prancer-io / prancer-compliance-test

This repository includes cloud security policies for IaC and live resources.
https://www.prancer.io
39 stars 11 forks source link

master-snapshot GOOGLE_PROJECTS_IAM has inconsistency between "type" and "get_method" property value. #564

Closed rezoan closed 3 months ago

rezoan commented 1 year ago

Bit of confused on below master-shanspt

  {
                    "masterSnapshotId": "GOOGLE_PROJECTS_IAM",
                    "type": "compute/projects.list",
                    "get_method": ["cloudresourcemanager/projects.getIamPolicy"],
                    "collection": "project_iam_user",
                    "tags": [
                      {
                        "cloud": "GCP",
                        "service": [
                          "iam"
                        ]
                      }
                    ]
                }

projects.list under property type don't have any relation with cloudresourcemanager/projects.getIamPolicy under property get_method. both are returning list. one is returning project list and other is returning list of users and service accounts with their role under specific project whose id is being passed at url parameter.

can someone please explain how these 2 are related with each other and why we need to add "compute/projects.list" in types instead of "cloudresourcemanager/projects.getIamPolicy"****

if you think this snapshot is correct, please explain below snapshot regrading metrics.list compared to previous one.

it is also returning a list of logging metrics of specific project whose id is being passed at url parameter, similar to cloudresourcemanager/projects.getIamPolicy. why this snapshot don't have any projects.list in property type.

 {
                    "masterSnapshotId": "GOOGLE_LOGGING",
                    "type": "logging/metrics.list",
                    "collection": "logging",
                    "tags": [
                        {
                            "cloud": "GCP",
                            "service": [
                                "logging"
                            ]
                        }
                    ]
                }
rezoan commented 3 months ago

already resolved.