aquasecurity / aquasecurity/cloudsploit
AccessDenied for keys that are managed by AWS
Open
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
I think possible filter for that kind of keys could be an alias that usually contains aws/* or "KeyManager": "AWS", .
https://github.com/cloudsploit/scans/blob/36fac15388486d418b53597fb264807e3a6982e1/plugins/aws/kms/kmsKeyRotation.js#L59
Contributor guide
Research direction
Start with plugins/aws/kms/kmsKeyRotation.js at the linked line and inspect how AWS KMS keys are selected and how AccessDenied responses are handled. Compare the proposed alias pattern and KeyManager value, then verify that AWS-managed keys are handled without producing an erroneous finding or permission error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100