aquasecurity / aquasecurity/cloudsploit

CloudTrail Enabled plugin false positive

Open
#139 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

## Issue
We're currently getting a false positive from the [CloudTrail Enabled plugin](https://github.com/cloudsploit/scans/blob/a74c7e5b7df1cd8d4c8d3561d47e421f2af36786/plugins/cloudtrail/cloudtrailEnabled.js) regarding not having global services enabled.

## Context
We have multiple active trails in our AWS account that get funneled to different downstream services. In order to avoid getting repeated global services events from every trail, only 1 trail in our account has `IncludeGlobalServiceEvents` enabled. The plugin check currently breaks out of the for-loop after finding the first trail that is enabled (`isLogging = true`). Because of this it is not able to tell that another trail in `describeTrails.data` does indeed have global services enabled and misreports the configuration error.

Contributor guide

Open the contributing guide

Research direction

Start with plugins/cloudtrail/cloudtrailEnabled.js at the loop over describeTrails.data and inspect how isLogging is set and used. Reproduce the case with multiple active trails where only one has IncludeGlobalServiceEvents enabled. Done means the plugin recognizes that configuration without reporting a false positive.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
cloud, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.