# Finding-rule inventory for the pinned ScoutSuite (see requirements.lock).
#
# One finding-rule filename per line; '#' starts a comment. This is the offline
# source of truth the curated gcp-cis.json baseline is validated against in CI,
# so the wrapper can be checked without installing GPL ScoutSuite.
#
# Regenerate against the actually-pinned ScoutSuite (run inside an env with the
# '[scoutsuite]' extra installed):
#
#     presidio-scout-validate --regenerate --source installed
#
# 'presidio-scout-validate --source installed' flags any drift between this
# inventory and the installed ScoutSuite.

cloudstorage-bucket-no-public-access-prevention.json
cloudstorage-uniform-bucket-level-access-disabled.json
cloudstorage-bucket-no-versioning.json
cloudstorage-bucket-no-logging.json
cloudsql-instances-public-ips.json
cloudsql-instance-ssl-not-required.json
cloudsql-instance-backups-disabled.json
cloudsql-instance-is-open-to-the-world.json
computeengine-instance-public-ip-adresses.json
computeengine-instance-default-service-account.json
computeengine-instance-full-api-access.json
computeengine-instance-os-login-disabled.json
computeengine-instance-connecting-serial-ports-enabled.json
computeengine-instance-ip-forwarding-enabled.json
computeengine-instance-shielded-vm-disabled.json
computeengine-firewall-rule-opens-sensitive-port-to-all.json
computeengine-firewall-rule-opens-all-ports-to-all.json
computeengine-firewall-default-rule-in-use.json
computeengine-vpc-flow-logs-disabled.json
kms-cryptokeys-anonymously-publicly-accessible.json
kms-encryption-keys-not-rotated.json
iam-primitive-role-in-use.json
iam-sa-has-admin-privileges.json
iam-service-account-with-user-managed-keys.json
iam-lack-of-service-account-key-rotation.json
kubernetesengine-cluster-logging-disabled.json
kubernetesengine-legacy-abac-enabled.json
