aquasecurity / aquasecurity/cloudsploit
CloudTrail Enabled plugin false positive
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
## Issue
We're currently getting a false positive from the [CloudTrail Enabled plugin](https://github.com/cloudsploit/scans/blob/a74c7e5b7df1cd8d4c8d3561d47e421f2af36786/plugins/cloudtrail/cloudtrailEnabled.js) regarding not having global services enabled.
## Context
We have multiple active trails in our AWS account that get funneled to different downstream services. In order to avoid getting repeated global services events from every trail, only 1 trail in our account has `IncludeGlobalServiceEvents` enabled. The plugin check currently breaks out of the for-loop after finding the first trail that is enabled (`isLogging = true`). Because of this it is not able to tell that another trail in `describeTrails.data` does indeed have global services enabled and misreports the configuration error.
Contributor guide
Research direction
Start with plugins/cloudtrail/cloudtrailEnabled.js at the loop over describeTrails.data and inspect how isLogging is set and used. Reproduce the case with multiple active trails where only one has IncludeGlobalServiceEvents enabled. Done means the plugin recognizes that configuration without reporting a false positive.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100