hlxsites / hlxsites/prisma-cloud-docs

Duplicate and incorrect documentation for CKV_AWS_111 and CKV_AWS_109

Open
#1,020 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
21
Forks
92
PR merge metrics
No merged PRs in 30d

Description

CKV_AWS_111 ([write access without constraints](https://github.com/hlxsites/prisma-cloud-docs/blob/main/docs/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint.adoc)) has the documentation for CKV_AWS_109 ([resource exposure without constraints](https://github.com/hlxsites/prisma-cloud-docs/blob/main/docs/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint.adoc)).

Both of these documents are wrong and make no mention of the Resource constraint (`*`) that needs to be set to specific ARNs.
The "Fix" diff for [CKV_AWS_111](https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint) even shows a policy that completely passes even before removing the offending line marked with a `-`.

Also interesting is that these are both subsets of [CKV_AWS_356](https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356) which is marked as "High" severity, while these two, which check if even more dangerous things are low priority.

Can these checks be reevaluated for validity? I have found a few other checks (e.g. [CKV_K8S_356](https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-21) with invalid, possibly AI-generated, information that does not describe the check properly, and I fear there are several others.

We are evaluating our options and would like to get all our teams using Checkov, but it is difficult to pitch when the documentation does not accurately describe the issue and the fix.

Contributor guide

Open the contributing guide

Research direction

Start with the two linked AsciiDoc files for CKV_AWS_111 and CKV_AWS_109, then compare them with the CKV_AWS_356 documentation and the referenced Fix diff. Verify whether the Resource constraint and specific ARNs are accurately described, and check the severity relationship. Done means the affected documentation correctly explains each check and its fix, with any broader reevaluation scoped separately.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
documentation, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.