search

GoogleCloudPlatform / inspec-gcp-cis-benchmark

GCP CIS 1.1.0 Benchmark InSpec Profile
Apache License 2.0
129 stars 53 forks source link

Filter out disabled Service Account keys in 1.7 #91

Open dinvlad opened 2 years ago

dinvlad commented 2 years ago

Hi Team,

The benchmark appears to report old Service Account keys, even if they're disabled. Could you add logic to 1.07 control that filters out disabled keys?

Thanks!

aaronlippold commented 2 years ago

That shouldn’t be too hard if there’s a property we can access about the key to know that it’s disabled, then it would be just updating the control to say next if property true

On Wed, Mar 2, 2022 at 13:09 Denis Loginov @.***> wrote:

Hi Team,

The benchmark appears to report old Service Account keys, even if they're disabled. Could you add logic to 1.07 control https://github.com/GoogleCloudPlatform/inspec-gcp-cis-benchmark/blob/master/controls/1.07-iam.rb that filters out disabled keys?

Thanks!

— Reply to this email directly, view it on GitHub https://github.com/GoogleCloudPlatform/inspec-gcp-cis-benchmark/issues/91, or unsubscribe https://github.com/notifications/unsubscribe-auth/AALK42HTYE27TGSUWSKCWV3U56VETANCNFSM5PYGUNOQ . You are receiving this because you are subscribed to this thread.Message ID: @.***>

--

Aaron Lippold

@.***

260-255-4779

twitter/aim/yahoo,etc. 'aaronlippold'

dinvlad commented 2 years ago

@aaronlippold yes, there's disabled field on the ServiceAccountKey object, I believe: https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts.keys#ServiceAccountKey