import type { AWSServiceCheckFunction } from '../../../types/analysis.types'; /** * checkKey -> open-package ruleId. Every entry replaces the native check of * the same checkKey; the registry's checkKey->ruleId stamping stays valid * because the adapter stamps the identical ruleId on each finding. */ export declare const OPEN_RULE_DISPATCH: { readonly acmValidation: "acm-certificate-email-validation"; readonly apiGatewayDefaultEndpoint: "apigateway-default-endpoint-enabled"; readonly apiGatewayMethodAuth: "api-gateway-method-auth-missing"; readonly apiGatewayThrottling: "apigateway-throttling-missing"; readonly appSyncAuth: "appsync-api-key-auth"; readonly appSyncLogging: "appsync-logging-disabled"; readonly appSyncWaf: "appsync-waf-missing"; readonly autoScalingGroupHealthCheck: "autoscaling-group-no-elb-healthcheck"; readonly autoScalingLaunchConfigPublicIp: "autoscaling-launch-config-public-ip"; readonly backupPlans: "backup-plan-misconfigured"; readonly backupVault: "backup-vault-hardening"; readonly cloudFrontHttpsOnly: "cloudfront-https-only"; readonly cloudFrontLogging: "cloudfront-logging-disabled"; readonly cloudFrontTls: "cloudfront-tls-outdated"; readonly cloudFrontWafAssociation: "cloudfront-waf-missing"; readonly cloudWatchAlarms: "cloudwatch-alarm-actions-missing"; readonly cloudWatchEncryption: "cloudwatch-logs-encryption-disabled"; readonly cognitoAdvancedSecurity: "cognito-advanced-security-disabled"; readonly cognitoMfa: "cognito-mfa-disabled"; readonly dynamoDBAutoScaling: "dynamodb-autoscaling-missing"; readonly dynamoDBDeletionProtection: "dynamodb-deletion-protection-disabled"; readonly dynamoDBEncryption: "dynamodb-encryption-aws-owned-key"; readonly dynamoDBPitr: "dynamodb-pitr-disabled"; readonly dynamoDBStreams: "dynamodb-streams-disabled"; readonly ec2Imdsv2: "ec2-imdsv2-not-enforced"; readonly ec2InstanceType: "ec2-instance-type-outdated"; readonly ec2PublicIp: "ec2-instance-public-ip"; readonly ec2SubnetAutoPublicIp: "ec2-subnet-auto-public-ip"; readonly ecrImmutableTags: "ecr-mutable-tags"; readonly ecrLifecycle: "ecr-lifecycle-policy-missing"; readonly ecrScanning: "ecr-scan-on-push-disabled"; readonly ecsDeploymentCircuitBreaker: "ecs-deployment-circuit-breaker-disabled"; readonly ecsLogging: "ecs-logging-disabled"; readonly ecsMutableImageTag: "ecs-task-definition-mutable-image-tag"; readonly ecsPrivilegedContainer: "ecs-container-privileged"; readonly ecsResources: "ecs-resources-missing"; readonly ecsSecrets: "ecs-secrets-plaintext"; readonly ecsServiceConnectLogs: "ecs-service-connect-access-logs-missing"; readonly efsEncryption: "efs-encryption-disabled"; readonly eksEncryption: "eks-secrets-encryption-disabled"; readonly elastiCacheAuth: "elasticache-auth-token-missing"; readonly elastiCacheEncryption: "elasticache-encryption-disabled"; readonly elastiCacheFailover: "elasticache-failover-disabled"; readonly elbDeletionProtection: "elb-deletion-protection-disabled"; readonly elbLogging: "elb-logging-disabled"; readonly elbSecurityPolicy: "elb-security-policy-outdated"; readonly eventBusPolicy: "eventbridge-bus-policy-wildcard-principal"; readonly glueConnections: "glue-connection-network-isolation"; readonly glueEncryption: "glue-job-encryption-missing"; readonly iamCrossAccountTrust: "iam-cross-account-trust"; readonly iamPermissionBoundary: "iam-permission-boundary-missing"; readonly iamUserPolicies: "iam-user-direct-policies"; readonly kinesisEncryption: "kinesis-encryption-disabled"; readonly kinesisRetention: "kinesis-retention-minimum"; readonly kmsKeyPolicySelfLockout: "kms-key-policy-self-lockout"; readonly kmsKeys: "kms-key-policy-public"; readonly lambdaDeadLetterQueue: "lambda-dlq-missing"; readonly lambdaEnvironmentVariables: "lambda-env-sensitive-data"; readonly lambdaMemory: "lambda-memory-optimization"; readonly lambdaReservedConcurrency: "lambda-reserved-concurrency-missing"; readonly lambdaRuntime: "lambda-runtime-deprecated"; readonly lambdaTracing: "lambda-tracing-disabled"; readonly lambdaUrlAuth: "lambda-url-auth-none"; readonly lambdaVpcNatWarning: "lambda-vpc-nat-cost"; readonly mskAuth: "msk-client-authentication-missing"; readonly mskLogging: "msk-broker-logging-disabled"; readonly natGatewayUsage: "nat-gateway-usage"; readonly openSearchAccessControl: "opensearch-access-control-weak"; readonly openSearchEncryption: "opensearch-encryption-disabled"; readonly openSearchLogging: "opensearch-logging-disabled"; readonly rdsBackupRetention: "rds-backup-retention-low"; readonly rdsDeletionProtection: "rds-deletion-protection-disabled"; readonly rdsEncryption: "rds-encryption-disabled"; readonly rdsEnhancedMonitoring: "rds-enhanced-monitoring-disabled"; readonly rdsLogging: "rds-logging-disabled"; readonly rdsManagedSecretCmk: "rds-managed-secret-without-cmk"; readonly rdsMultiAZ: "rds-multi-az-gp2-storage"; readonly rdsPublicAccess: "rds-publicly-accessible"; readonly redshiftEncryption: "redshift-encryption-disabled"; readonly redshiftLogging: "redshift-audit-logging-disabled"; readonly redshiftPublicAccess: "redshift-publicly-accessible"; readonly route53Dnssec: "route53-dnssec-disabled"; readonly route53HealthChecks: "route53-health-check-suboptimal"; readonly route53QueryLogging: "route53-query-logging-disabled"; readonly s3BucketLogging: "s3-bucket-access-logging-disabled"; readonly s3BucketPolicySelfLockout: "s3-bucket-policy-self-lockout"; readonly s3BucketPolicySsl: "s3-bucket-policy-non-ssl"; readonly s3BucketVersioning: "s3-bucket-versioning-disabled"; readonly s3IntelligentTiering: "s3-intelligent-tiering"; readonly s3LifecyclePolicy: "s3-lifecycle-policy-missing"; readonly s3Replication: "s3-replication-missing"; readonly secretsManager: "secrets-manager-secret-public"; readonly sns: "sns-encryption-disabled"; readonly snsTopicPolicySelfLockout: "sns-topic-policy-self-lockout"; readonly sqs: "sqs-encryption-disabled"; readonly sqsDeadLetterQueue: "sqs-queue-no-dlq"; readonly sqsQueuePolicySelfLockout: "sqs-queue-policy-self-lockout"; readonly stepFunctions: "stepfunctions-logging-disabled"; readonly vpcDefaultSecurityGroup: "vpc-default-security-group-rules-present"; readonly vpcFlowLogs: "vpc-flow-logs-missing"; readonly wafLogging: "waf-logging-disabled"; readonly cloudWatchLogRetention: "cloudwatch-logs-retention-missing"; readonly cognitoPasswordPolicy: "cognito-password-policy-weak"; readonly ebsVolumes: readonly ["ebs-volume-unencrypted", "ebs-volume-gp2-storage"]; readonly eksLogging: "eks-control-plane-logging-disabled"; readonly eksPublicEndpoint: readonly ["eks-public-endpoint-unrestricted", "eks-private-endpoint-access-disabled"]; readonly elbHttpsListeners: "elb-https-listeners-missing"; readonly eventBridgeRules: readonly ["eventbridge-rule-no-targets", "eventbridge-rule-disabled"]; readonly iamPolicies: "iam-policies-overly-permissive"; readonly lambdaPermission: readonly ["lambda-permission-public", "lambda-permission-service-unrestricted", "lambda-permission-scoped-wildcard"]; readonly mskEncryption: readonly ["msk-encryption-weak", "msk-data-volume-cmk-missing"]; readonly s3Buckets: readonly ["s3-bucket-public-access", "s3-bucket-encryption-aws-managed"]; readonly securityGroups: readonly ["security-group-unrestricted-ingress", "security-group-unrestricted-egress", "security-group-no-rules"]; readonly wafWebAcl: "waf-webacl-misconfigured"; }; /** Wrap one or more open-package rules as a CLI service-check function. */ export declare const fromOpenRules: (...ruleIds: string[]) => AWSServiceCheckFunction; /** All dispatched open-rule checks, ready to spread over the factory map. */ export declare const createOpenRuleChecks: () => Record;