aquasecurity / aquasecurity/cloudsploit

CloudResourceManager plugins always return status OK regardless of policies configuration

Open
#1,608 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

CloudResourceManager plugins don’t behave as expected in all test cases, it always give scan result `OK` but the reason is not accurate, as it indicates: ` No organization policies found` which is not the case, as org policy is setup and the expected outcome here is `OK` because Org policy is `enforced`.

another example on `disableAutomaticIAMGrants` Plugin, change the environment setup, by not enforcing `disableAutomaticIAMGrants` , in this case, plugin must give `fail` result, for the reason `disableAutomaticIAMGrants` is not enforced, but again we get same `OK` result for reason, `"No organization policies found"`

Contributor guide

Open the contributing guide

Research direction

Start by locating the CloudResourceManager plugin implementations and their tests, especially the disableAutomaticIAMGrants case, then inspect how organization policy configuration and enforcement are evaluated. Done means enforced policies produce OK with an accurate reason, while unenforced disableAutomaticIAMGrants produces fail with the corresponding reason.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.