# Control Reference

> Auto-generated from the built-in control catalog.
> Do not edit manually. Run: `go run ./internal/tools/gencontroldocs`

**Total controls:** 3554
**Pack hash:** `f752bcd49b1c16c95339cd9053356d1842de91ae55f64a1cc5dcdb2664008785`

The full per-control detail is split by service so every page renders on
GitHub. Pick a service below.

## Summary

| Severity | Count |
|----------|-------|
| critical | 379 |
| high | 1517 |
| info | 19 |
| low | 280 |
| medium | 1359 |

| Domain | Count |
|--------|-------|
| access | 9 |
| audit | 103 |
| availability | 1 |
| capacity | 3 |
| compute | 1 |
| config | 2 |
| detection | 162 |
| encryption | 137 |
| exposure | 1546 |
| governance | 711 |
| hygiene | 21 |
| identity | 698 |
| lifecycle | 32 |
| network | 66 |
| resilience | 50 |
| secrets | 4 |
| storage | 8 |

## Controls by service

| Service | Controls |
|---------|----------|
| [ACCESSANALYZER](reference/accessanalyzer.md) | 1 |
| [ACCOUNT](reference/account.md) | 6 |
| [ACM](reference/acm.md) | 11 |
| [ACMPCA](reference/acmpca.md) | 4 |
| [AD](reference/ad.md) | 40 |
| [AMPLIFY](reference/amplify.md) | 2 |
| [APIGATEWAY](reference/apigateway.md) | 105 |
| [APIGW2](reference/apigw2.md) | 2 |
| [APPFLOW](reference/appflow.md) | 1 |
| [APPRUNNER](reference/apprunner.md) | 6 |
| [APPSTREAM](reference/appstream.md) | 3 |
| [APPSYNC](reference/appsync.md) | 2 |
| [ATHENA](reference/athena.md) | 6 |
| [AUDITMANAGER](reference/auditmanager.md) | 2 |
| [AUTOSCALING](reference/autoscaling.md) | 3 |
| [AZURE](reference/azure.md) | 141 |
| [BACKUP](reference/backup.md) | 14 |
| [BATCH](reference/batch.md) | 5 |
| [BEANSTALK](reference/beanstalk.md) | 5 |
| [BEDROCK](reference/bedrock.md) | 62 |
| [CFN](reference/cfn.md) | 1 |
| [CISCO](reference/cisco.md) | 30 |
| [CLOUD9](reference/cloud9.md) | 4 |
| [CLOUDFLARE](reference/cloudflare.md) | 29 |
| [CLOUDFORMATION](reference/cloudformation.md) | 12 |
| [CLOUDFRONT](reference/cloudfront.md) | 72 |
| [CLOUDTRAIL](reference/cloudtrail.md) | 66 |
| [CLOUDWATCH](reference/cloudwatch.md) | 68 |
| [CODEARTIFACT](reference/codeartifact.md) | 5 |
| [CODEBUILD](reference/codebuild.md) | 13 |
| [CODECOMMIT](reference/codecommit.md) | 2 |
| [CODEPIPELINE](reference/codepipeline.md) | 6 |
| [COGNITO](reference/cognito.md) | 114 |
| [COMPLIANCE](reference/compliance.md) | 1 |
| [COMPREHEND](reference/comprehend.md) | 4 |
| [CONFIG](reference/config.md) | 53 |
| [DATACLASS](reference/dataclass.md) | 5 |
| [DATASYNC](reference/datasync.md) | 2 |
| [DAX](reference/dax.md) | 3 |
| [DETECTIVE](reference/detective.md) | 2 |
| [DIRECTORYSERVICE](reference/directoryservice.md) | 2 |
| [DMS](reference/dms.md) | 10 |
| [DNS](reference/dns.md) | 3 |
| [DOCUMENTDB](reference/documentdb.md) | 19 |
| [DYNAMODB](reference/dynamodb.md) | 39 |
| [EBS](reference/ebs.md) | 3 |
| [EC2](reference/ec2.md) | 118 |
| [ECR](reference/ecr.md) | 13 |
| [ECS](reference/ecs.md) | 61 |
| [EFS](reference/efs.md) | 15 |
| [EKS](reference/eks.md) | 123 |
| [ELASTICACHE](reference/elasticache.md) | 15 |
| [ELB](reference/elb.md) | 80 |
| [EMR](reference/emr.md) | 10 |
| [EVENTBRIDGE](reference/eventbridge.md) | 97 |
| [EVS](reference/evs.md) | 1 |
| [EXPOSURE](reference/exposure.md) | 11 |
| [FIREHOSE](reference/firehose.md) | 5 |
| [FMS](reference/fms.md) | 4 |
| [FSX](reference/fsx.md) | 4 |
| [GCP](reference/gcp.md) | 72 |
| [GCS](reference/gcs.md) | 7 |
| [GHOST](reference/ghost.md) | 2 |
| [GITHUB](reference/github.md) | 22 |
| [GLACIER](reference/glacier.md) | 3 |
| [GLOBALACCELERATOR](reference/globalaccelerator.md) | 2 |
| [GLUE](reference/glue.md) | 19 |
| [GRAFANA](reference/grafana.md) | 2 |
| [GUARDDUTY](reference/guardduty.md) | 21 |
| [GUARDRAIL](reference/guardrail.md) | 1 |
| [IAM](reference/iam.md) | 349 |
| [INSPECTOR](reference/inspector.md) | 5 |
| [IOT](reference/iot.md) | 9 |
| [K8S](reference/k8s.md) | 68 |
| [KENDRA](reference/kendra.md) | 1 |
| [KEYSPACES](reference/keyspaces.md) | 5 |
| [KINESIS](reference/kinesis.md) | 7 |
| [KMS](reference/kms.md) | 51 |
| [LAKEFORMATION](reference/lakeformation.md) | 4 |
| [LAMBDA](reference/lambda.md) | 94 |
| [LIFECYCLE](reference/lifecycle.md) | 1 |
| [LIGHTSAIL](reference/lightsail.md) | 11 |
| [M365](reference/m365.md) | 73 |
| [MACIE](reference/macie.md) | 5 |
| [MARKETPLACE](reference/marketplace.md) | 2 |
| [MEDIASTORE](reference/mediastore.md) | 2 |
| [MEMORYDB](reference/memorydb.md) | 6 |
| [META](reference/meta.md) | 1 |
| [MODEL](reference/model.md) | 2 |
| [MQ](reference/mq.md) | 8 |
| [MSK](reference/msk.md) | 14 |
| [MWAA](reference/mwaa.md) | 4 |
| [NEPTUNE](reference/neptune.md) | 21 |
| [NETFIREWALL](reference/netfirewall.md) | 16 |
| [NLB](reference/nlb.md) | 2 |
| [OPENSEARCH](reference/opensearch.md) | 133 |
| [ORG](reference/org.md) | 66 |
| [QBUSINESS](reference/qbusiness.md) | 1 |
| [QLDB](reference/qldb.md) | 3 |
| [QUICKSIGHT](reference/quicksight.md) | 2 |
| [RAM](reference/ram.md) | 3 |
| [RDS](reference/rds.md) | 74 |
| [RECYCLEBIN](reference/recyclebin.md) | 2 |
| [REDSHIFT](reference/redshift.md) | 27 |
| [REKOGNITION](reference/rekognition.md) | 3 |
| [ROUTE53](reference/route53.md) | 54 |
| [S3](reference/s3.md) | 158 |
| [S3EXPRESS](reference/s3express.md) | 6 |
| [S3TABLES](reference/s3tables.md) | 3 |
| [S3VECTORS](reference/s3vectors.md) | 5 |
| [SAGEMAKER](reference/sagemaker.md) | 56 |
| [SECRET](reference/secret.md) | 3 |
| [SECRETS](reference/secrets.md) | 31 |
| [SECRETSMANAGER](reference/secretsmanager.md) | 5 |
| [SECURITYAGENT](reference/securityagent.md) | 3 |
| [SECURITYHUB](reference/securityhub.md) | 10 |
| [SECURITYIR](reference/securityir.md) | 2 |
| [SECURITYLAKE](reference/securitylake.md) | 5 |
| [SERVERLESSREPO](reference/serverlessrepo.md) | 1 |
| [SERVICECATALOG](reference/servicecatalog.md) | 1 |
| [SES](reference/ses.md) | 4 |
| [SHIELD](reference/shield.md) | 6 |
| [SIGNIN](reference/signin.md) | 3 |
| [SNS](reference/sns.md) | 39 |
| [SQS](reference/sqs.md) | 37 |
| [SSM](reference/ssm.md) | 13 |
| [STEPFUNCTIONS](reference/stepfunctions.md) | 113 |
| [TAGS](reference/tags.md) | 1 |
| [TEXTRACT](reference/textract.md) | 2 |
| [TIMESTREAM](reference/timestream.md) | 4 |
| [TRANSFER](reference/transfer.md) | 4 |
| [VERIFIEDACCESS](reference/verifiedaccess.md) | 5 |
| [VERIFIEDPERMISSIONS](reference/verifiedpermissions.md) | 7 |
| [VPC](reference/vpc.md) | 133 |
| [VPCLATTICE](reference/vpclattice.md) | 5 |
| [VSPHERE](reference/vsphere.md) | 35 |
| [WAF](reference/waf.md) | 24 |
| [WORKSPACES](reference/workspaces.md) | 2 |
| [XRAY](reference/xray.md) | 2 |