Skip to main content
A cloud misconfiguration found in production is a fix in two places: the live resource, and the infrastructure as code (IaC) that will recreate it on the next apply. Amnify checks your IaC as well, and an agent links what it finds there to the resource it produces.

​
What we check

Resources open to the whole internet, unrestricted ingress rules, public IP assignment where it is not required, and management ports reachable from anywhere.
Wildcard permissions, roles that can escalate their own privileges, trust policies that accept any principal, and long lived credentials where a short lived one would do.
Encryption at rest and in transit disabled or defaulted, missing key management, public read or write on storage, and unversioned or undeletable data stores.
Audit logging disabled, log retention below policy, and control plane events not captured.
Credentials, keys and connection strings written into IaC files or default variable values.
Deletion protection off, backups disabled, and public snapshots or images.

​
Clustered with the live resource

When the same problem exists in both your IaC and the deployed resource, Amnify puts the two findings in one cluster with a single remediation. This is the difference between fixing a symptom and fixing a cause. A remediation that only closes the live resource leaves the IaC to recreate it.

​
Tracked across scans

An IaC finding is identified by the repository, the file path, the check and the resource, so it persists across scans and resolves when the code is corrected.

​
Where results appear

IaC findings appear in Findings under their own type, and on Home as their own posture count. When a change to your IaC introduces one, it is also raised inline on the pull request. See Pull request review.