tf-eu-guard — Compliance Audit Report

NIS2 (Directive 2022/2555, Art. 21) & GDPR (Reg. 2016/679, Art. 32 & 44)

Target: examples/vulnerable-awsGenerated: 2026-08-30 16:53 UTC

Scope & limitations. This report lists only Checkov control failures that map to a NIS2 or GDPR article. It is an evidence aid for an auditor, not a certification. An article not listed here was not exercised by a failing check — that is not evidence of compliance.

Executive summary

This scan surfaced 52 compliance findings across 5 file(s). Each finding is a Checkov control failure mapped to one or more NIS2 / GDPR articles. The table below counts, per framework, the distinct articles with at least one open finding and the total findings citing that framework.

Framework	Articles with open findings	Total findings
NIS2	5	45
GDPR	4	32

NIS2 controls

NIS2 Art. 21(2)(b) — Incident handling↑ top

OPEN — 9 finding(s)

Severity	Resource	Location	Failed control
MEDIUM	`aws_vpc.main`	`/network.tf:2-11`	`CKV2_AWS_11` Ensure VPC flow logging is enabled in all VPCs
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV2_AWS_30` Ensure Postgres RDS as aws_db_instance has Query Logging enabled
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_118` Ensure that enhanced monitoring is enabled for Amazon RDS instances
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_129` Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled
LOW	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_353` Ensure that RDS instances have performance insights enabled
LOW	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV2_AWS_62` Ensure S3 buckets should have event notifications enabled
LOW	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV2_AWS_62` Ensure S3 buckets should have event notifications enabled
MEDIUM	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV_AWS_18` Ensure the S3 bucket has access logging enabled
MEDIUM	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV_AWS_18` Ensure the S3 bucket has access logging enabled

Mapping rationale: docs/nis2-mapping.md

NIS2 Art. 21(2)(c) — Business continuity, backup management and disaster recovery↑ top

OPEN — 10 finding(s)

Severity	Resource	Location	Failed control
LOW	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV2_AWS_60` Ensure RDS instance with copy tags to snapshots is enabled
HIGH	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_133` Ensure that RDS instances has backup policy
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_157` Ensure that RDS instances have Multi-AZ enabled
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_293` Ensure that AWS database instances have deletion protection enabled
LOW	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV2_AWS_61` Ensure that an S3 bucket has a lifecycle configuration
LOW	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV2_AWS_61` Ensure that an S3 bucket has a lifecycle configuration
MEDIUM	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV_AWS_144` Ensure that S3 bucket has cross-region replication enabled
MEDIUM	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV_AWS_144` Ensure that S3 bucket has cross-region replication enabled
MEDIUM	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV_AWS_21` Ensure all data stored in the S3 bucket have versioning enabled
MEDIUM	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV_AWS_21` Ensure all data stored in the S3 bucket have versioning enabled

Mapping rationale: docs/nis2-mapping.md

NIS2 Art. 21(2)(e) — Security in network and information systems acquisition, development and maintenance↑ top

OPEN — 2 finding(s)

Severity	Resource	Location	Failed control
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_226` Ensure DB instance gets all minor upgrades automatically
CRITICAL	`aws_db_instance.main`	`/rds.tf:2-30`	`EUGUARD_NIS2_001` Ensure secrets are not hardcoded in Terraform (use variables/Secrets Manager)

Mapping rationale: docs/nis2-mapping.md

NIS2 Art. 21(2)(h) — Policies and procedures on the use of cryptography and encryption↑ top

OPEN — 3 finding(s)

Severity	Resource	Location	Failed control
HIGH	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_16` Ensure all data stored in the RDS is securely encrypted at rest
HIGH	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV_AWS_145` Ensure that S3 buckets are encrypted with KMS by default
HIGH	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV_AWS_145` Ensure that S3 buckets are encrypted with KMS by default

Mapping rationale: docs/nis2-mapping.md

NIS2 Art. 21(2)(i) — Human resources security, access control policies and asset management↑ top

OPEN — 21 finding(s)

Severity	Resource	Location	Failed control
HIGH	`aws_iam_user.app_user`	`/iam.tf:2-8`	`CKV_AWS_273` Ensure access is controlled through SSO and not AWS IAM defined users
CRITICAL	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_287` Ensure IAM policies does not allow credentials exposure
CRITICAL	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_288` Ensure IAM policies does not allow data exfiltration
CRITICAL	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_289` Ensure IAM policies does not allow permissions management / resource exposure without constraints
CRITICAL	`aws_iam_role_policy.app_role_policy`	`/iam.tf:53-67`	`CKV_AWS_289` Ensure IAM policies does not allow permissions management / resource exposure without constraints
HIGH	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_290` Ensure IAM policies does not allow write access without constraints
HIGH	`aws_iam_role_policy.app_role_policy`	`/iam.tf:53-67`	`CKV_AWS_290` Ensure IAM policies does not allow write access without constraints
HIGH	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_355` Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions
HIGH	`aws_iam_role_policy.app_role_policy`	`/iam.tf:53-67`	`CKV_AWS_355` Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions
MEDIUM	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_40` Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)
MEDIUM	`aws_vpc.main`	`/network.tf:2-11`	`CKV2_AWS_12` Ensure the default security group of every VPC restricts all traffic
LOW	`aws_security_group.web`	`/network.tf:61-93`	`CKV2_AWS_5` Ensure that Security Groups are attached to another resource
MEDIUM	`aws_subnet.public_a`	`/network.tf:14-24`	`CKV_AWS_130` Ensure VPC subnets do not assign public IP by default
MEDIUM	`aws_subnet.public_b`	`/network.tf:26-36`	`CKV_AWS_130` Ensure VPC subnets do not assign public IP by default
LOW	`aws_security_group.rds`	`/network.tf:96-119`	`CKV_AWS_23` Ensure every security group and rule has a description
HIGH	`aws_security_group.web`	`/network.tf:61-93`	`CKV_AWS_24` Ensure no security groups allow ingress from 0.0.0.0:0 to port 22
MEDIUM	`aws_security_group.web`	`/network.tf:61-93`	`CKV_AWS_260` Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
MEDIUM	`aws_security_group.web`	`/network.tf:61-93`	`CKV_AWS_382` Ensure no security groups allow egress from 0.0.0.0:0 to port -1
MEDIUM	`aws_security_group.rds`	`/network.tf:96-119`	`CKV_AWS_382` Ensure no security groups allow egress from 0.0.0.0:0 to port -1
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_161` Ensure RDS database has IAM authentication enabled
CRITICAL	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_17` Ensure all data stored in RDS is not publicly accessible

Mapping rationale: docs/nis2-mapping.md

GDPR controls

GDPR Art. 32(1)(a) — Pseudonymisation and encryption of personal data↑ top

OPEN — 3 finding(s)

Severity	Resource	Location	Failed control
HIGH	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_16` Ensure all data stored in the RDS is securely encrypted at rest
HIGH	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV_AWS_145` Ensure that S3 buckets are encrypted with KMS by default
HIGH	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV_AWS_145` Ensure that S3 buckets are encrypted with KMS by default

Mapping rationale: docs/gdpr-mapping.md

GDPR Art. 32(1)(b) — Confidentiality, integrity, availability and resilience of processing systems↑ top

OPEN — 21 finding(s)

Severity	Resource	Location	Failed control
CRITICAL	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_287` Ensure IAM policies does not allow credentials exposure
CRITICAL	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_288` Ensure IAM policies does not allow data exfiltration
CRITICAL	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_289` Ensure IAM policies does not allow permissions management / resource exposure without constraints
CRITICAL	`aws_iam_role_policy.app_role_policy`	`/iam.tf:53-67`	`CKV_AWS_289` Ensure IAM policies does not allow permissions management / resource exposure without constraints
HIGH	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_290` Ensure IAM policies does not allow write access without constraints
HIGH	`aws_iam_role_policy.app_role_policy`	`/iam.tf:53-67`	`CKV_AWS_290` Ensure IAM policies does not allow write access without constraints
HIGH	`aws_iam_user_policy.app_user_policy`	`/iam.tf:11-29`	`CKV_AWS_355` Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions
HIGH	`aws_iam_role_policy.app_role_policy`	`/iam.tf:53-67`	`CKV_AWS_355` Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions
MEDIUM	`aws_subnet.public_a`	`/network.tf:14-24`	`CKV_AWS_130` Ensure VPC subnets do not assign public IP by default
MEDIUM	`aws_subnet.public_b`	`/network.tf:26-36`	`CKV_AWS_130` Ensure VPC subnets do not assign public IP by default
HIGH	`aws_security_group.web`	`/network.tf:61-93`	`CKV_AWS_24` Ensure no security groups allow ingress from 0.0.0.0:0 to port 22
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV2_AWS_30` Ensure Postgres RDS as aws_db_instance has Query Logging enabled
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_161` Ensure RDS database has IAM authentication enabled
CRITICAL	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_17` Ensure all data stored in RDS is not publicly accessible
CRITICAL	`aws_db_instance.main`	`/rds.tf:2-30`	`EUGUARD_NIS2_001` Ensure secrets are not hardcoded in Terraform (use variables/Secrets Manager)
HIGH	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV2_AWS_6` Ensure that S3 bucket has a Public Access block
HIGH	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV2_AWS_6` Ensure that S3 bucket has a Public Access block
HIGH	`aws_s3_bucket_public_access_block.data`	`/s3.tf:12-19`	`CKV_AWS_53` Ensure S3 bucket has block public ACLS enabled
HIGH	`aws_s3_bucket_public_access_block.data`	`/s3.tf:12-19`	`CKV_AWS_54` Ensure S3 bucket has block public policy enabled
HIGH	`aws_s3_bucket_public_access_block.data`	`/s3.tf:12-19`	`CKV_AWS_55` Ensure S3 bucket has ignore public ACLs enabled
HIGH	`aws_s3_bucket_public_access_block.data`	`/s3.tf:12-19`	`CKV_AWS_56` Ensure S3 bucket has 'restrict_public_buckets' enabled

Mapping rationale: docs/gdpr-mapping.md

GDPR Art. 32(1)(c) — Ability to restore availability and access to personal data in a timely manner↑ top

OPEN — 7 finding(s)

Severity	Resource	Location	Failed control
HIGH	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_133` Ensure that RDS instances has backup policy
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_157` Ensure that RDS instances have Multi-AZ enabled
MEDIUM	`aws_db_instance.main`	`/rds.tf:2-30`	`CKV_AWS_293` Ensure that AWS database instances have deletion protection enabled
MEDIUM	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV_AWS_144` Ensure that S3 bucket has cross-region replication enabled
MEDIUM	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV_AWS_144` Ensure that S3 bucket has cross-region replication enabled
MEDIUM	`aws_s3_bucket.data`	`/s3.tf:2-9`	`CKV_AWS_21` Ensure all data stored in the S3 bucket have versioning enabled
MEDIUM	`aws_s3_bucket.logs`	`/s3.tf:22-28`	`CKV_AWS_21` Ensure all data stored in the S3 bucket have versioning enabled

Mapping rationale: docs/gdpr-mapping.md

GDPR Art. 44 — General principle for transfers of personal data to third countries↑ top

OPEN — 1 finding(s)

Severity	Resource	Location	Failed control
HIGH	`aws.default`	`/main.tf:11-13`	`EUGUARD_GDPR_001` Ensure the AWS provider region is in the EU (GDPR data residency, Art. 44-49)

Mapping rationale: docs/gdpr-mapping.md