aquasecurity / aquasecurity/cloudsploit
CloudResourceManager plugins always return status OK regardless of policies configuration
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
CloudResourceManager plugins don’t behave as expected in all test cases, it always give scan result `OK` but the reason is not accurate, as it indicates: ` No organization policies found` which is not the case, as org policy is setup and the expected outcome here is `OK` because Org policy is `enforced`.
another example on `disableAutomaticIAMGrants` Plugin, change the environment setup, by not enforcing `disableAutomaticIAMGrants` , in this case, plugin must give `fail` result, for the reason `disableAutomaticIAMGrants` is not enforced, but again we get same `OK` result for reason, `"No organization policies found"`
Contributor guide
Research direction
Start by locating the CloudResourceManager plugin implementations and their tests, especially the disableAutomaticIAMGrants case, then inspect how organization policy configuration and enforcement are evaluated. Done means enforced policies produce OK with an accurate reason, while unenforced disableAutomaticIAMGrants produces fail with the corresponding reason.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100