feat: Updated UnauthorizedAPICalls pattern to pass CIS v1.2.0 #48
Conversation
|
Hey @antonbabenko! 👋🏼 |
antonbabenko
changed the title
|
@bryantbiggs Do you have any idea what can be the reason and solution for failing CI runs (e.g. this)? PS: It is hard to come back from vacation... LOL |
|
Yes, it seems something changed recently on GitHub's side. terraform-aws-modules/terraform-aws-rds#467 (comment) I'll update the workflows today but that PR has the "fix" to avoid this rate limiting |
|
@dev-slatto Please update this PR with the change Bryant mentioned and we will be good to go with this PR. Thank you! |
|
Ofc! Done @antonbabenko 😉 |
## [4.1.0](v4.0.0...v4.1.0) (2023-01-03) ### Features * Updated UnauthorizedAPICalls pattern to pass CIS v1.2.0 ([#48](#48)) ([6901778](6901778))
|
This PR is included in version 4.1.0 🎉 |
|
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further. |
3 participants
Description
According to the documentation of CIS AWS Foundations Benchmark v1.2.0 the pattern for UnauthorizedAPICalls should be
{($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")}. As of today it also validates the sourceIP and the eventName, leading to the check of CIS 3.1 to fail.Motivation and Context
Merging this change will make the module compliant with the documentation of the CIS AWS Foundations Benchmark v1.2.0.
Breaking Changes
No breaking changes. Those users that still want to check for sourceIP and eventName can do so by utilising the control_overrides.
How Has This Been Tested?
examples/*to demonstrate and validate my change(s)examples/*projectspre-commit run -aon my pull request