Skip to content

fix(query): fix fn for cloudTrail_multi_region_disabled#7558

Merged
cx-artur-ribeiro merged 10 commits into
Checkmarx:masterfrom
cx-andre-pereira:AST-96069--FN_CloudTrail_Multi_Region_Disabled--ansible/aws
Jul 17, 2025
Merged

fix(query): fix fn for cloudTrail_multi_region_disabled#7558
cx-artur-ribeiro merged 10 commits into
Checkmarx:masterfrom
cx-andre-pereira:AST-96069--FN_CloudTrail_Multi_Region_Disabled--ansible/aws

Conversation

@cx-andre-pereira

@cx-andre-pereira cx-andre-pereira commented Jul 16, 2025

Copy link
Copy Markdown
Contributor

Reason for Proposed Changes

  • This query is meant to identify ansible tasks that configure an AWS CloudTrail trail with the is_multi_region_trail flag set to false.
  • In its current implementation it does not treat the lack of the relevant field (is_multi_region_trail) as false, it should do so because that is its default value.
  • This behavior leads to false negatives.

Proposed Changes

  • Refinement of the query`s CxPolicy logic to flag whether the field is set explicitly to false or missing altogether from the ansible task.

originalPR

I submit this contribution under the Apache-2.0 license.

@cx-andre-pereira cx-andre-pereira requested a review from a team as a code owner July 16, 2025 10:57
@github-actions github-actions Bot added community Community contribution query New query feature ansible Ansible query aws PR related with AWS Cloud labels Jul 16, 2025

@cx-eduardo-semanas cx-eduardo-semanas left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cx-artur-ribeiro cx-artur-ribeiro left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cx-artur-ribeiro cx-artur-ribeiro merged commit 5df5edb into Checkmarx:master Jul 17, 2025
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ansible Ansible query aws PR related with AWS Cloud community Community contribution query New query feature

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants