Skip to content

fix(query): fix fn for cloudTrail_multi_region_disabled #7558

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 10 commits into from
Jul 17, 2025
Merged

fix(query): fix fn for cloudTrail_multi_region_disabled #7558

merged 10 commits into from
Jul 17, 2025

Conversation

cx-andre-pereira
Copy link
Contributor

@cx-andre-pereira cx-andre-pereira commented Jul 16, 2025 •
edited
Loading

Reason for Proposed Changes

  • This query is meant to identify ansible tasks that configure an AWS CloudTrail trail with the is_multi_region_trail flag set to false.
  • In its current implementation it does not treat the lack of the relevant field (is_multi_region_trail) as false, it should do so because that is its default value.
  • This behavior leads to false negatives.

Proposed Changes

  • Refinement of the query`s CxPolicy logic to flag whether the field is set explicitly to false or missing altogether from the ansible task.

originalPR

I submit this contribution under the Apache-2.0 license.

@cx-andre-pereira cx-andre-pereira requested a review from a team as a code owner July 16, 2025 10:57
@github-actions github-actions bot added community Community contribution query New query feature ansible Ansible query aws PR related with AWS Cloud labels Jul 16, 2025
cx-eduardo-semanas
cx-eduardo-semanas previously approved these changes Jul 16, 2025
View reviewed changes
Copy link
Contributor

@cx-eduardo-semanas cx-eduardo-semanas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

cx-artur-ribeiro
cx-artur-ribeiro approved these changes Jul 17, 2025
View reviewed changes
Copy link
Contributor

@cx-artur-ribeiro cx-artur-ribeiro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cx-artur-ribeiro cx-artur-ribeiro merged commit 5df5edb into Checkmarx:master Jul 17, 2025
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cx-artur-ribeiro cx-artur-ribeiro cx-artur-ribeiro approved these changes

@cx-eduardo-semanas cx-eduardo-semanas cx-eduardo-semanas left review comments

Assignees

@cx-andre-pereira cx-andre-pereira

Labels
ansible Ansible query aws PR related with AWS Cloud community Community contribution query New query feature
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@cx-andre-pereira @cx-eduardo-semanas @cx-artur-ribeiro @AndrePereira123