streamalert
streamalert copied to clipboard
cloudtrail_public_resources missing actions
The rule cloudtrail_public_resources is supposed to identify when a resource is made public. However it is missing some actions, even for the resource types it is supposed to monitor. For example, you can make an SQS public via CreateQueue, SetQueueAttributes, or AddPermission, but the rule currently only monitors SetQueueAttributes. https://github.com/airbnb/streamalert/blob/master/rules/community/cloudtrail/cloudtrail_public_resources.py
I might be able to clean this rule up in February, 2020.