Rômulo Farias

[CIS AWS] Multiple Access Denied in Long Lived Environment

2

**Describe the bug** There are multiple Access Denied in AWS in the long lived env ([logs](https://evgblong813-db7-8-13-0.kb.us-west2.gcp.elastic-cloud.com:9243/app/r/s/SZnNs)) They are in different resources. During 8.13 QA Cycle we've seen in 1 cycle:...

**Motivation** About [example](https://qa-cycle-812-oleg-cfi-8-12-0.kb.us-west2.gcp.elastic-cloud.com:9243/app/discover#/doc/logs-*/.ds-logs-elastic_agent.cloudbeat-default-2023.12.24-000001?id=oB4CqowByeskzjUxbUq1) ``` failed to get file time data, error - %woperation not permitted ``` It looks like there are files which we don't have permissions to perform the...

**Motivation** Regarding > [example](https://qa-cycle-812-oleg-cfi-8-12-0.kb.us-west2.gcp.elastic-cloud.com:9243/app/discover#/doc/logs-*/.ds-logs-elastic_agent.cloudbeat-default-2023.12.24-000001?id=mRsqpowByeskzjUx_Hlt) > ``` > Unable to fetch PasswordPolicy, error: operation error IAM: GetAccountPasswordPolicy, https response error StatusCode: 404, RequestID: 0be1895f-a109-40e9-86d7-6c7a89fc91a0, NoSuchEntity: The Password Policy with domain name...

**Motivation** The service account used by cloudbeat doesn't have permissions to browse on organization level, only on project level. [Testable here](https://console.cloud.google.com/iam-admin/troubleshooter;permissions=resourcemanager.organizations.get;principal=qa-cycle-812-oleg-sa@elastic-security-test.iam.gserviceaccount.com;resources=%2F%2Fcloudresourcemanager.googleapis.com%2Forganizations%2F992493199029) The error: ``` error fetching GCP Org: googleapi: Error...

Invalid validation on Multi Value Headers (Chi Router implementation)

4

I need a multi value header, namely `Accept-Language`. As per my understanding from [RFC 9110 HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110.html#section-5.2) and [Mozilla Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language), it's a valid HTTP request to have multiple values in...

Based on the issue [#8365](https://github.com/elastic/security-team/issues/8365), we found out that some environment creations were leaving undeleted EBS Snapshots behind. The cases: - Failed creations - Environments with flag `Cleanup resources after...

[Azure Mysql Single Server Code is deprecated](https://learn.microsoft.com/en-us/azure/mysql/migrate/whats-happening-to-mysql-single-server) and from March 28 2025 it will be completely decommissioned. Therefore there is no point of having this code in our codebase, and...