infraweaver 0.3.7 → 0.3.8

package/src/mcp/terraform/checkovSeverities.ts

@@ -0,0 +1,1156 @@
+// Generated by scripts/generate-checkov-severities.ts from checkov 3.3.22's
+// policy index and trivy-checks 3ae9f4cc1967. Do not edit by
+// hand: rate a check in the script's OVERRIDES and regenerate.
+import type { Severity } from "#app/mcp/terraform/types";
+
+/**
+ * A severity for each checkov Terraform check, which open-source checkov does
+ * not report. Each line names its basis: a reviewer's rating, the severity
+ * trivy gives the same misconfiguration, a title rule, or the medium default.
+ */
+export const CHECKOV_SEVERITIES: Readonly<Record<string, Severity>> = {
+  CKV_ALI_1: "high", // internet-exposure — Alibaba Cloud OSS bucket accessible to public
+  CKV_ALI_2: "high", // internet-exposure — Ensure no security groups allow ingress from 0.0.0.0:0 to port 22
+  CKV_ALI_3: "high", // internet-exposure — Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389
+  CKV_ALI_4: "medium", // audit-logging — Ensure Action Trail Logging for all regions
+  CKV_ALI_5: "medium", // audit-logging — Ensure Action Trail Logging for all events
+  CKV_ALI_6: "low", // customer-managed-key — Ensure OSS bucket is encrypted with Customer Master Key
+  CKV_ALI_7: "high", // encryption-at-rest — Ensure disk is encrypted
+  CKV_ALI_8: "low", // customer-managed-key — Ensure Disk is encrypted with Customer Master Key
+  CKV_ALI_9: "high", // internet-exposure — Ensure database instance is not public
+  CKV_ALI_10: "medium", // recoverability — Ensure OSS bucket has versioning enabled
+  CKV_ALI_11: "low", // hygiene — Ensure OSS bucket has transfer Acceleration enabled
+  CKV_ALI_12: "medium", // audit-logging — Ensure the OSS bucket has access logging enabled
+  CKV_ALI_13: "medium", // password-policy — Ensure RAM password policy requires minimum length of 14 or greater
+  CKV_ALI_14: "medium", // password-policy — Ensure RAM password policy requires at least one number
+  CKV_ALI_15: "medium", // password-policy — Ensure RAM password policy requires at least one symbol
+  CKV_ALI_16: "medium", // password-policy — Ensure RAM password policy expires passwords within 90 days or less
+  CKV_ALI_17: "medium", // password-policy — Ensure RAM password policy requires at least one lowercase letter
+  CKV_ALI_18: "medium", // password-policy — Ensure RAM password policy prevents password reuse
+  CKV_ALI_19: "medium", // password-policy — Ensure RAM password policy requires at least one uppercase letter
+  CKV_ALI_20: "high", // encryption-in-transit — Ensure RDS instance uses SSL
+  CKV_ALI_21: "high", // encryption-in-transit — Ensure API Gateway API Protocol HTTPS
+  CKV_ALI_22: "high", // encryption-at-rest — Ensure Transparent Data Encryption is Enabled on instance
+  CKV_ALI_23: "medium", // password-policy — Ensure Ram Account Password Policy Max Login Attempts not > 5
+  CKV_ALI_24: "high", // authentication — Ensure RAM enforces MFA
+  CKV_ALI_25: "medium", // recoverability — Ensure RDS Instance SQL Collector Retention Period should be greater than 180
+  CKV_ALI_26: "medium", // default — Ensure Kubernetes installs plugin Terway or Flannel to support standard policies
+  CKV_ALI_27: "low", // customer-managed-key — Ensure KMS Key Rotation is enabled
+  CKV_ALI_28: "low", // customer-managed-key — Ensure KMS Keys are enabled
+  CKV_ALI_29: "medium", // default — Alibaba ALB ACL does not restrict Access
+  CKV_ALI_30: "low", // hygiene — Ensure RDS instance auto upgrades for minor versions
+  CKV_ALI_31: "medium", // default — Ensure K8s nodepools are set to auto repair
+  CKV_ALI_32: "high", // encryption-at-rest — Ensure launch template data disks are encrypted
+  CKV_ALI_33: "high", // encryption-in-transit — Alibaba Cloud Cypher Policy are secure
+  CKV_ALI_35: "medium", // audit-logging — Ensure RDS instance has log_duration enabled
+  CKV_ALI_36: "medium", // audit-logging — Ensure RDS instance has log_disconnections enabled
+  CKV_ALI_37: "medium", // audit-logging — Ensure RDS instance has log_connections enabled
+  CKV_ALI_38: "medium", // audit-logging — Ensure log audit is enabled for RDS
+  CKV_ALI_41: "medium", // network-placement — Ensure MongoDB is deployed inside a VPC
+  CKV_ALI_42: "high", // encryption-in-transit — Ensure Mongodb instance uses SSL
+  CKV_ALI_43: "high", // internet-exposure — Ensure MongoDB instance is not public
+  CKV_ALI_44: "high", // encryption-at-rest — Ensure MongoDB has Transparent Data Encryption Enabled
+  CKV_AWS_1: "critical", // public-write-or-full-admin — Ensure IAM policies that allow full "*-*" administrative privileges are not created
+  CKV_AWS_2: "high", // encryption-in-transit — Ensure ALB protocol is HTTPS
+  CKV_AWS_3: "high", // trivy AWS-0026 — Ensure all data stored in the EBS is securely encrypted
+  CKV_AWS_5: "high", // encryption-at-rest — Ensure all data stored in the Elasticsearch is securely encrypted at rest
+  CKV_AWS_6: "high", // encryption-at-rest — Ensure all Elasticsearch has node-to-node encryption enabled
+  CKV_AWS_7: "medium", // default — Ensure rotation for customer created CMKs is enabled
+  CKV_AWS_8: "high", // encryption-at-rest — Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted
+  CKV_AWS_9: "medium", // password-policy — Ensure IAM password policy expires passwords within 90 days or less
+  CKV_AWS_10: "medium", // password-policy — Ensure IAM password policy requires minimum length of 14 or greater
+  CKV_AWS_11: "medium", // password-policy — Ensure IAM password policy requires at least one lowercase letter
+  CKV_AWS_12: "medium", // password-policy — Ensure IAM password policy requires at least one number
+  CKV_AWS_13: "medium", // password-policy — Ensure IAM password policy prevents password reuse
+  CKV_AWS_14: "medium", // password-policy — Ensure IAM password policy requires at least one symbol
+  CKV_AWS_15: "medium", // password-policy — Ensure IAM password policy requires at least one uppercase letter
+  CKV_AWS_16: "high", // trivy AWS-0080 — Ensure all data stored in the RDS is securely encrypted at rest
+  CKV_AWS_17: "high", // internet-exposure — Ensure all data stored in RDS is not publicly accessible
+  CKV_AWS_18: "low", // trivy AWS-0089 — Ensure the S3 bucket has access logging enabled
+  CKV_AWS_19: "high", // trivy AWS-0088 — Ensure all data stored in the S3 bucket is securely encrypted at rest
+  CKV_AWS_20: "high", // internet-exposure — S3 Bucket has an ACL defined which allows public READ access.
+  CKV_AWS_21: "medium", // recoverability — Ensure all data stored in the S3 bucket have versioning enabled
+  CKV_AWS_22: "low", // customer-managed-key — Ensure SageMaker Notebook is encrypted at rest using KMS CMK
+  CKV_AWS_23: "medium", // network-placement — Ensure every security group and rule has a description
+  CKV_AWS_24: "high", // trivy AWS-0107 — Ensure no security groups allow ingress from 0.0.0.0:0 to port 22
+  CKV_AWS_25: "high", // internet-exposure — Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389
+  CKV_AWS_26: "high", // encryption-at-rest — Ensure all data stored in the SNS topic is encrypted
+  CKV_AWS_27: "high", // encryption-at-rest — Ensure all data stored in the SQS queue is encrypted
+  CKV_AWS_28: "medium", // recoverability — Ensure DynamoDB point in time recovery (backup) is enabled
+  CKV_AWS_29: "high", // encryption-at-rest — Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest
+  CKV_AWS_30: "high", // encryption-at-rest — Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit
+  CKV_AWS_31: "high", // authentication — Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token
+  CKV_AWS_32: "high", // internet-exposure — Ensure ECR policy is not set to public
+  CKV_AWS_33: "high", // over-broad-access — Ensure KMS key policy does not contain wildcard (*) principal
+  CKV_AWS_34: "high", // encryption-in-transit — Ensure CloudFront distribution ViewerProtocolPolicy is set to HTTPS
+  CKV_AWS_35: "high", // encryption-at-rest — Ensure CloudTrail logs are encrypted at rest using KMS CMKs
+  CKV_AWS_36: "medium", // audit-logging — Ensure CloudTrail log file validation is enabled
+  CKV_AWS_37: "medium", // audit-logging — Ensure Amazon EKS control plane logging is enabled for all log types
+  CKV_AWS_38: "high", // internet-exposure — Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0
+  CKV_AWS_39: "high", // internet-exposure — Ensure Amazon EKS public endpoint disabled
+  CKV_AWS_40: "low", // reviewed: attaching policies to groups is an access-management convention — Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)
+  CKV_AWS_41: "critical", // secret-in-config — Ensure no hard coded AWS access key and secret key exists in provider
+  CKV_AWS_42: "high", // encryption-at-rest — Ensure EFS is securely encrypted
+  CKV_AWS_43: "high", // encryption-at-rest — Ensure Kinesis Stream is securely encrypted
+  CKV_AWS_44: "high", // encryption-at-rest — Ensure Neptune storage is securely encrypted
+  CKV_AWS_45: "critical", // secret-in-config — Ensure no hard-coded secrets exist in lambda environment
+  CKV_AWS_46: "critical", // secret-in-config — Ensure no hard-coded secrets exist in EC2 user data
+  CKV_AWS_47: "high", // encryption-at-rest — Ensure DAX is encrypted at rest (default is unencrypted)
+  CKV_AWS_48: "medium", // audit-logging — Ensure MQ Broker logging is enabled
+  CKV_AWS_49: "high", // over-broad-access — Ensure no IAM policies documents allow "*" as a statement's actions
+  CKV_AWS_50: "low", // hygiene — X-Ray tracing is enabled for Lambda
+  CKV_AWS_51: "low", // hygiene — Ensure ECR Image Tags are immutable
+  CKV_AWS_53: "high", // trivy AWS-0086 — Ensure S3 bucket has block public ACLS enabled
+  CKV_AWS_54: "high", // trivy AWS-0086 — Ensure S3 bucket has block public policy enabled
+  CKV_AWS_55: "high", // trivy AWS-0086 — Ensure S3 bucket has ignore public ACLs enabled
+  CKV_AWS_56: "high", // trivy AWS-0086 — Ensure S3 bucket has 'restrict_public_buckets' enabled
+  CKV_AWS_57: "critical", // public-write-or-full-admin — S3 Bucket has an ACL defined which allows public WRITE access.
+  CKV_AWS_58: "high", // encryption-at-rest — Ensure EKS Cluster has Secrets Encryption Enabled
+  CKV_AWS_59: "high", // internet-exposure — Ensure there is no open access to back-end resources through API
+  CKV_AWS_60: "high", // over-broad-access — Ensure IAM role allows only specific services or principals to assume it
+  CKV_AWS_61: "high", // over-broad-access — Ensure AWS IAM policy does not allow assume role permission across all services
+  CKV_AWS_62: "critical", // public-write-or-full-admin — Ensure IAM policies that allow full "*-*" administrative privileges are not created
+  CKV_AWS_63: "high", // over-broad-access — Ensure no IAM policies documents allow "*" as a statement's actions
+  CKV_AWS_64: "high", // encryption-at-rest — Ensure all data stored in the Redshift cluster is securely encrypted at rest
+  CKV_AWS_65: "medium", // default — Ensure container insights are enabled on ECS cluster
+  CKV_AWS_66: "medium", // audit-logging — Ensure that CloudWatch Log Group specifies retention days
+  CKV_AWS_67: "medium", // audit-logging — Ensure CloudTrail is enabled in all Regions
+  CKV_AWS_68: "medium", // network-placement — CloudFront Distribution should have WAF enabled
+  CKV_AWS_69: "high", // internet-exposure — Ensure MQ Broker is not publicly exposed
+  CKV_AWS_70: "high", // over-broad-access — Ensure S3 bucket does not allow an action with any Principal
+  CKV_AWS_71: "medium", // audit-logging — Ensure Redshift Cluster logging is enabled
+  CKV_AWS_72: "high", // over-broad-access — Ensure SQS policy does not allow ALL (*) actions.
+  CKV_AWS_73: "low", // hygiene — Ensure API Gateway has X-Ray Tracing enabled
+  CKV_AWS_74: "high", // encryption-at-rest — Ensure DocumentDB is encrypted at rest (default is unencrypted)
+  CKV_AWS_75: "medium", // audit-logging — Ensure Global Accelerator accelerator has flow logs enabled
+  CKV_AWS_76: "medium", // audit-logging — Ensure API Gateway has Access Logging enabled
+  CKV_AWS_77: "high", // encryption-at-rest — Ensure Athena Database is encrypted at rest (default is unencrypted)
+  CKV_AWS_78: "high", // encryption-at-rest — Ensure that CodeBuild Project encryption is not disabled
+  CKV_AWS_79: "high", // trivy AWS-0028 — Ensure Instance Metadata Service Version 1 is not enabled
+  CKV_AWS_80: "medium", // audit-logging — Ensure MSK Cluster logging is enabled
+  CKV_AWS_81: "high", // encryption-at-rest — Ensure MSK Cluster encryption in rest and transit is enabled
+  CKV_AWS_82: "high", // encryption-at-rest — Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption
+  CKV_AWS_83: "high", // encryption-in-transit — Ensure Elasticsearch Domain enforces HTTPS
+  CKV_AWS_84: "medium", // audit-logging — Ensure Elasticsearch Domain Logging is enabled
+  CKV_AWS_85: "medium", // audit-logging — Ensure DocumentDB Logging is enabled
+  CKV_AWS_86: "medium", // audit-logging — Ensure CloudFront distribution has Access Logging enabled
+  CKV_AWS_87: "high", // internet-exposure — Redshift cluster should not be publicly accessible
+  CKV_AWS_88: "high", // internet-exposure — EC2 instance should not have public IP.
+  CKV_AWS_89: "high", // internet-exposure — DMS replication instance should not be publicly accessible
+  CKV_AWS_90: "high", // encryption-in-transit — Ensure DocumentDB TLS is not disabled
+  CKV_AWS_91: "medium", // audit-logging — Ensure the ELBv2 (Application/Network) has access logging enabled
+  CKV_AWS_92: "medium", // audit-logging — Ensure the ELB has access logging enabled
+  CKV_AWS_93: "low", // reviewed: a lockout is an operational risk, not an exposure — Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)
+  CKV_AWS_94: "high", // encryption-at-rest — Ensure Glue Data Catalog Encryption is enabled
+  CKV_AWS_96: "high", // encryption-at-rest — Ensure all data stored in Aurora is securely encrypted at rest
+  CKV_AWS_97: "high", // encryption-in-transit — Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions
+  CKV_AWS_98: "high", // encryption-at-rest — Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest
+  CKV_AWS_99: "high", // encryption-at-rest — Ensure Glue Security Configuration Encryption is enabled
+  CKV_AWS_100: "high", // internet-exposure — Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0
+  CKV_AWS_101: "medium", // audit-logging — Ensure Neptune logging is enabled
+  CKV_AWS_102: "high", // internet-exposure — Ensure Neptune Cluster instance is not publicly available
+  CKV_AWS_103: "high", // encryption-in-transit — Ensure that load balancer is using at least TLS 1.2
+  CKV_AWS_104: "medium", // audit-logging — Ensure DocumentDB has audit logs enabled
+  CKV_AWS_105: "high", // encryption-in-transit — Ensure Redshift uses SSL
+  CKV_AWS_106: "high", // encryption-at-rest — Ensure EBS default encryption is enabled
+  CKV_AWS_107: "high", // over-broad-access — Ensure IAM policies does not allow credentials exposure
+  CKV_AWS_108: "high", // over-broad-access — Ensure IAM policies does not allow data exfiltration
+  CKV_AWS_109: "high", // over-broad-access — Ensure IAM policies does not allow permissions management / resource exposure without constraints
+  CKV_AWS_110: "high", // over-broad-access — Ensure IAM policies does not allow privilege escalation
+  CKV_AWS_111: "medium", // default — Ensure IAM policies does not allow write access without constraints
+  CKV_AWS_112: "high", // encryption-in-transit — Ensure Session Manager data is encrypted in transit
+  CKV_AWS_113: "high", // encryption-at-rest — Ensure Session Manager logs are enabled and encrypted
+  CKV_AWS_114: "medium", // authentication-hardening — Ensure that EMR clusters with Kerberos have Kerberos Realm set
+  CKV_AWS_115: "low", // hygiene — Ensure that AWS Lambda function is configured for function-level concurrent execution limit
+  CKV_AWS_116: "low", // hygiene — Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)
+  CKV_AWS_117: "medium", // network-placement — Ensure that AWS Lambda function is configured inside a VPC
+  CKV_AWS_118: "medium", // audit-logging — Ensure that enhanced monitoring is enabled for Amazon RDS instances
+  CKV_AWS_119: "low", // customer-managed-key — Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK
+  CKV_AWS_120: "medium", // default — Ensure API Gateway caching is enabled
+  CKV_AWS_121: "medium", // default — Ensure AWS Config is enabled in all regions
+  CKV_AWS_122: "high", // internet-exposure — Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance
+  CKV_AWS_123: "medium", // network-placement — Ensure that VPC Endpoint Service is configured for Manual Acceptance
+  CKV_AWS_124: "medium", // audit-logging — Ensure that CloudFormation stacks are sending event notifications to an SNS topic
+  CKV_AWS_126: "medium", // audit-logging — Ensure that detailed monitoring is enabled for EC2 instances
+  CKV_AWS_127: "medium", // reviewed: a certificate's issuer, not whether traffic is encrypted — Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager
+  CKV_AWS_129: "medium", // audit-logging — Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled
+  CKV_AWS_130: "high", // internet-exposure — Ensure VPC subnets do not assign public IP by default
+  CKV_AWS_131: "medium", // default — Ensure that ALB drops HTTP headers
+  CKV_AWS_133: "medium", // recoverability — Ensure that RDS instances has backup policy
+  CKV_AWS_134: "medium", // recoverability — Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on
+  CKV_AWS_135: "medium", // default — Ensure that EC2 is EBS optimized
+  CKV_AWS_136: "high", // encryption-at-rest — Ensure that ECR repositories are encrypted using KMS
+  CKV_AWS_137: "medium", // network-placement — Ensure that Elasticsearch is configured inside a VPC
+  CKV_AWS_138: "medium", // default — Ensure that ELB is cross-zone-load-balancing enabled
+  CKV_AWS_139: "medium", // recoverability — Ensure that RDS clusters have deletion protection enabled
+  CKV_AWS_140: "high", // encryption-at-rest — Ensure that RDS global clusters are encrypted
+  CKV_AWS_141: "medium", // default — Ensured that Redshift cluster allowing version upgrade by default
+  CKV_AWS_142: "high", // encryption-at-rest — Ensure that Redshift cluster is encrypted by KMS
+  CKV_AWS_143: "medium", // default — Ensure that S3 bucket has lock configuration enabled by default
+  CKV_AWS_144: "low", // hygiene — Ensure that S3 bucket has cross-region replication enabled
+  CKV_AWS_145: "high", // trivy AWS-0088 — Ensure that S3 buckets are encrypted with KMS by default
+  CKV_AWS_146: "high", // encryption-at-rest — Ensure that RDS database cluster snapshot is encrypted
+  CKV_AWS_147: "low", // customer-managed-key — Ensure that CodeBuild projects are encrypted using CMK
+  CKV_AWS_148: "medium", // network-placement — Ensure no default VPC is planned to be provisioned
+  CKV_AWS_149: "low", // customer-managed-key — Ensure that Secrets Manager secret is encrypted using KMS CMK
+  CKV_AWS_150: "medium", // recoverability — Ensure that Load Balancer has deletion protection enabled
+  CKV_AWS_152: "medium", // default — Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled
+  CKV_AWS_153: "low", // hygiene — Autoscaling groups should supply tags to launch configurations
+  CKV_AWS_154: "medium", // network-placement — Ensure Redshift is not deployed outside of a VPC
+  CKV_AWS_155: "high", // encryption-at-rest — Ensure that Workspace user volumes are encrypted
+  CKV_AWS_156: "high", // encryption-at-rest — Ensure that Workspace root volumes are encrypted
+  CKV_AWS_157: "low", // hygiene — Ensure that RDS instances have Multi-AZ enabled
+  CKV_AWS_158: "high", // encryption-at-rest — Ensure that CloudWatch Log Group is encrypted by KMS
+  CKV_AWS_159: "high", // encryption-at-rest — Ensure that Athena Workgroup is encrypted
+  CKV_AWS_160: "low", // customer-managed-key — Ensure that Timestream database is encrypted with KMS CMK
+  CKV_AWS_161: "medium", // authentication-hardening — Ensure RDS database has IAM authentication enabled
+  CKV_AWS_162: "medium", // authentication-hardening — Ensure RDS cluster has IAM authentication enabled
+  CKV_AWS_163: "medium", // audit-logging — Ensure ECR image scanning on push is enabled
+  CKV_AWS_164: "high", // internet-exposure — Ensure Transfer Server is not exposed publicly.
+  CKV_AWS_165: "medium", // recoverability — Ensure DynamoDB point in time recovery (backup) is enabled for global tables
+  CKV_AWS_166: "low", // customer-managed-key — Ensure Backup Vault is encrypted at rest using KMS CMK
+  CKV_AWS_167: "high", // internet-exposure — Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it
+  CKV_AWS_168: "high", // internet-exposure — Ensure SQS queue policy is not public by only allowing specific services or principals to access it
+  CKV_AWS_169: "high", // internet-exposure — Ensure SNS topic policy is not public by only allowing specific services or principals to access it
+  CKV_AWS_170: "medium", // default — Ensure QLDB ledger permissions mode is set to STANDARD
+  CKV_AWS_171: "high", // encryption-at-rest — Ensure EMR Cluster security configuration encryption is using SSE-KMS
+  CKV_AWS_172: "medium", // recoverability — Ensure QLDB ledger has deletion protection enabled
+  CKV_AWS_173: "high", // encryption-at-rest — Check encryption settings for Lambda environmental variable
+  CKV_AWS_174: "high", // encryption-in-transit — Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 or higher
+  CKV_AWS_175: "medium", // network-placement — Ensure WAF has associated rules
+  CKV_AWS_176: "medium", // audit-logging — Ensure Logging is enabled for WAF Web Access Control Lists
+  CKV_AWS_177: "low", // customer-managed-key — Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_178: "low", // customer-managed-key — Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_179: "low", // customer-managed-key — Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_180: "low", // customer-managed-key — Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_181: "low", // customer-managed-key — Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_182: "low", // customer-managed-key — Ensure DocumentDB is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_183: "low", // customer-managed-key — Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_184: "low", // customer-managed-key — Ensure resource is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_185: "low", // customer-managed-key — Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_186: "low", // customer-managed-key — Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_187: "low", // customer-managed-key — Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_189: "low", // customer-managed-key — Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_190: "low", // customer-managed-key — Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_191: "low", // customer-managed-key — Ensure ElastiCache replication group is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_192: "medium", // audit-logging — Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
+  CKV_AWS_193: "medium", // audit-logging — Ensure AppSync has Logging enabled
+  CKV_AWS_194: "medium", // audit-logging — Ensure AppSync has Field-Level logs enabled
+  CKV_AWS_195: "medium", // default — Ensure Glue component has a security configuration associated
+  CKV_AWS_196: "medium", // default — Ensure no aws_elasticache_security_group resources exist
+  CKV_AWS_197: "medium", // audit-logging — Ensure MQ Broker Audit logging is enabled
+  CKV_AWS_198: "medium", // default — Ensure no aws_db_security_group resources exist
+  CKV_AWS_199: "low", // customer-managed-key — Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK)
+  CKV_AWS_200: "low", // customer-managed-key — Ensure that Image Recipe EBS Disk are encrypted with CMK
+  CKV_AWS_201: "high", // encryption-at-rest — Ensure MemoryDB is encrypted at rest using KMS CMKs
+  CKV_AWS_202: "high", // encryption-in-transit — Ensure MemoryDB data is encrypted in transit
+  CKV_AWS_203: "low", // customer-managed-key — Ensure resource is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_204: "high", // encryption-at-rest — Ensure AMIs are encrypted using KMS CMKs
+  CKV_AWS_205: "medium", // default — Ensure to Limit AMI launch Permissions
+  CKV_AWS_206: "high", // encryption-in-transit — Ensure API Gateway Domain uses a modern security Policy
+  CKV_AWS_207: "medium", // default — Ensure MQ Broker minor version updates are enabled
+  CKV_AWS_208: "medium", // default — Ensure MQ Broker version is current
+  CKV_AWS_209: "low", // customer-managed-key — Ensure MQ broker encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_210: "high", // over-broad-access — Batch job does not define a privileged container
+  CKV_AWS_211: "high", // encryption-in-transit — Ensure RDS uses a modern CaCert
+  CKV_AWS_212: "low", // customer-managed-key — Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_213: "high", // encryption-in-transit — Ensure ELB Policy uses only secure protocols
+  CKV_AWS_214: "high", // encryption-at-rest — Ensure AppSync API Cache is encrypted at rest
+  CKV_AWS_215: "high", // encryption-in-transit — Ensure AppSync API Cache is encrypted in transit
+  CKV_AWS_216: "medium", // default — Ensure CloudFront distribution is enabled
+  CKV_AWS_217: "medium", // default — Ensure Create before destroy for API deployments
+  CKV_AWS_218: "high", // encryption-in-transit — Ensure that CloudSearch is using latest TLS
+  CKV_AWS_219: "low", // customer-managed-key — Ensure CodePipeline Artifact store is using a KMS CMK
+  CKV_AWS_220: "high", // encryption-in-transit — Ensure that CloudSearch is using https
+  CKV_AWS_221: "low", // customer-managed-key — Ensure CodeArtifact Domain is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_222: "low", // hygiene — Ensure DMS replication instance gets all minor upgrade automatically
+  CKV_AWS_223: "medium", // audit-logging — Ensure ECS Cluster enables logging of ECS Exec
+  CKV_AWS_224: "low", // customer-managed-key — Ensure ECS Cluster logging is enabled and client to container communication uses CMK
+  CKV_AWS_225: "medium", // default — Ensure API Gateway method setting caching is enabled
+  CKV_AWS_226: "medium", // default — Ensure DB instance gets all minor upgrades automatically
+  CKV_AWS_227: "low", // customer-managed-key — Ensure KMS key is enabled
+  CKV_AWS_228: "high", // encryption-in-transit — Verify Elasticsearch domain is using an up to date TLS policy
+  CKV_AWS_229: "high", // internet-exposure — Ensure no NACL allow ingress from 0.0.0.0:0 to port 21
+  CKV_AWS_230: "high", // internet-exposure — Ensure no NACL allow ingress from 0.0.0.0:0 to port 20
+  CKV_AWS_231: "high", // internet-exposure — Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389
+  CKV_AWS_232: "high", // internet-exposure — Ensure no NACL allow ingress from 0.0.0.0:0 to port 22
+  CKV_AWS_233: "medium", // default — Ensure Create before destroy for ACM certificates
+  CKV_AWS_234: "medium", // audit-logging — Verify logging preference for ACM certificates
+  CKV_AWS_235: "high", // encryption-at-rest — Ensure that copied AMIs are encrypted
+  CKV_AWS_236: "low", // customer-managed-key — Ensure AMI copying uses a CMK
+  CKV_AWS_237: "medium", // default — Ensure Create before destroy for API Gateway
+  CKV_AWS_238: "medium", // audit-logging — Ensure that GuardDuty detector is enabled
+  CKV_AWS_239: "high", // encryption-in-transit — Ensure DAX cluster endpoint is using TLS
+  CKV_AWS_240: "high", // encryption-at-rest — Ensure Kinesis Firehose delivery stream is encrypted
+  CKV_AWS_241: "low", // customer-managed-key — Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK
+  CKV_AWS_242: "medium", // audit-logging — Ensure MWAA environment has scheduler logs enabled
+  CKV_AWS_243: "medium", // audit-logging — Ensure MWAA environment has worker logs enabled
+  CKV_AWS_244: "medium", // audit-logging — Ensure MWAA environment has webserver logs enabled
+  CKV_AWS_245: "high", // encryption-at-rest — Ensure replicated backups are encrypted at rest using KMS CMKs
+  CKV_AWS_246: "high", // encryption-at-rest — Ensure RDS Cluster activity streams are encrypted using KMS CMKs
+  CKV_AWS_247: "low", // customer-managed-key — Ensure all data stored in the Elasticsearch is encrypted with a CMK
+  CKV_AWS_248: "medium", // network-placement — Ensure that Elasticsearch is not using the default Security Group
+  CKV_AWS_249: "medium", // default — Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions
+  CKV_AWS_250: "high", // known-weakness — Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/)
+  CKV_AWS_251: "medium", // audit-logging — Ensure CloudTrail logging is enabled
+  CKV_AWS_252: "medium", // audit-logging — Ensure CloudTrail defines an SNS Topic
+  CKV_AWS_253: "high", // encryption-at-rest — Ensure DLM cross region events are encrypted
+  CKV_AWS_254: "low", // customer-managed-key — Ensure DLM cross region events are encrypted with Customer Managed Key
+  CKV_AWS_255: "high", // encryption-at-rest — Ensure DLM cross region schedules are encrypted
+  CKV_AWS_256: "low", // customer-managed-key — Ensure DLM cross region schedules are encrypted using a Customer Managed Key
+  CKV_AWS_257: "medium", // default — Ensure CodeCommit branch changes have at least 2 approvals
+  CKV_AWS_258: "high", // authentication — Ensure that Lambda function URLs AuthType is not None
+  CKV_AWS_259: "medium", // default — Ensure CloudFront response header policy enforces Strict Transport Security
+  CKV_AWS_260: "high", // trivy AWS-0107 — Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
+  CKV_AWS_261: "low", // not-security — Ensure HTTP HTTPS Target group defines Healthcheck
+  CKV_AWS_262: "low", // customer-managed-key — Ensure Kendra index Server side encryption uses CMK
+  CKV_AWS_263: "low", // customer-managed-key — Ensure AppFlow flow uses CMK
+  CKV_AWS_264: "low", // customer-managed-key — Ensure AppFlow connector profile uses CMK
+  CKV_AWS_265: "low", // customer-managed-key — Ensure Keyspaces Table uses CMK
+  CKV_AWS_266: "low", // customer-managed-key — Ensure DB Snapshot copy uses CMK
+  CKV_AWS_267: "low", // customer-managed-key — Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_268: "low", // customer-managed-key — Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_269: "low", // customer-managed-key — Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK
+  CKV_AWS_270: "low", // customer-managed-key — Ensure Connect Instance S3 Storage Config uses CMK
+  CKV_AWS_271: "low", // customer-managed-key — Ensure DynamoDB table replica KMS encryption uses CMK
+  CKV_AWS_272: "medium", // default — Ensure AWS Lambda function is configured to validate code-signing
+  CKV_AWS_273: "medium", // authentication-hardening — Ensure access is controlled through SSO and not AWS IAM defined users
+  CKV_AWS_274: "high", // over-broad-access — Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
+  CKV_AWS_275: "high", // over-broad-access — Disallow policies from using the AWS AdministratorAccess policy
+  CKV_AWS_276: "medium", // default — Ensure Data Trace is not enabled in API Gateway Method Settings
+  CKV_AWS_277: "high", // internet-exposure — Ensure no security groups allow ingress from 0.0.0.0:0 to port -1
+  CKV_AWS_278: "low", // customer-managed-key — Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_279: "high", // encryption-at-rest — Ensure Neptune snapshot is securely encrypted
+  CKV_AWS_280: "low", // customer-managed-key — Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_281: "low", // customer-managed-key — Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_282: "low", // customer-managed-key — Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK)
+  CKV_AWS_283: "high", // over-broad-access — Ensure no IAM policies documents allow ALL or any AWS principal permissions to the resource
+  CKV_AWS_284: "low", // hygiene — Ensure State Machine has X-Ray tracing enabled
+  CKV_AWS_285: "medium", // audit-logging — Ensure State Machine has execution history logging enabled
+  CKV_AWS_286: "high", // over-broad-access — Ensure IAM policies does not allow privilege escalation
+  CKV_AWS_287: "high", // over-broad-access — Ensure IAM policies does not allow credentials exposure
+  CKV_AWS_288: "high", // over-broad-access — Ensure IAM policies does not allow data exfiltration
+  CKV_AWS_289: "high", // over-broad-access — Ensure IAM policies does not allow permissions management / resource exposure without constraints
+  CKV_AWS_290: "medium", // default — Ensure IAM policies does not allow write access without constraints
+  CKV_AWS_291: "high", // internet-exposure — Ensure MSK nodes are private
+  CKV_AWS_292: "high", // encryption-at-rest — Ensure DocumentDB Global Cluster is encrypted at rest (default is unencrypted)
+  CKV_AWS_293: "medium", // recoverability — Ensure that AWS database instances have deletion protection enabled
+  CKV_AWS_294: "low", // customer-managed-key — Ensure CloudTrail Event Data Store uses CMK
+  CKV_AWS_295: "critical", // secret-in-config — Ensure DataSync Location Object Storage doesn't expose secrets
+  CKV_AWS_296: "low", // customer-managed-key — Ensure DMS endpoint uses Customer Managed Key (CMK)
+  CKV_AWS_297: "low", // customer-managed-key — Ensure EventBridge Scheduler Schedule uses Customer Managed Key (CMK)
+  CKV_AWS_298: "low", // customer-managed-key — Ensure DMS S3 uses Customer Managed Key (CMK)
+  CKV_AWS_300: "medium", // recoverability — Ensure S3 lifecycle configuration sets period for aborting failed uploads
+  CKV_AWS_301: "high", // internet-exposure — Ensure that AWS Lambda function is not publicly accessible
+  CKV_AWS_302: "high", // internet-exposure — Ensure DB Snapshots are not Public
+  CKV_AWS_303: "high", // internet-exposure — Ensure SSM documents are not Public
+  CKV_AWS_304: "medium", // default — Ensure Secrets Manager secrets should be rotated within 90 days
+  CKV_AWS_305: "medium", // default — Ensure CloudFront distribution has a default root object configured
+  CKV_AWS_306: "medium", // network-placement — Ensure SageMaker notebook instances should be launched into a custom VPC
+  CKV_AWS_307: "high", // over-broad-access — Ensure SageMaker Users should not have root access to SageMaker notebook instances
+  CKV_AWS_308: "high", // encryption-at-rest — Ensure API Gateway method setting caching is set to encrypted
+  CKV_AWS_309: "high", // authentication — Ensure API GatewayV2 routes specify an authorization type
+  CKV_AWS_310: "medium", // default — Ensure CloudFront distributions should have origin failover configured
+  CKV_AWS_311: "high", // encryption-at-rest — Ensure that CodeBuild S3 logs are encrypted
+  CKV_AWS_312: "low", // not-security — Ensure Elastic Beanstalk environments have enhanced health reporting enabled
+  CKV_AWS_313: "medium", // recoverability — Ensure RDS cluster configured to copy tags to snapshots
+  CKV_AWS_314: "medium", // audit-logging — Ensure CodeBuild project environments have a logging configuration
+  CKV_AWS_315: "medium", // default — Ensure EC2 Auto Scaling groups use EC2 launch templates
+  CKV_AWS_316: "high", // over-broad-access — Ensure CodeBuild project environments do not have privileged mode enabled
+  CKV_AWS_317: "medium", // audit-logging — Ensure Elasticsearch Domain Audit Logging is enabled
+  CKV_AWS_318: "medium", // default — Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA
+  CKV_AWS_319: "medium", // default — Ensure that CloudWatch alarm actions are enabled
+  CKV_AWS_320: "medium", // default — Ensure Redshift clusters do not use the default database name
+  CKV_AWS_321: "medium", // network-placement — Ensure Redshift clusters use enhanced VPC routing
+  CKV_AWS_322: "low", // hygiene — Ensure ElastiCache for Redis cache clusters have auto minor version upgrades enabled
+  CKV_AWS_323: "medium", // network-placement — Ensure ElastiCache clusters do not use the default subnet group
+  CKV_AWS_324: "medium", // audit-logging — Ensure that RDS Cluster log capture is enabled
+  CKV_AWS_325: "medium", // audit-logging — Ensure that RDS Cluster audit logging is enabled for MySQL engine
+  CKV_AWS_326: "medium", // default — Ensure that RDS Aurora Clusters have backtracking enabled
+  CKV_AWS_327: "high", // encryption-at-rest — Ensure RDS Clusters are encrypted using KMS CMKs
+  CKV_AWS_328: "medium", // default — Ensure that ALB is configured with defensive or strictest desync mitigation mode
+  CKV_AWS_329: "medium", // default — EFS access points should enforce a root directory
+  CKV_AWS_330: "medium", // default — EFS access points should enforce a user identity
+  CKV_AWS_331: "medium", // network-placement — Ensure Transit Gateways do not automatically accept VPC attachment requests
+  CKV_AWS_332: "medium", // default — Ensure ECS Fargate services run on the latest Fargate platform version
+  CKV_AWS_333: "high", // internet-exposure — Ensure ECS services do not have public IP addresses assigned to them automatically
+  CKV_AWS_334: "high", // over-broad-access — Ensure ECS containers should run as non-privileged
+  CKV_AWS_335: "medium", // default — Ensure ECS task definitions should not share the host's process namespace
+  CKV_AWS_336: "medium", // default — Ensure ECS containers are limited to read-only access to root filesystems
+  CKV_AWS_337: "low", // customer-managed-key — Ensure SSM parameters are using KMS CMK
+  CKV_AWS_338: "medium", // audit-logging — Ensure CloudWatch log groups retains logs for at least 1 year
+  CKV_AWS_339: "medium", // default — Ensure EKS clusters run on a supported Kubernetes version
+  CKV_AWS_340: "medium", // default — Ensure Elastic Beanstalk managed platform updates are enabled
+  CKV_AWS_341: "medium", // default — Ensure Launch template should not have a metadata response hop limit greater than 1
+  CKV_AWS_342: "medium", // network-placement — Ensure WAF rule has any actions
+  CKV_AWS_343: "medium", // recoverability — Ensure Amazon Redshift clusters should have automatic snapshots enabled
+  CKV_AWS_344: "medium", // recoverability — Ensure that Network firewalls have deletion protection enabled
+  CKV_AWS_345: "low", // customer-managed-key — Ensure that Network firewall encryption is via a CMK
+  CKV_AWS_346: "low", // customer-managed-key — Ensure Network Firewall Policy defines an encryption configuration that uses a customer managed Key (CMK)
+  CKV_AWS_347: "low", // customer-managed-key — Ensure Neptune is encrypted by KMS using a customer managed Key (CMK)
+  CKV_AWS_348: "critical", // public-write-or-full-admin — Ensure IAM root user does not have Access keys
+  CKV_AWS_349: "high", // encryption-at-rest — Ensure EMR Cluster security configuration encrypts local disks
+  CKV_AWS_350: "high", // encryption-at-rest — Ensure EMR Cluster security configuration encrypts EBS disks
+  CKV_AWS_351: "high", // encryption-at-rest — Ensure EMR Cluster security configuration encrypts InTransit
+  CKV_AWS_352: "high", // internet-exposure — Ensure NACL ingress does not allow all Ports
+  CKV_AWS_353: "low", // hygiene — Ensure that RDS instances have performance insights enabled
+  CKV_AWS_354: "high", // encryption-at-rest — Ensure RDS Performance Insights are encrypted using KMS CMKs
+  CKV_AWS_355: "high", // over-broad-access — Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions
+  CKV_AWS_356: "high", // over-broad-access — Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions
+  CKV_AWS_357: "high", // encryption-in-transit — Ensure Transfer Server allows only secure protocols
+  CKV_AWS_358: "high", // over-broad-access — Ensure AWS GitHub Actions OIDC authorization policies only allow safe claims and claim order
+  CKV_AWS_359: "medium", // authentication-hardening — Neptune DB clusters should have IAM database authentication enabled
+  CKV_AWS_360: "medium", // recoverability — Ensure DocumentDB has an adequate backup retention period
+  CKV_AWS_361: "medium", // recoverability — Ensure that Neptune DB cluster has automated backups enabled with adequate retention
+  CKV_AWS_362: "medium", // recoverability — Neptune DB clusters should be configured to copy tags to snapshots
+  CKV_AWS_363: "low", // hygiene — Ensure Lambda Runtime is not deprecated
+  CKV_AWS_364: "medium", // default — Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount
+  CKV_AWS_365: "high", // encryption-in-transit — Ensure SES Configuration Set enforces TLS usage
+  CKV_AWS_366: "high", // authentication — Ensure AWS Cognito identity pool does not allow unauthenticated guest access
+  CKV_AWS_367: "high", // encryption-at-rest — Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt model artifacts
+  CKV_AWS_368: "high", // encryption-at-rest — Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt data on attached storage volume
+  CKV_AWS_369: "high", // encryption-at-rest — Ensure Amazon Sagemaker Data Quality Job encrypts all communications between instances used for monitoring jobs
+  CKV_AWS_370: "medium", // default — Ensure Amazon SageMaker model uses network isolation
+  CKV_AWS_371: "high", // known-weakness — Ensure Amazon SageMaker Notebook Instance only allows for IMDSv2
+  CKV_AWS_372: "medium", // default — Ensure Amazon SageMaker Flow Definition uses KMS for output configurations
+  CKV_AWS_373: "low", // customer-managed-key — Ensure Bedrock Agent is encrypted with a CMK
+  CKV_AWS_374: "medium", // default — Ensure AWS CloudFront web distribution has geo restriction enabled
+  CKV_AWS_375: "medium", // default — Ensure AWS S3 bucket does not have global view ACL permissions enabled
+  CKV_AWS_376: "high", // encryption-in-transit — Ensure AWS Elastic Load Balancer listener uses TLS/SSL
+  CKV_AWS_377: "medium", // default — Ensure Route 53 domains have transfer lock protection
+  CKV_AWS_378: "high", // encryption-in-transit — Ensure AWS Load Balancer doesn't use HTTP protocol
+  CKV_AWS_379: "high", // encryption-in-transit — Ensure AWS S3 bucket is configured with secure data transport policy
+  CKV_AWS_380: "high", // encryption-in-transit — Ensure AWS Transfer Server uses latest Security Policy
+  CKV_AWS_381: "low", // customer-managed-key — Make sure that aws_codegurureviewer_repository_association has a CMK
+  CKV_AWS_382: "medium", // egress — Ensure no security groups allow egress from 0.0.0.0:0 to port -1
+  CKV_AWS_383: "medium", // default — Ensure AWS Bedrock agent is associated with Bedrock guardrails
+  CKV_AWS_385: "high", // over-broad-access — Ensure AWS SNS topic policies do not allow cross-account access
+  CKV_AWS_386: "medium", // default — Reduce potential for WhoAMI cloud image name confusion attack
+  CKV_AWS_387: "high", // internet-exposure — Ensure SQS policy does not allow public access through wildcards
+  CKV_AWS_388: "high", // known-weakness — Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability
+  CKV_AWS_389: "high", // internet-exposure — Ensure AWS Auto Scaling group launch configuration doesn't have public IP address assignment enabled
+  CKV_AWS_390: "high", // internet-exposure — Ensure AWS EMR block public access setting is enabled
+  CKV_AWS_391: "high", // internet-exposure — Avoid AWS Redshift cluster with commonly used master username and public access setting enabled
+  CKV_AWS_392: "high", // internet-exposure — Ensure AWS S3 access point block public access setting is enabled
+  CKV_AWS_393: "high", // over-broad-access — Ensure AWS GitHub Actions OIDC authorization policies only allow safe claims and claim order on IAM role
+  CKV_AWS_394: "low", // hygiene — Ensure aws_availability_zones data source pins zone identity so its result set does not silently expand when AWS adds an Availability Zone
+  CKV_AZURE_1: "high", // authentication — Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)
+  CKV_AZURE_2: "high", // trivy AZU-0038 — Ensure Azure managed disk has encryption enabled
+  CKV_AZURE_3: "high", // trivy AZU-0008 — Ensure that 'enable_https_traffic_only' is enabled
+  CKV_AZURE_4: "medium", // audit-logging — Ensure AKS logging to Azure Monitoring is Configured
+  CKV_AZURE_5: "high", // authentication — Ensure RBAC is enabled on AKS clusters
+  CKV_AZURE_6: "medium", // authentication-hardening — Ensure AKS has an API Server Authorized IP Ranges enabled
+  CKV_AZURE_7: "medium", // network-placement — Ensure AKS cluster has Network Policy configured
+  CKV_AZURE_8: "medium", // default — Ensure Kubernetes Dashboard is disabled
+  CKV_AZURE_9: "critical", // trivy AZU-0048 — Ensure that RDP access is restricted from the internet
+  CKV_AZURE_10: "critical", // trivy AZU-0050 — Ensure that SSH access is restricted from the internet
+  CKV_AZURE_11: "high", // trivy AZU-0029 — Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
+  CKV_AZURE_12: "medium", // audit-logging — Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
+  CKV_AZURE_13: "medium", // reviewed: the platform's sign-in layer; the app may authenticate itself — Ensure App Service Authentication is set on Azure App Service
+  CKV_AZURE_14: "high", // encryption-in-transit — Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
+  CKV_AZURE_15: "high", // encryption-in-transit — Ensure web app is using the latest version of TLS encryption
+  CKV_AZURE_16: "medium", // authentication-hardening — Ensure that Register with Azure Active Directory is enabled on App Service
+  CKV_AZURE_17: "medium", // default — Ensure the web app has 'Client Certificates (Incoming client certificates)' set
+  CKV_AZURE_18: "medium", // default — Ensure that 'HTTP Version' is the latest if used to run the web app
+  CKV_AZURE_19: "low", // hygiene — Ensure that standard pricing tier is selected
+  CKV_AZURE_20: "medium", // default — Ensure that security contact 'Phone number' is set
+  CKV_AZURE_21: "medium", // audit-logging — Ensure that 'Send email notification for high severity alerts' is set to 'On'
+  CKV_AZURE_22: "medium", // audit-logging — Ensure that 'Send email notification for high severity alerts' is set to 'On'
+  CKV_AZURE_23: "medium", // audit-logging — Ensure that 'Auditing' is set to 'On' for SQL servers
+  CKV_AZURE_24: "medium", // audit-logging — Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers
+  CKV_AZURE_25: "medium", // audit-logging — Ensure that 'Threat Detection types' is set to 'All'
+  CKV_AZURE_26: "medium", // audit-logging — Ensure that 'Send Alerts To' is enabled for MSSQL servers
+  CKV_AZURE_27: "medium", // default — Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers
+  CKV_AZURE_28: "high", // encryption-in-transit — Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server
+  CKV_AZURE_29: "high", // encryption-in-transit — Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
+  CKV_AZURE_30: "medium", // audit-logging — Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
+  CKV_AZURE_31: "medium", // audit-logging — Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server
+  CKV_AZURE_32: "medium", // default — Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server
+  CKV_AZURE_33: "medium", // audit-logging — Ensure Storage logging is enabled for Queue service for read, write and delete requests
+  CKV_AZURE_34: "high", // trivy AZU-0007 — Ensure that 'Public access level' is set to Private for blob containers
+  CKV_AZURE_35: "medium", // network-placement — Ensure default network access rule for Storage Accounts is set to deny
+  CKV_AZURE_36: "low", // reviewed: trusted Microsoft services is a connectivity setting — Ensure 'Trusted Microsoft Services' is enabled for Storage Account access
+  CKV_AZURE_37: "medium", // audit-logging — Ensure that Activity Log Retention is set 365 days or greater
+  CKV_AZURE_38: "medium", // audit-logging — Ensure audit profile captures all the activities
+  CKV_AZURE_39: "high", // over-broad-access — Ensure that no custom subscription owner roles are created
+  CKV_AZURE_40: "medium", // default — Ensure that the expiration date is set on all keys
+  CKV_AZURE_41: "medium", // default — Ensure that the expiration date is set on all secrets
+  CKV_AZURE_42: "medium", // recoverability — Ensure the key vault is recoverable
+  CKV_AZURE_43: "low", // hygiene — Ensure Storage Accounts adhere to the naming rules
+  CKV_AZURE_44: "critical", // trivy AZU-0011 — Ensure Storage Account is using the latest version of TLS encryption
+  CKV_AZURE_45: "critical", // secret-in-config — Ensure that no sensitive credentials are exposed in VM custom_data
+  CKV_AZURE_47: "high", // encryption-in-transit — Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers
+  CKV_AZURE_48: "high", // internet-exposure — Ensure 'public network access enabled' is set to 'False' for MariaDB servers
+  CKV_AZURE_49: "high", // authentication — Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead)
+  CKV_AZURE_50: "medium", // default — Ensure Virtual Machine Extensions are not Installed
+  CKV_AZURE_52: "high", // encryption-in-transit — Ensure MSSQL is using the latest version of TLS encryption
+  CKV_AZURE_53: "high", // internet-exposure — Ensure 'public network access enabled' is set to 'False' for mySQL servers
+  CKV_AZURE_54: "high", // encryption-in-transit — Ensure MySQL is using the latest version of TLS encryption
+  CKV_AZURE_55: "medium", // audit-logging — Ensure that Azure Defender is set to On for Servers
+  CKV_AZURE_56: "medium", // reviewed: the platform's sign-in layer; the function may authenticate itself — Ensure that function apps enables Authentication
+  CKV_AZURE_57: "medium", // default — Ensure that CORS disallows every resource to access app services
+  CKV_AZURE_58: "medium", // network-placement — Ensure that Azure Synapse workspaces enables managed virtual networks
+  CKV_AZURE_59: "high", // internet-exposure — Ensure that Storage accounts disallow public access
+  CKV_AZURE_61: "medium", // audit-logging — Ensure that Azure Defender is set to On for App Service
+  CKV_AZURE_62: "medium", // default — Ensure function apps are not accessible from all regions
+  CKV_AZURE_63: "medium", // audit-logging — Ensure that App service enables HTTP logging
+  CKV_AZURE_64: "high", // internet-exposure — Ensure that Azure File Sync disables public network access
+  CKV_AZURE_65: "medium", // default — Ensure that App service enables detailed error messages
+  CKV_AZURE_66: "low", // hygiene — Ensure that App service enables failed request tracing
+  CKV_AZURE_67: "medium", // default — Ensure that 'HTTP Version' is the latest, if used to run the Function app
+  CKV_AZURE_68: "high", // internet-exposure — Ensure that PostgreSQL server disables public network access
+  CKV_AZURE_69: "medium", // audit-logging — Ensure that Azure Defender is set to On for Azure SQL database servers
+  CKV_AZURE_70: "high", // encryption-in-transit — Ensure that Function apps is only accessible over HTTPS
+  CKV_AZURE_71: "medium", // authentication-hardening — Ensure that Managed identity provider is enabled for app services
+  CKV_AZURE_72: "medium", // default — Ensure that remote debugging is not enabled for app services
+  CKV_AZURE_73: "high", // encryption-at-rest — Ensure that Automation account variables are encrypted
+  CKV_AZURE_74: "high", // encryption-at-rest — Ensure that Azure Data Explorer (Kusto) uses disk encryption
+  CKV_AZURE_75: "high", // encryption-at-rest — Ensure that Azure Data Explorer uses double encryption
+  CKV_AZURE_76: "high", // encryption-at-rest — Ensure that Azure Batch account uses key vault to encrypt data
+  CKV_AZURE_77: "high", // internet-exposure — Ensure that UDP Services are restricted from the Internet
+  CKV_AZURE_78: "high", // encryption-in-transit — Ensure FTP deployments are disabled
+  CKV_AZURE_79: "medium", // audit-logging — Ensure that Azure Defender is set to On for SQL servers on machines
+  CKV_AZURE_80: "medium", // default — Ensure that 'Net Framework' version is the latest, if used as a part of the web app
+  CKV_AZURE_81: "medium", // default — Ensure that 'PHP version' is the latest, if used to run the web app
+  CKV_AZURE_82: "medium", // default — Ensure that 'Python version' is the latest, if used to run the web app
+  CKV_AZURE_83: "medium", // default — Ensure that 'Java version' is the latest, if used to run the web app
+  CKV_AZURE_84: "medium", // audit-logging — Ensure that Azure Defender is set to On for Storage
+  CKV_AZURE_85: "medium", // audit-logging — Ensure that Azure Defender is set to On for Kubernetes
+  CKV_AZURE_86: "medium", // audit-logging — Ensure that Azure Defender is set to On for Container Registries
+  CKV_AZURE_87: "medium", // audit-logging — Ensure that Azure Defender is set to On for Key Vault
+  CKV_AZURE_88: "medium", // default — Ensure that app services use Azure Files
+  CKV_AZURE_89: "high", // internet-exposure — Ensure that Azure Cache for Redis disables public network access
+  CKV_AZURE_91: "high", // encryption-in-transit — Ensure that only SSL are enabled for Cache for Redis
+  CKV_AZURE_92: "medium", // default — Ensure that Virtual Machines use managed disks
+  CKV_AZURE_93: "low", // customer-managed-key — Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption
+  CKV_AZURE_94: "medium", // recoverability — Ensure that My SQL server enables geo-redundant backups
+  CKV_AZURE_95: "medium", // default — Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets
+  CKV_AZURE_96: "high", // encryption-at-rest — Ensure that MySQL server enables infrastructure encryption
+  CKV_AZURE_97: "high", // encryption-at-rest — Ensure that Virtual machine scale sets have encryption at host enabled
+  CKV_AZURE_98: "medium", // network-placement — Ensure that Azure Container group is deployed into virtual network
+  CKV_AZURE_99: "medium", // default — Ensure Cosmos DB accounts have restricted access
+  CKV_AZURE_100: "low", // customer-managed-key — Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest
+  CKV_AZURE_101: "high", // internet-exposure — Ensure that Azure Cosmos DB disables public network access
+  CKV_AZURE_102: "medium", // recoverability — Ensure that PostgreSQL server enables geo-redundant backups
+  CKV_AZURE_103: "medium", // default — Ensure that Azure Data Factory uses Git repository for source control
+  CKV_AZURE_104: "high", // internet-exposure — Ensure that Azure Data factory public network access is disabled
+  CKV_AZURE_105: "high", // encryption-at-rest — Ensure that Data Lake Store accounts enables encryption
+  CKV_AZURE_106: "high", // internet-exposure — Ensure that Azure Event Grid Domain public network access is disabled
+  CKV_AZURE_107: "medium", // network-placement — Ensure that API management services use virtual networks
+  CKV_AZURE_108: "high", // internet-exposure — Ensure that Azure IoT Hub disables public network access
+  CKV_AZURE_109: "medium", // network-placement — Ensure that key vault allows firewall rules settings
+  CKV_AZURE_110: "medium", // recoverability — Ensure that key vault enables purge protection
+  CKV_AZURE_111: "medium", // recoverability — Ensure that key vault enables soft delete
+  CKV_AZURE_112: "low", // customer-managed-key — Ensure that key vault key is backed by HSM
+  CKV_AZURE_113: "medium", // trivy AZU-0022 — Ensure that SQL server disables public network access
+  CKV_AZURE_114: "medium", // default — Ensure that key vault secrets have "content_type" set
+  CKV_AZURE_115: "medium", // network-placement — Ensure that AKS enables private clusters
+  CKV_AZURE_116: "medium", // default — Ensure that AKS uses Azure Policies Add-on
+  CKV_AZURE_117: "high", // encryption-at-rest — Ensure that AKS uses disk encryption set
+  CKV_AZURE_118: "medium", // default — Ensure that Network Interfaces disable IP forwarding
+  CKV_AZURE_119: "high", // internet-exposure — Ensure that Network Interfaces don't use public IPs
+  CKV_AZURE_120: "medium", // network-placement — Ensure that Application Gateway enables WAF
+  CKV_AZURE_121: "medium", // network-placement — Ensure that Azure Front Door enables WAF
+  CKV_AZURE_122: "medium", // network-placement — Ensure that Application Gateway uses WAF in "Detection" or "Prevention" modes
+  CKV_AZURE_123: "medium", // network-placement — Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes
+  CKV_AZURE_124: "high", // internet-exposure — Ensure that Azure Cognitive Search disables public network access
+  CKV_AZURE_125: "medium", // default — Ensures that Service Fabric use three levels of protection available
+  CKV_AZURE_126: "medium", // authentication-hardening — Ensures that Active Directory is used for authentication for Service Fabric
+  CKV_AZURE_127: "medium", // audit-logging — Ensure that My SQL server enables Threat detection policy
+  CKV_AZURE_128: "medium", // audit-logging — Ensure that PostgreSQL server enables Threat detection policy
+  CKV_AZURE_129: "medium", // recoverability — Ensure that MariaDB server enables geo-redundant backups
+  CKV_AZURE_130: "high", // encryption-at-rest — Ensure that PostgreSQL server enables infrastructure encryption
+  CKV_AZURE_131: "medium", // default — Ensure that 'Security contact emails' is set
+  CKV_AZURE_132: "high", // over-broad-access — Ensure cosmosdb does not allow privileged escalation by restricting management plane changes
+  CKV_AZURE_133: "medium", // audit-logging — Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
+  CKV_AZURE_134: "high", // internet-exposure — Ensure that Cognitive Services accounts disable public network access
+  CKV_AZURE_135: "medium", // audit-logging — Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
+  CKV_AZURE_136: "medium", // recoverability — Ensure that PostgreSQL Flexible server enables geo-redundant backups
+  CKV_AZURE_137: "high", // over-broad-access — Ensure ACR admin account is disabled
+  CKV_AZURE_138: "high", // internet-exposure — Ensures that ACR disables anonymous pulling of images
+  CKV_AZURE_139: "high", // internet-exposure — Ensure ACR set to disable public networking
+  CKV_AZURE_140: "medium", // authentication-hardening — Ensure that Local Authentication is disabled on CosmosDB
+  CKV_AZURE_141: "high", // over-broad-access — Ensure AKS local admin account is disabled
+  CKV_AZURE_142: "medium", // authentication-hardening — Ensure Machine Learning Compute Cluster Local Authentication is disabled
+  CKV_AZURE_143: "high", // internet-exposure — Ensure AKS cluster nodes do not have public IP addresses
+  CKV_AZURE_144: "high", // internet-exposure — Ensure that Public Access is disabled for Machine Learning Workspace
+  CKV_AZURE_145: "high", // encryption-in-transit — Ensure Function app is using the latest version of TLS encryption
+  CKV_AZURE_146: "medium", // audit-logging — Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server
+  CKV_AZURE_147: "high", // encryption-in-transit — Ensure PostgreSQL is using the latest version of TLS encryption
+  CKV_AZURE_148: "high", // encryption-in-transit — Ensure Redis Cache is using the latest version of TLS encryption
+  CKV_AZURE_149: "high", // authentication — Ensure that Virtual machine does not enable password authentication
+  CKV_AZURE_150: "medium", // default — Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0
+  CKV_AZURE_151: "high", // encryption-at-rest — Ensure Windows VM enables encryption
+  CKV_AZURE_152: "medium", // default — Ensure Client Certificates are enforced for API management
+  CKV_AZURE_153: "high", // encryption-in-transit — Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot
+  CKV_AZURE_154: "high", // encryption-in-transit — Ensure the App service slot is using the latest version of TLS encryption
+  CKV_AZURE_155: "medium", // default — Ensure debugging is disabled for the App service slot
+  CKV_AZURE_156: "medium", // audit-logging — Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs
+  CKV_AZURE_157: "medium", // default — Ensure that Synapse workspace has data_exfiltration_protection_enabled
+  CKV_AZURE_158: "medium", // network-placement — Ensure Databricks Workspace data plane to control plane communication happens over private link
+  CKV_AZURE_159: "medium", // audit-logging — Ensure function app builtin logging is enabled
+  CKV_AZURE_160: "high", // internet-exposure — Ensure that HTTP (port 80) access is restricted from the internet
+  CKV_AZURE_161: "high", // encryption-in-transit — Ensures Spring Cloud API Portal is enabled on for HTTPS
+  CKV_AZURE_162: "high", // internet-exposure — Ensures Spring Cloud API Portal Public Access Is Disabled
+  CKV_AZURE_163: "medium", // audit-logging — Enable vulnerability scanning for container images.
+  CKV_AZURE_164: "medium", // default — Ensures that ACR uses signed/trusted images
+  CKV_AZURE_165: "low", // hygiene — Ensure geo-replicated container registries to match multi-region container deployments.
+  CKV_AZURE_166: "medium", // default — Ensure container image quarantine, scan, and mark images verified
+  CKV_AZURE_167: "medium", // recoverability — Ensure a retention policy is set to cleanup untagged manifests.
+  CKV_AZURE_168: "medium", // default — Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods.
+  CKV_AZURE_169: "medium", // default — Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets
+  CKV_AZURE_170: "low", // hygiene — Ensure that AKS use the Paid Sku for its SLA
+  CKV_AZURE_171: "medium", // default — Ensure AKS cluster upgrade channel is chosen
+  CKV_AZURE_172: "medium", // default — Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters
+  CKV_AZURE_173: "high", // encryption-in-transit — Ensure API management uses at least TLS 1.2
+  CKV_AZURE_174: "high", // internet-exposure — Ensure API management public access is disabled
+  CKV_AZURE_175: "low", // hygiene — Ensure Web PubSub uses a SKU with an SLA
+  CKV_AZURE_176: "medium", // authentication-hardening — Ensure Web PubSub uses managed identities to access Azure resources
+  CKV_AZURE_177: "medium", // default — Ensure Windows VM enables automatic updates
+  CKV_AZURE_178: "medium", // default — Ensure linux VM enables SSH with keys for secure communication
+  CKV_AZURE_179: "medium", // default — Ensure VM agent is installed
+  CKV_AZURE_180: "low", // hygiene — Ensure that data explorer uses Sku with an SLA
+  CKV_AZURE_181: "medium", // authentication-hardening — Ensure that data explorer/Kusto uses managed identities to access Azure resources securely.
+  CKV_AZURE_182: "medium", // default — Ensure that VNET has at least 2 connected DNS Endpoints
+  CKV_AZURE_183: "medium", // default — Ensure that VNET uses local DNS addresses
+  CKV_AZURE_184: "medium", // authentication-hardening — Ensure 'local_auth_enabled' is set to 'False'
+  CKV_AZURE_185: "high", // internet-exposure — Ensure 'Public Access' is not Enabled for App configuration
+  CKV_AZURE_186: "high", // encryption-at-rest — Ensure App configuration encryption block is set.
+  CKV_AZURE_187: "medium", // recoverability — Ensure App configuration purge protection is enabled
+  CKV_AZURE_188: "low", // hygiene — Ensure App configuration Sku is standard
+  CKV_AZURE_189: "high", // internet-exposure — Ensure that Azure Key Vault disables public network access
+  CKV_AZURE_190: "high", // internet-exposure — Ensure that Storage blobs restrict public access
+  CKV_AZURE_191: "medium", // authentication-hardening — Ensure that Managed identity provider is enabled for Azure Event Grid Topic
+  CKV_AZURE_192: "medium", // authentication-hardening — Ensure that Azure Event Grid Topic local Authentication is disabled
+  CKV_AZURE_193: "high", // internet-exposure — Ensure public network access is disabled for Azure Event Grid Topic
+  CKV_AZURE_194: "medium", // authentication-hardening — Ensure that Managed identity provider is enabled for Azure Event Grid Domain
+  CKV_AZURE_195: "medium", // authentication-hardening — Ensure that Azure Event Grid Domain local Authentication is disabled
+  CKV_AZURE_196: "low", // hygiene — Ensure that SignalR uses a Paid Sku for its SLA
+  CKV_AZURE_197: "high", // encryption-in-transit — Ensure the Azure CDN disables the HTTP endpoint
+  CKV_AZURE_198: "high", // encryption-in-transit — Ensure the Azure CDN enables the HTTPS endpoint
+  CKV_AZURE_199: "high", // encryption-at-rest — Ensure that Azure Service Bus uses double encryption
+  CKV_AZURE_200: "high", // encryption-in-transit — Ensure the Azure CDN endpoint is using the latest version of TLS encryption
+  CKV_AZURE_201: "low", // customer-managed-key — Ensure that Azure Service Bus uses a customer-managed key to encrypt data
+  CKV_AZURE_202: "medium", // authentication-hardening — Ensure that Managed identity provider is enabled for Azure Service Bus
+  CKV_AZURE_203: "medium", // authentication-hardening — Ensure Azure Service Bus Local Authentication is disabled
+  CKV_AZURE_204: "high", // internet-exposure — Ensure 'public network access enabled' is set to 'False' for Azure Service Bus
+  CKV_AZURE_205: "high", // encryption-in-transit — Ensure Azure Service Bus is using the latest version of TLS encryption
+  CKV_AZURE_206: "low", // hygiene — Ensure that Storage Accounts use replication
+  CKV_AZURE_207: "medium", // authentication-hardening — Ensure Azure Cognitive Search service uses managed identities to access Azure resources
+  CKV_AZURE_208: "low", // hygiene — Ensure that Azure Cognitive Search maintains SLA for index updates
+  CKV_AZURE_209: "low", // hygiene — Ensure that Azure Cognitive Search maintains SLA for search index queries
+  CKV_AZURE_210: "high", // internet-exposure — Ensure Azure Cognitive Search service allowed IPS does not give public Access
+  CKV_AZURE_211: "medium", // default — Ensure App Service plan suitable for production use
+  CKV_AZURE_212: "medium", // default — Ensure App Service has a minimum number of instances for failover
+  CKV_AZURE_213: "low", // not-security — Ensure that App Service configures health check
+  CKV_AZURE_214: "medium", // default — Ensure App Service is set to be always on
+  CKV_AZURE_215: "high", // encryption-in-transit — Ensure API management backend uses https
+  CKV_AZURE_216: "medium", // network-placement — Ensure DenyIntelMode is set to Deny for Azure Firewalls
+  CKV_AZURE_217: "high", // encryption-in-transit — Ensure Azure Application gateways listener that allow connection requests over HTTP
+  CKV_AZURE_218: "high", // encryption-in-transit — Ensure Application Gateway defines secure protocols for in transit communication
+  CKV_AZURE_219: "medium", // network-placement — Ensure Firewall defines a firewall policy
+  CKV_AZURE_220: "medium", // network-placement — Ensure Firewall policy has IDPS mode as deny
+  CKV_AZURE_221: "high", // internet-exposure — Ensure that Azure Function App public network access is disabled
+  CKV_AZURE_222: "high", // internet-exposure — Ensure that Azure Web App public network access is disabled
+  CKV_AZURE_223: "high", // encryption-in-transit — Ensure Event Hub Namespace uses at least TLS 1.2
+  CKV_AZURE_224: "medium", // default — Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity
+  CKV_AZURE_225: "low", // hygiene — Ensure the App Service Plan is zone redundant
+  CKV_AZURE_226: "medium", // default — Ensure ephemeral disks are used for OS disks
+  CKV_AZURE_227: "high", // encryption-at-rest — Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources
+  CKV_AZURE_228: "low", // hygiene — Ensure the Azure Event Hub Namespace is zone redundant
+  CKV_AZURE_229: "low", // hygiene — Ensure the Azure SQL Database Namespace is zone redundant
+  CKV_AZURE_230: "low", // hygiene — Standard Replication should be enabled
+  CKV_AZURE_231: "low", // hygiene — Ensure App Service Environment is zone redundant
+  CKV_AZURE_232: "medium", // default — Ensure that only critical system pods run on system nodes
+  CKV_AZURE_233: "low", // hygiene — Ensure Azure Container Registry (ACR) is zone redundant
+  CKV_AZURE_234: "medium", // audit-logging — Ensure that Azure Defender for cloud is set to On for Resource Manager
+  CKV_AZURE_235: "medium", // default — Ensure that Azure container environment variables are configured with secure values only
+  CKV_AZURE_236: "medium", // authentication-hardening — Ensure that Cognitive Services accounts disable local authentication
+  CKV_AZURE_237: "medium", // default — Ensure dedicated data endpoints are enabled.
+  CKV_AZURE_238: "medium", // authentication-hardening — Ensure that all Azure Cognitive Services accounts are configured with a managed identity
+  CKV_AZURE_239: "medium", // audit-logging — Ensure Azure Synapse Workspace administrator login password is not exposed
+  CKV_AZURE_240: "low", // customer-managed-key — Ensure Azure Synapse Workspace is encrypted with a CMK
+  CKV_AZURE_241: "high", // encryption-at-rest — Ensure Synapse SQL pools are encrypted
+  CKV_AZURE_242: "medium", // default — Ensure isolated compute is enabled for Synapse Spark pools
+  CKV_AZURE_244: "medium", // authentication-hardening — Avoid the use of local users for Azure Storage unless necessary
+  CKV_AZURE_245: "medium", // network-placement — Ensure that Azure Container group is deployed into virtual network
+  CKV_AZURE_246: "medium", // default — Ensure Azure AKS cluster HTTP application routing is disabled
+  CKV_AZURE_247: "medium", // default — Ensure that Azure Cognitive Services account hosted with OpenAI is configured with data loss prevention
+  CKV_AZURE_248: "high", // internet-exposure — Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny'
+  CKV_AZURE_249: "high", // over-broad-access — Ensure Azure GitHub Actions OIDC trust policy is configured securely
+  CKV_AZURE_250: "high", // internet-exposure — Ensure Storage Sync Service is not configured with overly permissive network access
+  CKV_AZURE_251: "high", // internet-exposure — Ensure Azure Virtual Machine disks are configured without public network access
+  CKV_BCW_1: "critical", // secret-in-config — Ensure no hard coded API token exist in the provider
+  CKV_DIO_1: "medium", // recoverability — Ensure the Spaces bucket has versioning enabled
+  CKV_DIO_2: "medium", // default — Ensure the droplet specifies an SSH key
+  CKV_DIO_3: "high", // internet-exposure — Ensure the Spaces bucket is private
+  CKV_DIO_4: "medium", // network-placement — Ensure the firewall ingress is not wide open
+  CKV_GCP_1: "medium", // audit-logging — Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters
+  CKV_GCP_2: "medium", // trivy GCP-0071 — Ensure Google compute firewall ingress does not allow unrestricted ssh access
+  CKV_GCP_3: "high", // trivy GCP-0070 — Ensure Google compute firewall ingress does not allow unrestricted rdp access
+  CKV_GCP_4: "high", // encryption-in-transit — Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
+  CKV_GCP_6: "high", // trivy GCP-0015 — Ensure all Cloud SQL database instance requires all incoming connections to use SSL
+  CKV_GCP_7: "high", // trivy GCP-0062 — Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters
+  CKV_GCP_8: "medium", // audit-logging — Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters
+  CKV_GCP_9: "medium", // default — Ensure 'Automatic node repair' is enabled for Kubernetes Clusters
+  CKV_GCP_10: "medium", // default — Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters
+  CKV_GCP_11: "high", // trivy GCP-0017 — Ensure that Cloud SQL database Instances are not open to the world
+  CKV_GCP_12: "medium", // trivy GCP-0056 — Ensure Network Policy is enabled on Kubernetes Engine Clusters
+  CKV_GCP_13: "high", // authentication — Ensure client certificate authentication to Kubernetes Engine Clusters is disabled
+  CKV_GCP_14: "medium", // recoverability — Ensure all Cloud SQL database instance have backup configuration enabled
+  CKV_GCP_15: "critical", // trivy GCP-0046 — Ensure that BigQuery datasets are not anonymously or publicly accessible
+  CKV_GCP_16: "medium", // default — Ensure that DNSSEC is enabled for Cloud DNS
+  CKV_GCP_17: "medium", // default — Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC
+  CKV_GCP_18: "high", // trivy GCP-0053 — Ensure GKE Control Plane is not public
+  CKV_GCP_20: "high", // trivy GCP-0061 — Ensure master authorized networks is set to enabled in GKE clusters
+  CKV_GCP_21: "low", // hygiene — Ensure Kubernetes Clusters are configured with Labels
+  CKV_GCP_22: "medium", // default — Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image
+  CKV_GCP_23: "medium", // default — Ensure Kubernetes Cluster is created with Alias IP ranges enabled
+  CKV_GCP_24: "medium", // default — Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters
+  CKV_GCP_25: "medium", // trivy GCP-0059 — Ensure Kubernetes Cluster is created with Private cluster enabled
+  CKV_GCP_26: "medium", // audit-logging — Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network
+  CKV_GCP_27: "medium", // default — Ensure that the default network does not exist in a project
+  CKV_GCP_28: "high", // trivy GCP-0001 — Ensure that Cloud Storage bucket is not anonymously or publicly accessible
+  CKV_GCP_29: "medium", // trivy GCP-0002 — Ensure that Cloud Storage buckets have uniform bucket-level access enabled
+  CKV_GCP_30: "critical", // trivy GCP-0044 — Ensure that instances are not configured to use the default service account
+  CKV_GCP_31: "high", // over-broad-access — Ensure that instances are not configured to use the default service account with full access to all Cloud APIs
+  CKV_GCP_32: "medium", // trivy GCP-0030 — Ensure 'Block Project-wide SSH keys' is enabled for VM instances
+  CKV_GCP_33: "medium", // trivy GCP-0042 — Ensure oslogin is enabled for a Project
+  CKV_GCP_34: "medium", // trivy GCP-0036 — Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances)
+  CKV_GCP_35: "medium", // trivy GCP-0032 — Ensure 'Enable connecting to serial ports' is not enabled for VM Instance
+  CKV_GCP_36: "high", // trivy GCP-0043 — Ensure that IP forwarding is not enabled on Instances
+  CKV_GCP_37: "high", // encryption-at-rest — Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_38: "high", // encryption-at-rest — Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_39: "medium", // default — Ensure Compute instances are launched with Shielded VM enabled
+  CKV_GCP_40: "high", // trivy GCP-0031 — Ensure that Compute instances do not have public IP addresses
+  CKV_GCP_41: "high", // authentication — Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
+  CKV_GCP_42: "high", // over-broad-access — Ensure that Service Account has no Admin privileges
+  CKV_GCP_43: "high", // trivy GCP-0065 — Ensure KMS encryption keys are rotated within a period of 90 days
+  CKV_GCP_44: "high", // over-broad-access — Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level
+  CKV_GCP_45: "high", // over-broad-access — Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level
+  CKV_GCP_46: "medium", // default — Ensure Default Service account is not used at a project level
+  CKV_GCP_47: "medium", // default — Ensure default service account is not used at an organization level
+  CKV_GCP_48: "medium", // default — Ensure Default Service account is not used at a folder level
+  CKV_GCP_49: "high", // over-broad-access — Ensure roles do not impersonate or manage Service Accounts used at project level
+  CKV_GCP_50: "medium", // default — Ensure MySQL database 'local_infile' flag is set to 'off'
+  CKV_GCP_51: "medium", // audit-logging — Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on'
+  CKV_GCP_52: "medium", // audit-logging — Ensure PostgreSQL database 'log_connections' flag is set to 'on'
+  CKV_GCP_53: "medium", // audit-logging — Ensure PostgreSQL database 'log_disconnections' flag is set to 'on'
+  CKV_GCP_54: "medium", // audit-logging — Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on'
+  CKV_GCP_55: "medium", // audit-logging — Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value
+  CKV_GCP_56: "medium", // audit-logging — Ensure PostgreSQL database 'log_temp_files flag is set to '0'
+  CKV_GCP_57: "medium", // audit-logging — Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1'
+  CKV_GCP_58: "medium", // default — Ensure SQL database 'cross db ownership chaining' flag is set to 'off'
+  CKV_GCP_59: "medium", // reviewed: a SQL Server hardening flag — Ensure SQL database 'contained database authentication' flag is set to 'off'
+  CKV_GCP_60: "high", // trivy GCP-0017 — Ensure Cloud SQL database does not have public IP
+  CKV_GCP_61: "medium", // audit-logging — Enable VPC Flow Logs and Intranode Visibility
+  CKV_GCP_62: "medium", // audit-logging — Bucket should log access
+  CKV_GCP_63: "medium", // audit-logging — Bucket should not log to itself
+  CKV_GCP_64: "medium", // trivy GCP-0059 — Ensure clusters are created with Private Nodes
+  CKV_GCP_65: "medium", // authentication-hardening — Manage Kubernetes RBAC users with Google Groups for GKE
+  CKV_GCP_66: "medium", // authentication-hardening — Ensure use of Binary Authorization
+  CKV_GCP_68: "medium", // default — Ensure Secure Boot for Shielded GKE Nodes is Enabled
+  CKV_GCP_69: "high", // trivy GCP-0057 — Ensure the GKE Metadata Server is Enabled
+  CKV_GCP_70: "medium", // default — Ensure the GKE Release Channel is set
+  CKV_GCP_71: "high", // trivy GCP-0055 — Ensure Shielded GKE Nodes are Enabled
+  CKV_GCP_72: "medium", // audit-logging — Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled
+  CKV_GCP_73: "medium", // audit-logging — Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
+  CKV_GCP_74: "medium", // network-placement — Ensure that private_ip_google_access is enabled for Subnet
+  CKV_GCP_75: "high", // encryption-in-transit — Ensure Google compute firewall ingress does not allow unrestricted FTP access
+  CKV_GCP_76: "medium", // default — Ensure that Private google access is enabled for IPV6
+  CKV_GCP_77: "high", // encryption-in-transit — Ensure Google compute firewall ingress does not allow on ftp port
+  CKV_GCP_78: "medium", // recoverability — Ensure Cloud storage has versioning enabled
+  CKV_GCP_79: "medium", // default — Ensure SQL database is using latest Major version
+  CKV_GCP_80: "high", // encryption-at-rest — Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_81: "high", // encryption-at-rest — Ensure Big Query Datasets are encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_82: "low", // customer-managed-key — Ensure KMS keys are protected from deletion
+  CKV_GCP_83: "high", // encryption-at-rest — Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_84: "high", // encryption-at-rest — Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_85: "high", // encryption-at-rest — Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_86: "high", // internet-exposure — Ensure Cloud build workers are private
+  CKV_GCP_87: "high", // internet-exposure — Ensure Data fusion instances are private
+  CKV_GCP_88: "medium", // network-placement — Ensure Google compute firewall ingress does not allow unrestricted mysql access
+  CKV_GCP_89: "high", // internet-exposure — Ensure Vertex AI instances are private
+  CKV_GCP_90: "high", // encryption-at-rest — Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_91: "high", // encryption-at-rest — Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_92: "low", // customer-managed-key — Ensure Vertex AI datasets uses a CMK (Customer Managed Key)
+  CKV_GCP_93: "high", // encryption-at-rest — Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK)
+  CKV_GCP_94: "high", // internet-exposure — Ensure Dataflow jobs are private
+  CKV_GCP_95: "high", // authentication — Ensure Memorystore for Redis has AUTH enabled
+  CKV_GCP_96: "low", // customer-managed-key — Ensure Vertex AI Metadata Store uses a CMK (Customer Managed Key)
+  CKV_GCP_97: "high", // encryption-at-rest — Ensure Memorystore for Redis uses intransit encryption
+  CKV_GCP_98: "high", // internet-exposure — Ensure that Dataproc clusters are not anonymously or publicly accessible
+  CKV_GCP_99: "high", // internet-exposure — Ensure that Pub/Sub Topics are not anonymously or publicly accessible
+  CKV_GCP_100: "high", // internet-exposure — Ensure that BigQuery Tables are not anonymously or publicly accessible
+  CKV_GCP_101: "high", // internet-exposure — Ensure that Artifact Registry repositories are not anonymously or publicly accessible
+  CKV_GCP_102: "high", // internet-exposure — Ensure that GCP Cloud Run services are not anonymously or publicly accessible
+  CKV_GCP_103: "high", // internet-exposure — Ensure Dataproc Clusters do not have public IPs
+  CKV_GCP_104: "medium", // audit-logging — Ensure Datafusion has stack driver logging enabled
+  CKV_GCP_105: "medium", // audit-logging — Ensure Datafusion has stack driver monitoring enabled
+  CKV_GCP_106: "medium", // network-placement — Ensure Google compute firewall ingress does not allow unrestricted http port 80 access
+  CKV_GCP_107: "high", // internet-exposure — Cloud functions should not be public
+  CKV_GCP_108: "medium", // audit-logging — Ensure hostnames are logged for GCP PostgreSQL databases
+  CKV_GCP_109: "medium", // audit-logging — Ensure the GCP PostgreSQL database log levels are set to ERROR or lower
+  CKV_GCP_110: "medium", // audit-logging — Ensure pgAudit is enabled for your GCP PostgreSQL database
+  CKV_GCP_111: "medium", // audit-logging — Ensure GCP PostgreSQL logs SQL statements
+  CKV_GCP_112: "high", // internet-exposure — Ensure KMS policy should not allow public access
+  CKV_GCP_113: "high", // internet-exposure — Ensure IAM policy should not define public access
+  CKV_GCP_114: "high", // internet-exposure — Ensure public access prevention is enforced on Cloud Storage bucket
+  CKV_GCP_115: "medium", // default — Ensure basic roles are not used at organization level.
+  CKV_GCP_116: "medium", // default — Ensure basic roles are not used at folder level.
+  CKV_GCP_117: "medium", // default — Ensure basic roles are not used at project level.
+  CKV_GCP_118: "medium", // default — Ensure IAM workload identity pool provider is restricted
+  CKV_GCP_119: "medium", // recoverability — Ensure Spanner Database has deletion protection enabled
+  CKV_GCP_120: "medium", // recoverability — Ensure Spanner Database has drop protection enabled
+  CKV_GCP_121: "medium", // recoverability — Ensure BigQuery tables have deletion protection enabled
+  CKV_GCP_122: "medium", // recoverability — Ensure Big Table Instances have deletion protection enabled
+  CKV_GCP_123: "medium", // default — GKE Don't Use NodePools in the Cluster configuration
+  CKV_GCP_124: "high", // internet-exposure — Ensure GCP Cloud Function is not configured with overly permissive Ingress setting
+  CKV_GCP_125: "high", // over-broad-access — Ensure GCP GitHub Actions OIDC trust policy is configured securely
+  CKV_GCP_126: "medium", // default — Ensure Vertex AI Notebook instances are launched with Shielded VM enabled
+  CKV_GCP_127: "medium", // audit-logging — Ensure Integrity Monitoring for Shielded Vertex AI Notebook Instances is Enabled
+  CKV_GIT_1: "high", // internet-exposure — Ensure GitHub repository is Private
+  CKV_GIT_2: "high", // encryption-in-transit — Ensure GitHub repository webhooks are using HTTPS
+  CKV_GIT_3: "medium", // audit-logging — Ensure GitHub repository has vulnerability alerts enabled
+  CKV_GIT_4: "high", // encryption-at-rest — Ensure GitHub Actions secrets are encrypted
+  CKV_GIT_5: "medium", // default — GitHub pull requests should require at least 2 approvals
+  CKV_GIT_6: "medium", // default — Ensure GitHub branch protection rules requires signed commits
+  CKV_GLB_1: "medium", // default — Ensure at least two approving reviews are required to merge a GitLab MR
+  CKV_GLB_2: "medium", // default — Ensure GitLab branch protection rules does not allow force pushes
+  CKV_GLB_3: "medium", // default — Ensure GitLab prevent secrets is enabled
+  CKV_GLB_4: "medium", // default — Ensure GitLab commits are signed
+  CKV_K8S_1: "high", // over-broad-access — Do not admit containers wishing to share the host process ID namespace
+  CKV_K8S_2: "high", // over-broad-access — Do not admit privileged containers
+  CKV_K8S_3: "high", // over-broad-access — Do not admit containers wishing to share the host IPC namespace
+  CKV_K8S_4: "high", // over-broad-access — Do not admit containers wishing to share the host network namespace
+  CKV_K8S_5: "high", // over-broad-access — Containers should not run with allowPrivilegeEscalation
+  CKV_K8S_6: "medium", // default — Do not admit root containers
+  CKV_K8S_7: "medium", // default — Do not admit containers with the NET_RAW capability
+  CKV_K8S_8: "medium", // default — Liveness Probe Should be Configured
+  CKV_K8S_9: "medium", // default — Readiness Probe Should be Configured
+  CKV_K8S_10: "medium", // default — CPU requests should be set
+  CKV_K8S_11: "medium", // default — CPU Limits should be set
+  CKV_K8S_12: "medium", // default — Memory Limits should be set
+  CKV_K8S_13: "medium", // default — Memory requests should be set
+  CKV_K8S_14: "low", // hygiene — Image Tag should be fixed - not latest or blank
+  CKV_K8S_15: "medium", // default — Image Pull Policy should be Always
+  CKV_K8S_16: "high", // over-broad-access — Do not admit privileged containers
+  CKV_K8S_17: "high", // over-broad-access — Do not admit containers wishing to share the host process ID namespace
+  CKV_K8S_18: "high", // over-broad-access — Do not admit containers wishing to share the host IPC namespace
+  CKV_K8S_19: "high", // over-broad-access — Do not admit containers wishing to share the host network namespace
+  CKV_K8S_20: "high", // over-broad-access — Containers should not run with allowPrivilegeEscalation
+  CKV_K8S_21: "medium", // default — The default namespace should not be used
+  CKV_K8S_22: "medium", // default — Use read-only filesystem for containers where possible
+  CKV_K8S_24: "medium", // default — Do not allow containers with added capability
+  CKV_K8S_25: "medium", // default — Minimize the admission of containers with added capability
+  CKV_K8S_26: "medium", // default — Do not specify hostPort unless absolutely necessary
+  CKV_K8S_27: "high", // over-broad-access — Do not expose the docker daemon socket to containers
+  CKV_K8S_28: "medium", // default — Minimize the admission of containers with the NET_RAW capability
+  CKV_K8S_29: "medium", // default — Apply security context to your pods, deployments and daemon_sets
+  CKV_K8S_30: "medium", // default — Apply security context to your pods and containers
+  CKV_K8S_32: "medium", // default — Ensure default seccomp profile set to docker/default or runtime/default
+  CKV_K8S_34: "medium", // default — Ensure that Tiller (Helm v2) is not deployed
+  CKV_K8S_35: "medium", // default — Prefer using secrets as files over secrets as environment variables
+  CKV_K8S_36: "medium", // default — Minimise the admission of containers with capabilities assigned
+  CKV_K8S_37: "medium", // default — Minimise the admission of containers with capabilities assigned
+  CKV_K8S_39: "high", // over-broad-access — Do not use the CAP_SYS_ADMIN linux capability
+  CKV_K8S_41: "medium", // default — Ensure that default service accounts are not actively used
+  CKV_K8S_42: "medium", // default — Ensure that default service accounts are not actively used
+  CKV_K8S_43: "medium", // default — Image should use digest
+  CKV_K8S_44: "medium", // default — Ensure that the Tiller Service (Helm v2) is deleted
+  CKV_K8S_49: "high", // over-broad-access — Minimize wildcard use in Roles and ClusterRoles
+  CKV_K8S_159: "high", // over-broad-access — Do not admit privileged containers
+  CKV_LIN_1: "critical", // secret-in-config — Ensure no hard coded Linode tokens exist in provider
+  CKV_LIN_2: "medium", // reviewed: key-based access is the hardening; its absence is not an exposure — Ensure SSH key set in authorized_keys
+  CKV_LIN_3: "medium", // default — Ensure email is set
+  CKV_LIN_4: "medium", // default — Ensure username is set
+  CKV_LIN_5: "medium", // network-placement — Ensure Inbound Firewall Policy is not set to ACCEPT
+  CKV_LIN_6: "medium", // egress — Ensure Outbound Firewall Policy is not set to ACCEPT
+  CKV_NCP_1: "low", // not-security — Ensure HTTP HTTPS Target group defines Healthcheck
+  CKV_NCP_2: "low", // hygiene — Ensure every access control groups rule has a description
+  CKV_NCP_3: "medium", // egress — Ensure no security group rules allow outbound traffic to 0.0.0.0/0
+  CKV_NCP_4: "high", // internet-exposure — Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22
+  CKV_NCP_5: "high", // internet-exposure — Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389
+  CKV_NCP_6: "high", // encryption-at-rest — Ensure Server instance is encrypted.
+  CKV_NCP_7: "high", // encryption-at-rest — Ensure Basic Block storage is encrypted.
+  CKV_NCP_8: "high", // internet-exposure — Ensure no NACL allow inbound from 0.0.0.0:0 to port 20
+  CKV_NCP_9: "high", // internet-exposure — Ensure no NACL allow inbound from 0.0.0.0:0 to port 21
+  CKV_NCP_10: "high", // internet-exposure — Ensure no NACL allow inbound from 0.0.0.0:0 to port 22
+  CKV_NCP_11: "high", // internet-exposure — Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389
+  CKV_NCP_12: "high", // internet-exposure — An inbound Network ACL rule should not allow ALL ports.
+  CKV_NCP_13: "high", // encryption-in-transit — Ensure LB Listener uses only secure protocols
+  CKV_NCP_14: "high", // encryption-at-rest — Ensure NAS is securely encrypted
+  CKV_NCP_15: "high", // encryption-in-transit — Ensure Load Balancer Target Group is not using HTTP
+  CKV_NCP_16: "high", // internet-exposure — Ensure Load Balancer isn't exposed to the internet
+  CKV_NCP_18: "low", // not-security — Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks.
+  CKV_NCP_19: "high", // internet-exposure — Ensure Naver Kubernetes Service public endpoint disabled
+  CKV_NCP_20: "medium", // egress — Ensure Routing Table associated with Web tier subnet have the default route (0.0.0.0/0) defined to allow connectivity
+  CKV_NCP_22: "medium", // audit-logging — Ensure NKS control plane logging enabled for all log types
+  CKV_NCP_23: "high", // internet-exposure — Ensure Server instance should not have public IP.
+  CKV_NCP_24: "high", // encryption-in-transit — Ensure Load Balancer Listener Using HTTPS
+  CKV_NCP_25: "high", // internet-exposure — Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80
+  CKV_NCP_26: "medium", // default — Ensure Access Control Group has Access Control Group Rule attached
+  CKV_OCI_1: "critical", // secret-in-config — Ensure no hard coded OCI private key in provider
+  CKV_OCI_2: "medium", // recoverability — Ensure OCI Block Storage Block Volume has backup enabled
+  CKV_OCI_3: "low", // customer-managed-key — OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK)
+  CKV_OCI_4: "high", // encryption-at-rest — Ensure OCI Compute Instance boot volume has in-transit data encryption enabled
+  CKV_OCI_5: "high", // known-weakness — Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled
+  CKV_OCI_6: "medium", // audit-logging — Ensure OCI Compute Instance has monitoring enabled
+  CKV_OCI_7: "medium", // default — Ensure OCI Object Storage bucket can emit object events
+  CKV_OCI_8: "medium", // recoverability — Ensure OCI Object Storage has versioning enabled
+  CKV_OCI_9: "low", // customer-managed-key — Ensure OCI Object Storage is encrypted with Customer Managed Key
+  CKV_OCI_10: "high", // internet-exposure — Ensure OCI Object Storage is not Public
+  CKV_OCI_11: "medium", // password-policy — OCI IAM password policy - must contain lower case
+  CKV_OCI_12: "medium", // password-policy — OCI IAM password policy - must contain Numeric characters
+  CKV_OCI_13: "medium", // password-policy — OCI IAM password policy - must contain Special characters
+  CKV_OCI_14: "medium", // password-policy — OCI IAM password policy - must contain Uppercase characters
+  CKV_OCI_15: "low", // customer-managed-key — Ensure OCI File System is Encrypted with a customer Managed Key
+  CKV_OCI_16: "medium", // default — Ensure VCN has an inbound security list
+  CKV_OCI_17: "medium", // default — Ensure VCN inbound security lists are stateless
+  CKV_OCI_18: "medium", // password-policy — OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters
+  CKV_OCI_19: "high", // internet-exposure — Ensure no security list allow ingress from 0.0.0.0:0 to port 22.
+  CKV_OCI_20: "high", // internet-exposure — Ensure no security list allow ingress from 0.0.0.0:0 to port 3389.
+  CKV_OCI_21: "medium", // network-placement — Ensure security group has stateless ingress security rules
+  CKV_OCI_22: "high", // internet-exposure — Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22
+  CKV_OCI_23: "high", // internet-exposure — Ensure OCI Data Catalog is configured without overly permissive network access
+  CKV_OPENSTACK_1: "critical", // secret-in-config — Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider
+  CKV_OPENSTACK_2: "high", // internet-exposure — Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp)
+  CKV_OPENSTACK_3: "high", // internet-exposure — Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp)
+  CKV_OPENSTACK_4: "high", // authentication — Ensure that instance does not use basic credentials
+  CKV_OPENSTACK_5: "medium", // network-placement — Ensure firewall rule set a destination IP
+  CKV_PAN_1: "critical", // secret-in-config — Ensure no hard coded PAN-OS credentials exist in provider
+  CKV_PAN_2: "high", // encryption-in-transit — Ensure plain-text management HTTP is not enabled for an Interface Management Profile
+  CKV_PAN_3: "high", // encryption-in-transit — Ensure plain-text management Telnet is not enabled for an Interface Management Profile
+  CKV_PAN_4: "medium", // default — Ensure DSRI is not enabled within security policies
+  CKV_PAN_5: "medium", // default — Ensure security rules do not have 'applications' set to 'any'
+  CKV_PAN_6: "medium", // default — Ensure security rules do not have 'services' set to 'any'
+  CKV_PAN_7: "medium", // default — Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any'
+  CKV_PAN_8: "low", // hygiene — Ensure description is populated within security policies
+  CKV_PAN_9: "medium", // audit-logging — Ensure a Log Forwarding Profile is selected for each security policy rule
+  CKV_PAN_10: "medium", // audit-logging — Ensure logging at session end is enabled within security policies
+  CKV_PAN_11: "high", // encryption-at-rest — Ensure IPsec profiles do not specify use of insecure encryption algorithms
+  CKV_PAN_12: "high", // authentication — Ensure IPsec profiles do not specify use of insecure authentication algorithms
+  CKV_PAN_13: "high", // encryption-in-transit — Ensure IPsec profiles do not specify use of insecure protocols
+  CKV_PAN_14: "medium", // default — Ensure a Zone Protection Profile is defined within Security Zones
+  CKV_PAN_15: "medium", // default — Ensure an Include ACL is defined for a Zone when User-ID is enabled
+  CKV_TC_1: "high", // encryption-at-rest — Ensure Tencent Cloud CBS is encrypted
+  CKV_TC_2: "high", // internet-exposure — Ensure Tencent Cloud CVM instance does not allocate a public IP
+  CKV_TC_3: "medium", // audit-logging — Ensure Tencent Cloud CVM monitor service is enabled
+  CKV_TC_4: "medium", // network-placement — Ensure Tencent Cloud CVM instances do not use the default security group
+  CKV_TC_5: "medium", // network-placement — Ensure Tencent Cloud CVM instances do not use the default VPC
+  CKV_TC_6: "medium", // audit-logging — Ensure Tencent Cloud TKE clusters enable log agent
+  CKV_TC_7: "high", // internet-exposure — Ensure Tencent Cloud TKE cluster is not assigned a public IP address
+  CKV_TC_8: "medium", // network-placement — Ensure Tencent Cloud VPC security group rules do not accept all traffic
+  CKV_TC_9: "high", // internet-exposure — Ensure Tencent Cloud mysql instances do not enable access from public networks
+  CKV_TC_10: "medium", // default — Ensure Tencent Cloud MySQL instances intranet ports are not set to the default 3306
+  CKV_TC_11: "medium", // audit-logging — Ensure Tencent Cloud CLB has a logging ID and topic
+  CKV_TC_12: "high", // encryption-at-rest — Ensure Tencent Cloud CLBs use modern, encrypted protocols
+  CKV_TC_13: "critical", // secret-in-config — Ensure Tencent Cloud CVM user data does not contain sensitive information
+  CKV_TC_14: "medium", // audit-logging — Ensure Tencent Cloud VPC flow logs are enabled
+  CKV_TF_1: "medium", // default — Ensure Terraform module sources use a commit hash
+  CKV_TF_2: "low", // hygiene — Ensure Terraform module sources use a tag with a version number
+  CKV_YC_1: "medium", // network-placement — Ensure security group is assigned to database cluster.
+  CKV_YC_2: "high", // internet-exposure — Ensure compute instance does not have public IP.
+  CKV_YC_3: "high", // encryption-at-rest — Ensure storage bucket is encrypted.
+  CKV_YC_4: "medium", // default — Ensure compute instance does not have serial console enabled.
+  CKV_YC_5: "high", // internet-exposure — Ensure Kubernetes cluster does not have public IP address.
+  CKV_YC_6: "high", // internet-exposure — Ensure Kubernetes cluster node group does not have public IP addresses.
+  CKV_YC_7: "medium", // default — Ensure Kubernetes cluster auto-upgrade is enabled.
+  CKV_YC_8: "medium", // default — Ensure Kubernetes node group auto-upgrade is enabled.
+  CKV_YC_9: "medium", // default — Ensure KMS symmetric key is rotated.
+  CKV_YC_10: "low", // customer-managed-key — Ensure etcd database is encrypted with KMS key.
+  CKV_YC_11: "medium", // network-placement — Ensure security group is assigned to network interface.
+  CKV_YC_12: "high", // internet-exposure — Ensure public IP is not assigned to database cluster.
+  CKV_YC_13: "high", // over-broad-access — Ensure cloud member does not have elevated access.
+  CKV_YC_14: "medium", // network-placement — Ensure security group is assigned to Kubernetes cluster.
+  CKV_YC_15: "medium", // network-placement — Ensure security group is assigned to Kubernetes node group.
+  CKV_YC_16: "medium", // network-placement — Ensure network policy is assigned to Kubernetes cluster.
+  CKV_YC_17: "high", // internet-exposure — Ensure storage bucket does not have public access permissions.
+  CKV_YC_18: "high", // internet-exposure — Ensure compute instance group does not have public IP.
+  CKV_YC_19: "medium", // network-placement — Ensure security group does not contain allow-all rules.
+  CKV_YC_20: "medium", // network-placement — Ensure security group rule is not allow-all.
+  CKV_YC_21: "high", // over-broad-access — Ensure organization member does not have elevated access.
+  CKV_YC_22: "medium", // network-placement — Ensure compute instance group has security group assigned.
+  CKV_YC_23: "high", // over-broad-access — Ensure folder member does not have elevated access.
+  CKV_YC_24: "medium", // default — Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible.
+  CKV2_ADO_1: "medium", // default — Ensure at least two approving reviews for PRs
+  CKV2_AWS_1: "medium", // network-placement — Ensure that all NACL are attached to subnets
+  CKV2_AWS_2: "high", // encryption-at-rest — Ensure that only encrypted EBS volumes are attached to EC2 instances
+  CKV2_AWS_3: "medium", // audit-logging — Ensure GuardDuty is enabled to specific org/region
+  CKV2_AWS_4: "medium", // audit-logging — Ensure API Gateway stage have logging level defined as appropriate
+  CKV2_AWS_5: "medium", // network-placement — Ensure that Security Groups are attached to another resource
+  CKV2_AWS_6: "high", // trivy AWS-0086 — Ensure that S3 bucket has a Public Access block
+  CKV2_AWS_7: "high", // internet-exposure — Ensure that Amazon EMR clusters' security groups are not open to the world
+  CKV2_AWS_8: "medium", // recoverability — Ensure that RDS clusters has backup plan of AWS Backup
+  CKV2_AWS_9: "medium", // recoverability — Ensure that EBS are added in the backup plans of AWS Backup
+  CKV2_AWS_10: "medium", // audit-logging — Ensure CloudTrail trails are integrated with CloudWatch Logs
+  CKV2_AWS_11: "medium", // audit-logging — Ensure VPC flow logging is enabled in all VPCs
+  CKV2_AWS_12: "medium", // network-placement — Ensure the default security group of every VPC restricts all traffic
+  CKV2_AWS_14: "medium", // default — Ensure that IAM groups includes at least one IAM user
+  CKV2_AWS_15: "low", // not-security — Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks.
+  CKV2_AWS_16: "medium", // default — Ensure that Auto Scaling is enabled on your DynamoDB tables
+  CKV2_AWS_18: "medium", // recoverability — Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup
+  CKV2_AWS_19: "medium", // network-placement — Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances
+  CKV2_AWS_20: "high", // encryption-in-transit — Ensure that ALB redirects HTTP requests into HTTPS ones
+  CKV2_AWS_21: "medium", // default — Ensure that all IAM users are members of at least one IAM group.
+  CKV2_AWS_22: "medium", // default — Ensure an IAM User does not have access to the console
+  CKV2_AWS_23: "medium", // default — Route53 A Record has Attached Resource
+  CKV2_AWS_27: "medium", // audit-logging — Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled
+  CKV2_AWS_28: "medium", // network-placement — Ensure public facing ALB are protected by WAF
+  CKV2_AWS_29: "medium", // network-placement — Ensure public API gateway are protected by WAF
+  CKV2_AWS_30: "medium", // audit-logging — Ensure Postgres RDS as aws_db_instance has Query Logging enabled
+  CKV2_AWS_31: "medium", // audit-logging — Ensure WAF2 has a Logging Configuration
+  CKV2_AWS_32: "medium", // default — Ensure CloudFront distribution has a response headers policy attached
+  CKV2_AWS_33: "medium", // network-placement — Ensure AppSync is protected by WAF
+  CKV2_AWS_34: "high", // encryption-at-rest — AWS SSM Parameter should be Encrypted
+  CKV2_AWS_35: "medium", // egress — AWS NAT Gateways should be utilized for the default route
+  CKV2_AWS_36: "critical", // secret-in-config — Ensure terraform is not sending SSM secrets to untrusted domains over HTTP
+  CKV2_AWS_37: "medium", // default — Ensure CodeCommit associates an approval rule
+  CKV2_AWS_38: "medium", // default — Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones
+  CKV2_AWS_39: "medium", // audit-logging — Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones
+  CKV2_AWS_40: "high", // over-broad-access — Ensure AWS IAM policy does not allow full IAM privileges
+  CKV2_AWS_41: "medium", // default — Ensure an IAM role is attached to EC2 instance
+  CKV2_AWS_42: "low", // reviewed: a custom certificate is a branding choice; traffic is encrypted either way — Ensure AWS CloudFront distribution uses custom SSL certificate
+  CKV2_AWS_43: "high", // authentication — Ensure S3 Bucket does not allow access to all Authenticated users
+  CKV2_AWS_44: "high", // internet-exposure — Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic
+  CKV2_AWS_45: "medium", // default — Ensure AWS Config recorder is enabled to record all supported resources
+  CKV2_AWS_46: "medium", // default — Ensure AWS CloudFront Distribution with S3 have Origin Access set to enabled
+  CKV2_AWS_47: "medium", // audit-logging — Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
+  CKV2_AWS_48: "medium", // default — Ensure AWS Config must record all possible resources
+  CKV2_AWS_49: "high", // encryption-in-transit — Ensure AWS Database Migration Service endpoints have SSL configured
+  CKV2_AWS_50: "low", // hygiene — Ensure AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to enabled
+  CKV2_AWS_51: "medium", // reviewed: mutual TLS on top of whatever authorization the API has — Ensure AWS API Gateway endpoints uses client certificate authentication
+  CKV2_AWS_52: "medium", // default — Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled
+  CKV2_AWS_53: "medium", // default — Ensure AWS API gateway request is validated
+  CKV2_AWS_54: "high", // encryption-in-transit — Ensure AWS CloudFront distribution is using secure SSL protocols for HTTPS communication
+  CKV2_AWS_55: "medium", // default — Ensure AWS EMR cluster is configured with security configuration
+  CKV2_AWS_56: "high", // over-broad-access — Ensure AWS Managed IAMFullAccess IAM policy is not used.
+  CKV2_AWS_57: "medium", // default — Ensure Secrets Manager secrets should have automatic rotation enabled
+  CKV2_AWS_58: "medium", // recoverability — Ensure AWS Neptune cluster deletion protection is enabled
+  CKV2_AWS_59: "medium", // default — Ensure ElasticSearch/OpenSearch has dedicated master node enabled
+  CKV2_AWS_60: "medium", // recoverability — Ensure RDS instance with copy tags to snapshots is enabled
+  CKV2_AWS_61: "medium", // recoverability — Ensure that an S3 bucket has a lifecycle configuration
+  CKV2_AWS_62: "medium", // audit-logging — Ensure S3 buckets should have event notifications enabled
+  CKV2_AWS_63: "medium", // audit-logging — Ensure Network firewall has logging configuration defined
+  CKV2_AWS_64: "low", // customer-managed-key — Ensure KMS key Policy is defined
+  CKV2_AWS_65: "medium", // default — Ensure access control lists for S3 buckets are disabled
+  CKV2_AWS_66: "high", // internet-exposure — Ensure MWAA environment is not publicly accessible
+  CKV2_AWS_68: "high", // internet-exposure — Ensure SageMaker notebook instance IAM policy is not overly permissive
+  CKV2_AWS_69: "high", // encryption-in-transit — Ensure AWS RDS database instance configured with encryption in transit
+  CKV2_AWS_70: "high", // authentication — Ensure API gateway method has authorization or API key set
+  CKV2_AWS_71: "low", // reviewed: a wildcard certificate widens what one key covers, not what is exposed — Ensure AWS ACM Certificate domain name does not include wildcards
+  CKV2_AWS_72: "high", // encryption-in-transit — Ensure AWS CloudFront origin protocol policy enforces HTTPS-only
+  CKV2_AWS_73: "low", // customer-managed-key — Ensure AWS SQS uses CMK not AWS default keys for encryption
+  CKV2_AWS_74: "high", // encryption-in-transit — Ensure AWS Load Balancers use strong ciphers
+  CKV2_AWS_75: "medium", // default — Ensure no open CORS policy
+  CKV2_AWS_76: "medium", // audit-logging — Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
+  CKV2_AWS_77: "medium", // audit-logging — Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
+  CKV2_AWS_78: "medium", // audit-logging — Ensure AWS AppSync attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
+  CKV2_AZURE_1: "low", // customer-managed-key — Ensure storage for critical data are encrypted with Customer Managed Key
+  CKV2_AZURE_2: "medium", // audit-logging — Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account
+  CKV2_AZURE_3: "medium", // default — Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server
+  CKV2_AZURE_4: "medium", // default — Ensure Azure SQL server ADS VA Send scan reports to is configured
+  CKV2_AZURE_5: "medium", // audit-logging — Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server
+  CKV2_AZURE_6: "high", // internet-exposure — Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
+  CKV2_AZURE_7: "medium", // authentication-hardening — Ensure that Azure Active Directory Admin is configured
+  CKV2_AZURE_8: "high", // internet-exposure — Ensure the storage container storing the activity logs is not publicly accessible
+  CKV2_AZURE_9: "medium", // default — Ensure Virtual Machines are utilizing Managed Disks
+  CKV2_AZURE_10: "medium", // default — Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines
+  CKV2_AZURE_11: "low", // customer-managed-key — Ensure that Azure Data Explorer encryption at rest uses a customer-managed key
+  CKV2_AZURE_12: "medium", // recoverability — Ensure that virtual machines are backed up using Azure Backup
+  CKV2_AZURE_13: "medium", // default — Ensure that sql servers enables data security policy
+  CKV2_AZURE_14: "high", // encryption-at-rest — Ensure that Unattached disks are encrypted
+  CKV2_AZURE_15: "low", // customer-managed-key — Ensure that Azure data factories are encrypted with a customer-managed key
+  CKV2_AZURE_16: "low", // customer-managed-key — Ensure that MySQL server enables customer-managed key for encryption
+  CKV2_AZURE_17: "low", // customer-managed-key — Ensure that PostgreSQL server enables customer-managed key for encryption
+  CKV2_AZURE_19: "medium", // network-placement — Ensure that Azure Synapse workspaces have no IP firewall rules attached
+  CKV2_AZURE_20: "medium", // audit-logging — Ensure Storage logging is enabled for Table service for read requests
+  CKV2_AZURE_21: "medium", // audit-logging — Ensure Storage logging is enabled for Blob service for read requests
+  CKV2_AZURE_22: "low", // customer-managed-key — Ensure that Cognitive Services enables customer-managed key for encryption
+  CKV2_AZURE_23: "medium", // network-placement — Ensure Azure spring cloud is configured with Virtual network (Vnet)
+  CKV2_AZURE_24: "high", // internet-exposure — Ensure Azure automation account does NOT have overly permissive network access
+  CKV2_AZURE_25: "high", // encryption-at-rest — Ensure Azure SQL database Transparent Data Encryption (TDE) is enabled
+  CKV2_AZURE_26: "high", // internet-exposure — Ensure Azure PostgreSQL Flexible server is not configured with overly permissive network access
+  CKV2_AZURE_27: "medium", // authentication-hardening — Ensure Azure AD authentication is enabled for Azure SQL (MSSQL)
+  CKV2_AZURE_28: "medium", // authentication-hardening — Ensure Container Instance is configured with managed identity
+  CKV2_AZURE_29: "medium", // default — Ensure AKS cluster has Azure CNI networking enabled
+  CKV2_AZURE_30: "high", // encryption-in-transit — Ensure Azure Container Registry (ACR) has HTTPS enabled for webhook
+  CKV2_AZURE_31: "medium", // network-placement — Ensure VNET subnet is configured with a Network Security Group (NSG)
+  CKV2_AZURE_32: "medium", // network-placement — Ensure private endpoint is configured to key vault
+  CKV2_AZURE_33: "medium", // network-placement — Ensure storage account is configured with private endpoint
+  CKV2_AZURE_34: "high", // internet-exposure — Ensure Azure SQL server firewall is not overly permissive
+  CKV2_AZURE_35: "medium", // authentication-hardening — Ensure Azure recovery services vault is configured with managed identity
+  CKV2_AZURE_36: "medium", // authentication-hardening — Ensure Azure automation account is configured with managed identity
+  CKV2_AZURE_37: "high", // encryption-in-transit — Ensure Azure MariaDB server is using latest TLS (1.2)
+  CKV2_AZURE_38: "medium", // recoverability — Ensure soft-delete is enabled on Azure storage account
+  CKV2_AZURE_39: "high", // internet-exposure — Ensure Azure VM is not configured with public IP and serial console access
+  CKV2_AZURE_40: "medium", // authentication-hardening — Ensure storage account is not configured with Shared Key authorization
+  CKV2_AZURE_41: "medium", // default — Ensure storage account is configured with SAS expiration policy
+  CKV2_AZURE_42: "medium", // network-placement — Ensure Azure PostgreSQL server is configured with private endpoint
+  CKV2_AZURE_43: "medium", // network-placement — Ensure Azure MariaDB server is configured with private endpoint
+  CKV2_AZURE_44: "medium", // network-placement — Ensure Azure MySQL server is configured with private endpoint
+  CKV2_AZURE_45: "medium", // network-placement — Ensure Microsoft SQL server is configured with private endpoint
+  CKV2_AZURE_46: "medium", // audit-logging — Ensure that Azure Synapse Workspace vulnerability assessment is enabled
+  CKV2_AZURE_47: "high", // internet-exposure — Ensure storage account is configured without blob anonymous access
+  CKV2_AZURE_48: "low", // customer-managed-key — Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption
+  CKV2_AZURE_49: "high", // internet-exposure — Ensure that Azure Machine learning workspace is not configured with overly permissive network access
+  CKV2_AZURE_50: "high", // internet-exposure — Ensure Azure Storage Account storing Machine Learning workspace high business impact data is not publicly accessible
+  CKV2_AZURE_51: "medium", // audit-logging — Ensure Synapse SQL Pool has a security alert policy
+  CKV2_AZURE_52: "medium", // audit-logging — Ensure Synapse SQL Pool has vulnerability assessment attached
+  CKV2_AZURE_53: "medium", // audit-logging — Ensure Azure Synapse Workspace has extended audit logs
+  CKV2_AZURE_54: "medium", // audit-logging — Ensure log monitoring is enabled for Synapse SQL Pool
+  CKV2_AZURE_55: "high", // encryption-in-transit — Ensure Azure Spring Cloud app end-to-end TLS is enabled
+  CKV2_AZURE_56: "medium", // network-placement — Ensure Azure MySQL Flexible Server is configured with private endpoint
+  CKV2_AZURE_57: "medium", // network-placement — Ensure PostgreSQL Flexible Server is configured with private endpoint
+  CKV2_GCP_1: "medium", // default — Ensure GKE clusters are not running using the Compute Engine default service account
+  CKV2_GCP_2: "medium", // default — Ensure legacy networks do not exist for a project
+  CKV2_GCP_3: "medium", // default — Ensure that there are only GCP-managed service account keys for each service account
+  CKV2_GCP_4: "medium", // audit-logging — Ensure that retention policies on log buckets are configured using Bucket Lock
+  CKV2_GCP_5: "medium", // audit-logging — Ensure that Cloud Audit Logging is configured properly across all services and all users from a project
+  CKV2_GCP_6: "high", // internet-exposure — Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible
+  CKV2_GCP_7: "high", // over-broad-access — Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges
+  CKV2_GCP_8: "high", // internet-exposure — Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible
+  CKV2_GCP_9: "high", // internet-exposure — Ensure that Container Registry repositories are not anonymously or publicly accessible
+  CKV2_GCP_10: "high", // authentication — Ensure GCP Cloud Function HTTP trigger is secured
+  CKV2_GCP_11: "medium", // audit-logging — Ensure GCP GCR Container Vulnerability Scanning is enabled
+  CKV2_GCP_12: "critical", // trivy GCP-0027 — Ensure GCP compute firewall ingress does not allow unrestricted access to all ports
+  CKV2_GCP_13: "medium", // audit-logging — Ensure PostgreSQL database flag 'log_duration' is set to 'on'
+  CKV2_GCP_14: "medium", // audit-logging — Ensure PostgreSQL database flag 'log_executor_stats' is set to 'off'
+  CKV2_GCP_15: "medium", // audit-logging — Ensure PostgreSQL database flag 'log_parser_stats' is set to 'off'
+  CKV2_GCP_16: "medium", // audit-logging — Ensure PostgreSQL database flag 'log_planner_stats' is set to 'off'
+  CKV2_GCP_17: "medium", // audit-logging — Ensure PostgreSQL database flag 'log_statement_stats' is set to 'off'
+  CKV2_GCP_18: "medium", // network-placement — Ensure GCP network defines a firewall and does not use the default firewall
+  CKV2_GCP_19: "medium", // default — Ensure GCP Kubernetes engine clusters have 'alpha cluster' feature disabled
+  CKV2_GCP_20: "medium", // recoverability — Ensure MySQL DB instance has point-in-time recovery backup configured
+  CKV2_GCP_21: "low", // customer-managed-key — Ensure Vertex AI instance disks are encrypted with a Customer Managed Key (CMK)
+  CKV2_GCP_22: "low", // customer-managed-key — Ensure Document AI Processors are encrypted with a Customer Managed Key (CMK)
+  CKV2_GCP_23: "low", // customer-managed-key — Ensure Document AI Warehouse Location is configured to use a Customer Managed Key (CMK)
+  CKV2_GCP_24: "low", // customer-managed-key — Ensure Vertex AI endpoint uses a Customer Managed Key (CMK)
+  CKV2_GCP_25: "low", // customer-managed-key — Ensure Vertex AI featurestore uses a Customer Managed Key (CMK)
+  CKV2_GCP_26: "low", // customer-managed-key — Ensure Vertex AI tensorboard uses a Customer Managed Key (CMK)
+  CKV2_GCP_27: "low", // customer-managed-key — Ensure Vertex AI workbench instance disks are encrypted with a Customer Managed Key (CMK)
+  CKV2_GCP_28: "high", // internet-exposure — Ensure Vertex AI workbench instances are private
+  CKV2_GCP_29: "medium", // audit-logging — Ensure logging is enabled for Dialogflow agents
+  CKV2_GCP_30: "medium", // audit-logging — Ensure logging is enabled for Dialogflow CX agents
+  CKV2_GCP_31: "medium", // audit-logging — Ensure logging is enabled for Dialogflow CX webhooks
+  CKV2_GCP_32: "high", // internet-exposure — Ensure TPU v2 is private
+  CKV2_GCP_33: "high", // internet-exposure — Ensure Vertex AI endpoint is private
+  CKV2_GCP_34: "high", // internet-exposure — Ensure Vertex AI index endpoint is private
+  CKV2_GCP_35: "low", // customer-managed-key — Ensure Vertex AI runtime is encrypted with a Customer Managed Key (CMK)
+  CKV2_GCP_36: "high", // internet-exposure — Ensure Vertex AI runtime is private
+  CKV2_GCP_37: "high", // encryption-in-transit — Ensure GCP compute regional forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme
+  CKV2_GCP_38: "high", // encryption-in-transit — Ensure GCP compute global forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme
+  CKV2_GIT_1: "medium", // default — Ensure each Repository has branch protection associated
+  CKV2_IBM_1: "high", // internet-exposure — Ensure load balancer for VPC is private (disable public access)
+  CKV2_IBM_2: "medium", // network-placement — Ensure VPC classic access is disabled
+  CKV2_IBM_3: "medium", // default — Ensure API key creation is restricted in account settings
+  CKV2_IBM_4: "high", // authentication — Ensure Multi-Factor Authentication (MFA) is enabled at the account level
+  CKV2_IBM_5: "medium", // default — Ensure Service ID creation is restricted in account settings
+  CKV2_IBM_7: "high", // internet-exposure — Ensure Kubernetes clusters are accessible by using private endpoint and NOT public endpoint
+  CKV2_OCI_1: "medium", // default — Ensure administrator users are not associated with API keys
+  CKV2_OCI_2: "high", // internet-exposure — Ensure NSG does not allow all traffic on RDP port (3389)
+  CKV2_OCI_3: "medium", // default — Ensure Kubernetes engine cluster is configured with NSG(s)
+  CKV2_OCI_4: "medium", // default — Ensure File Storage File System access is restricted to root users
+  CKV2_OCI_5: "high", // encryption-at-rest — Ensure Kubernetes Engine Cluster boot volume is configured with in-transit data encryption
+  CKV2_OCI_6: "medium", // default — Ensure Kubernetes Engine Cluster pod security policy is enforced
+};