The CloudFormation Scanner can not currently follow complex conditional logic that uses CloudFormation references (Ref) or conditions (If). For example, a security group configured with inbound IP addresses set to the string “0.0.0.0/0” would trigger a failure while a reference of “Ref: SomeRefVar” would not.