search

elastic / cloudbeat

Analyzing Cloud Security Posture
Other
14 stars 42 forks source link

[BUG] CIS AWS Rule 3.10 / 3.11 - When object-level logging for write / read events is enabled for S3 bucket evaluation is failed. #811

Closed gurevichdmitry closed 1 year ago

gurevichdmitry commented 1 year ago

Describe the bug When object-level logging for write / read events is enabled for S3 bucket evaluation is failed.

rule 3.10

rule 3.11

Audit: aws cloudtrail get-event-selectors --region us-west-2 --trail-name test-aws-file-validation-on-pass --query "EventSelectors[*].DataResources[]"

Preconditions ELK Stack 8.8 is deployed

To Reproduce Steps to reproduce the behavior:

  1. Create CSPM integration and deploy elastic agent.
  2. Navigate to Findings and search by rule.tags: "CIS 3.10" and resource.name: "test-aws-file-validation-on-pass"
  3. Navigate to Findings and search by rule.tags: "CIS 3.11" and resource.name: "test-aws-file-validation-on-pass"

Expected behavior Evaluation result for rules 3.10 and 3.11 is passed

uri-weisman commented 1 year ago

Current rego implementation support writing and reading to all s3 buckets instead of supporting all and a specific bucket.

partialARN == "arn:aws:s3"

Should be:

contains(partialARN, "arn:aws:s3")