You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm seeing the same issue. When I manually changed the pattern to the old version (without the log delivery or bucket additions), then SecurityHub marked the control as passing.
UnauthorizedAPICalls alert was defined as {($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")} in v1.2.0, but it's updated to {(($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*")) && (($.sourceIPAddress!="delivery.logs.amazonaws.com") && ($.eventName!="HeadBucket"))} in v1.3.0.
So our implementation uses the latest pattern, which I believe preferable, but the current CIS standard implementation in SecurityHub is still looking for the old pattern.
With that said, I would recommend suppressing the finding at this moment. I hope AWS will release the SecurityHub standard for the latest CIS benchmark in near future.
Hi all
It seems that the recent change to the the pattern for the "UnauthorizedAPICalls" alert is triggering a false finding in Security Hub
3d5332a
I guess the reason is that the "official" pattern tested for is:
The new pattern is:
Is my assumption correct?
Should you revert the change or should we suppress the finding?
Thanks,
Luigi
The text was updated successfully, but these errors were encountered: