Checks

Avoid using 'RUN' with 'sudo' commands, as it can lead to unpredictable behavior.

When a COPY command has more than two arguments, the last one should end with a slash.

Different FROMs can't have the same alias defined.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Avoid using both 'wget' and 'curl' since these tools have the same effect.

You should use 'yum clean all' after using a 'yum install' command to clean package cached data and reduce image size.

There can only be one CMD instruction in a Dockerfile. If you list more than one CMD then only the last CMD will take effect.

The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.

Cached package data should be cleaned after installation to reduce image size.

The layer and image size should be reduced by deleting unneeded caches after running zypper.

'apt-get' calls should use the flag '-y' to avoid manual user input.

MAINTAINER has been deprecated since Docker 1.13.0.

Providing more than one HEALTHCHECK instruction per stage is confusing and error-prone.

You should use 'apk add' with '--no-cache' to clean package cached data and reduce image size.

You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

Cached package data should be cleaned after installation to reduce image size.

'apt-get' install should use '--no-install-recommends' to minimize image size.

WORKDIR should not be mounted on system directories to avoid container breakouts

Passing secrets via build-args or envs or copying secret files can leak them out

Amazon DynamoDB Accelerator (DAX) clusters are evaluated for server-side encryption at rest. The finding indicates whether the cluster's on-disk cache, configuration, and logs are encrypted using service-managed keys.

DAX clusters have endpoint encryption set to TLS, enforcing encryption in transit for client connections to the cluster

Amazon DynamoDB Accelerator (DAX) cluster node placement across Availability Zones is evaluated. Clusters with nodes in more than one AZ within the Region are recognized as multi-AZ; clusters whose nodes reside in a single AZ are recognized as single-AZ.

DynamoDB tables use automatic capacity scaling via on-demand mode or PROVISIONED mode with auto scaling enabled for both read and write capacity units.

Provisioned tables are evaluated for scaling on both dimensions.

DynamoDB tables are evaluated for resource-based policies that permit cross-account or public principals.

Tables without a resource policy, or with policies restricted to the same account, are identified as isolated configurations.