aquasecurity / aquasecurity/cloudsploit
CloudTrail Global Services Logging Duplicated plugin false positive
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
The _CloudTrail Global Services Logging Duplicated_ plugin incorrectly reports failure when evaluating a multi-region trail. AWS recommends multi-region trails over single-region trails for most configurations, as they have several benefits over traditional single-region trails. Multi-region trails can be identified in the output returned by `DescribeTrails` by the `IsMultiRegionTrail` property being set to `true`.
The issue is a multi-region trail with global service event logging enabled will have the `IncludeGlobalServiceEvents` property set to `true` for all trails belonging to the multi-region trail. For a single multi-region trail, this should not be considered a failure result.
Contributor guide
Research direction
No file or test is named. Start at the CloudTrail Global Services Logging Duplicated plugin and inspect how DescribeTrails results use IsMultiRegionTrail and IncludeGlobalServiceEvents. Done means a single multi-region trail with global service event logging is not reported as a failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100