cnspec icon indicating copy to clipboard operation
cnspec copied to clipboard

Policy variants do not inherit `title`, `impact`, and `props` as expected

Open scottford-io opened this issue 2 years ago • 0 comments

Describe the bug Policy variants do not inherit title, impact, and props as expected.

cnspec policies that leverage variants should work by defining the check in the parent including the title, impact, and any props, and any variants should be able to inherit those attributes:

For example, the following check from the Okta policy defines the title, impact and prop in the parent

  - uid: mondoo-okta-security-enable-okta-verify-with-push-for-mfa
    title: Enable Okta Verify (with Push if available) for MFA
    impact: 80
    docs:
      desc: |
        Okta Verify is a multifactor authentication (MFA) app developed by Okta. It lets users verify their identity when they sign in to Okta and makes it less likely that someone pretending to be the user can gain access to the account.

        To use Okta Verify, you must first enable and configure it for your org, and then your end users must install the Okta Verify app on their device and set it up. Then, when end users sign in to Okta, they can verify their identity by approving a push notification in the app, or by entering a one-time code provided by the app into Okta.
    variants:
      - uid: mondoo-okta-security-enable-okta-verify-with-push-for-mfa-runtime
      - uid: mondoo-okta-security-enable-okta-verify-with-push-for-mfa-terraform-hcl
      - uid: mondoo-okta-security-enable-okta-verify-with-push-for-mfa-terraform-plan

When the title and impact are not defined on the variant child checks. scan output produce the first title for one of the checks in the policy, and applies that to every other parent check:

image

When the title and impact are defined on all variant checks, the scan output is correct:

image

scottford-io avatar May 26 '23 18:05 scottford-io