ansible-lockdown / AMAZON2023-CIS

Ansible role for Amazon2023 CIS Baseline
https://ansible-lockdown.readthedocs.io/en/latest/
MIT License
24 stars 18 forks source link

Small bug in task 5.2.4.5 "Ensure audit configuration files are 640 or more restrictive" #59

Closed DianaMariaDDM closed 5 months ago

DianaMariaDDM commented 6 months ago

Describe the Issue If the auditd_conf_files register used in this task is empty or undefined then the task would fail. Expected Behavior The task should not fail even if the register is empty.

Actual Behavior The task fails because of the order of execution in ansible fields. The first when conditional `when:

is the one responsible for this, along with the loop: used in the task : loop: "{{ auditd_conf_files.files }}".

If one combines a when statement with a loop, Ansible processes the condition separately for each item. This is by design, so you can execute the task on some items in the loop and skip it on other items.

The documentation for Ansible provides a solution: image

Control(s) Affected

Environment (please complete the following information):

Additional Notes Anything additional goes here

Possible Solution The fix will be provided in a PR.