aquasecurity / aquasecurity/cloudsploit

CloudTrail Global Services Logging Duplicated plugin false positive

Open
#596 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

The _CloudTrail Global Services Logging Duplicated_ plugin incorrectly reports failure when evaluating a multi-region trail. AWS recommends multi-region trails over single-region trails for most configurations, as they have several benefits over traditional single-region trails. Multi-region trails can be identified in the output returned by `DescribeTrails` by the `IsMultiRegionTrail` property being set to `true`.

The issue is a multi-region trail with global service event logging enabled will have the `IncludeGlobalServiceEvents` property set to `true` for all trails belonging to the multi-region trail. For a single multi-region trail, this should not be considered a failure result.

Contributor guide

Open the contributing guide

Research direction

No file or test is named. Start at the CloudTrail Global Services Logging Duplicated plugin and inspect how DescribeTrails results use IsMultiRegionTrail and IncludeGlobalServiceEvents. Done means a single multi-region trail with global service event logging is not reported as a failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
cloud, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.