streamalert icon indicating copy to clipboard operation
streamalert copied to clipboard

cloudtrail_public_resources missing actions

Open 0xdabbad00 opened this issue 5 years ago • 0 comments

The rule cloudtrail_public_resources is supposed to identify when a resource is made public. However it is missing some actions, even for the resource types it is supposed to monitor. For example, you can make an SQS public via CreateQueue, SetQueueAttributes, or AddPermission, but the rule currently only monitors SetQueueAttributes. https://github.com/airbnb/streamalert/blob/master/rules/community/cloudtrail/cloudtrail_public_resources.py

I might be able to clean this rule up in February, 2020.

0xdabbad00 avatar Dec 16 '19 19:12 0xdabbad00