File: /path/e2e/fixtures/samples/positive.yaml Line 32
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp should not be open to the world (0.0.0.0/0) Found: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp is open to the world (0.0.0.0/0)
31 ToPort: 22
32 CidrIp: 0.0.0.0/0
33 EcsSecurityGroupALBports:

ALB Is Not Integrated With WAF

Platform: CloudFormation CWE: 778 Risk Score: 4.9 Category: Networking and Firewall
All Application Load Balancers (ALB) must be protected with Web Application Firewall (WAF) servicehttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafregional-webaclassociation.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 86
Expected: 'Resources.ECSALB' should not have an 'internal' scheme and should have a 'WebACLAssociation' associated Found: 'Resources.ECSALB' does not have an 'internal' scheme and a 'WebACLAssociation' associated
85 - Name: my-vol
86 ECSALB:
87 Type: AWS::ElasticLoadBalancingV2::LoadBalancer

ALB Listening on HTTP

Platform: CloudFormation CWE: 319 Risk Score: 6.8 Category: Networking and Firewall
AWS Application Load Balancer (alb) should not listen on HTTPhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-elb-listener.html#cfn-ec2-elb-listener-protocol
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 104
Expected: 'Resources.ALBListener.Protocol' should not equal to 'HTTP' Found: 'Resources.ALBListener.Protocol' equals to 'HTTP'
103 Port: 80
104 Protocol: HTTP
105 ECSALBListenerRule:

Auto Scaling Group With No Associated ELB

Platform: CloudFormation CWE: 400 Risk Score: 5.1 Category: Availability
AWS Auto Scaling Groups must have associated ELBs to ensure high availability and improve application performance. This means the attribute 'LoadBalancerNames' must be defined and not empty.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-as-group.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 131
Expected: 'Resources.ECSAutoScalingGroup.Properties.LoadBalancerNames' should be defined Found: 'Resources.ECSAutoScalingGroup.Properties.LoadBalancerNames' is not defined
130 Type: AWS::AutoScaling::AutoScalingGroup
131 Properties:
132 VPCZoneIdentifier: !Ref 'SubnetId'

ECS Task Definition Network Mode Not Recommended

Platform: CloudFormation CWE: 665 Risk Score: 5.2 Category: Insecure Configurations
Network_Mode should be 'awsvpc' in ecs_task_definition. AWS VPCs provides the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurationshttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-networkmode
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 48
Expected: 'Resources.TaskDefinition.Properties.NetworkMode' should be set and should be 'awsvpc' Found: 'Resources.TaskDefinition.Properties.NetworkMode' is undefined and defaults to 'bridge'
47 Type: AWS::ECS::TaskDefinition
48 Properties:
49 Family: !Join ['', [!Ref 'AWS::StackName', -ecs-demo-app]]

EFS Volume With Disabled Transit Encryption

Platform: CloudFormation CWE: 319 Risk Score: 5.5 Category: Encryption
Amazon EFS volume does not have encryption for data at transit enabled. To prevent such a scenario, enable the attribute 'TransitEncryption'https://docs.aws.amazon.com/AmazonECS/latest/developerguide/efs-volumes.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 85
Expected: Resources.TaskDefinition.Properties.Volumes[0].EFSVolumeConfiguration should be defined Found: Resources.TaskDefinition.Properties.Volumes[0].EFSVolumeConfiguration is not defined
84 Volumes:
85 - Name: my-vol
86 ECSALB:

ELB With Security Group Without Outbound Rules

Platform: CloudFormation CWE: 665 Risk Score: 5.2 Category: Networking and Firewall
An AWS Elastic Load Balancer (ELB) shouldn't have security groups without outbound ruleshttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html#cfn-ec2-securitygroup-securitygroupegress
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 14
Expected: 'Resources.EcsSecurityGroup.Properties.SecurityGroupEgress' should be defined Found: 'Resources.EcsSecurityGroup.Properties.SecurityGroupEgress' is undefined
13 Type: AWS::EC2::SecurityGroup
14 Properties:
15 GroupDescription: ECS Security Group

Empty Roles For ECS Cluster Task Definitions

Platform: CloudFormation CWE: 665 Risk Score: 4.9 Category: Access Control
Check if any ECS cluster has not defined proper roles for services' task definitions.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 167
Expected: 'Resources.service.Properties.TaskDefinition' refers to a TaskDefinition with Role Found: 'Resources.service.Properties.TaskDefinition' does not refer to a TaskDefinition with Role
166 Role: !Ref 'ECSServiceRole'
167 TaskDefinition: !Ref 'TaskDefinition'
168 ECSServiceRole:

HTTP Port Open To Internet

Platform: CloudFormation CWE: 668 Risk Score: 4.9 Category: Networking and Firewall
The HTTP port is open to the internet in a Security Grouphttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 19
Expected: 'Resources.EcsSecurityGroupHTTPinbound02.Properties' should not open the HTTP port (80) Found: 'Resources.EcsSecurityGroupHTTPinbound02.Properties' opens the HTTP port (80)
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'

Secretsmanager Secret Without KMS

Platform: CloudFormation CWE: 326 Risk Score: 3.0 Category: Encryption
AWS Secretmanager should use AWS KMS customer master key (CMK) to encrypt the secret values in the versions stored in the secrethttps://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-secretsmanager-secret.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 270
Expected: 'Resources.MyAmpAppSecretManagerRotater.Properties.KmsKeyId' should be defined and not null Found: 'Resources.MyAmpAppSecretManagerRotater.Properties.KmsKeyId' is undefined or null
269 Type: AWS::SecretsManager::Secret
270 Properties:
271 Description: 'This is my amp app instance secret'

Security Group Ingress With Port Range

Platform: CloudFormation CWE: 665 Risk Score: 5.2 Category: Networking and Firewall
AWS Security Group Ingress should have a single porthttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 35
Expected: Resources.EcsSecurityGroupALBports.Properties.FromPort should equal to Resources.EcsSecurityGroupALBports.Properties.ToPort Found: Resources.EcsSecurityGroupALBports.Properties.FromPort is not equal to Resources.EcsSecurityGroupALBports.Properties.ToPort
34 Type: AWS::EC2::SecurityGroupIngress
35 Properties:
36 GroupId: !Ref 'EcsSecurityGroup'

Security Group With Unrestricted Access To SSH

Platform: CloudFormation CWE: 284 Risk Score: 5.2 Category: Networking and Firewall
'SSH' (TCP:22) should not be public in AWS Security Grouphttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 27
Expected: 'Resources.EcsSecurityGroupSSHinbound.Properties' should not open the SSH port (22) Found: 'Resources.EcsSecurityGroupSSHinbound.Properties' opens the SSH port (22)
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'

ECS Service Without Running Tasks

Platform: CloudFormation CWE: 665 Risk Score: 2.2 Category: Availability
ECS Service should have at least 1 task runninghttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html#cfn-ecs-service-deploymentconfiguration
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 159
Expected: Resources.service.Properties.DeploymentConfiguration should be defined and not null Found: Resources.service.Properties.DeploymentConfiguration is undefined or null
158 Type: AWS::ECS::Service
159 Properties:
160 Cluster: !Ref 'ECSCluster'

ECS Task Definition HealthCheck Missing

Platform: CloudFormation CWE: 778 Risk Score: 3.6 Category: Observability
Amazon ECS must have the HealthCheck property defined to give more control over monitoring the health of taskshttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-healthcheck.html
Results (2)
File: /path/e2e/fixtures/samples/positive.yaml Line 207
Expected: 'Resources.TaskDefinition.Properties.ContainerDefinitions' should contain 'HealthCheck' property Found: 'Resources.TaskDefinition.Properties.ContainerDefinitions' doesn't contain 'HealthCheck' property
206 StepAdjustments:
207 - MetricIntervalLowerBound: 0
208 ScalingAdjustment: 200
File: /path/e2e/fixtures/samples/positive.yaml Line 115
Expected: 'Resources.TaskDefinition.Properties.ContainerDefinitions' should contain 'HealthCheck' property Found: 'Resources.TaskDefinition.Properties.ContainerDefinitions' doesn't contain 'HealthCheck' property
114 ListenerArn: !Ref 'ALBListener'
115 Priority: 1
116 ECSTG:

IAM Access Analyzer Not Enabled

Platform: CloudFormation CWE: 778 Risk Score: 3.5 Category: Best Practices
IAM Access Analyzer should be enabled and configured to continuously monitor resource permissionshttps://docs.aws.amazon.com/en_us/AWSCloudFormation/latest/UserGuide/aws-resource-accessanalyzer-analyzer.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 9
Expected: 'AWS::AccessAnalyzer::Analyzer' should be set Found: 'AWS::AccessAnalyzer::Analyzer' is undefined
8 Description: Select at two subnets in your selected VPC.
9Resources:
10 ECSCluster:

Secrets Manager Should Specify KmsKeyId

Platform: CloudFormation CWE: 326 Risk Score: 2.0 Category: Secret Management
Secrets Manager Secret should explicitly specify KmsKeyId, this will allow the secret to be shared cross-accounthttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secret.html
Results (1)
File: /path/e2e/fixtures/samples/positive.yaml Line 270
Expected: Resources.MyAmpAppSecretManagerRotater.Properties.KmsKeyId should be defined Found: Resources.MyAmpAppSecretManagerRotater.Properties.KmsKeyId is undefined
269 Type: AWS::SecretsManager::Secret
270 Properties:
271 Description: 'This is my amp app instance secret'

Security Group Rule Without Description

Platform: CloudFormation CWE: 710 Risk Score: 0.0 Category: Best Practices
It's considered a best practice for AWS Security Group to have a descriptionhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html
Results (3)
File: /path/e2e/fixtures/samples/positive.yaml Line 35
Expected: Resources.EcsSecurityGroupALBports.Properties.Description should be set Found: Resources.EcsSecurityGroupALBports.Properties.Description is undefined
34 Type: AWS::EC2::SecurityGroupIngress
35 Properties:
36 GroupId: !Ref 'EcsSecurityGroup'
File: /path/e2e/fixtures/samples/positive.yaml Line 19
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description should be set Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is undefined
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'
File: /path/e2e/fixtures/samples/positive.yaml Line 27
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.Description should be set Found: Resources.EcsSecurityGroupSSHinbound.Properties.Description is undefined
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'
KICS is open and will always stay such. Both the scanning engine and the security queries are clear and open for the software development community.
Spread the love:
The KICS project is powered by Checkmarx, global leader of Application Security Testing