aws-cis-foundation-benchmark-checklist fails
lang7 opened this issue · 8 comments
3.8, 3.9, 3.13 Fail checks because of metric /alarm / subscription missing.
@lang7 3.8, 3.9 and 3.13 is working for me
@Infectsoldier It looks like the LogGroup Metric Filters are not being created - the checks for 3.8, 3.9, and 3.13 are covered by Event Rules / Lambda functions. I don't think aws-cis-foundation-benchmark-checklist.py checks for this ?
@lang7 you are correct. I had to build my own Metric Filters and Alarms to satisfy that check with the python code. Same for 3.6 and 3.7, still getting false positives.
@etendards you can check the fix for 3.6 and 3.7 in my PR #35
@lang7 i've create all log groups and metrics using aws cli, not cloudformation template
Will look into this. The log group metrics/filters are mapped to the CIS benchmark, will verify against the CFn template.
Seems like the py script is correct but the cfn template is deviating from the benchmark. Although the event rules might be an acceptable alternative to creating a metric/filter + alarm for certain use cases, it isn't really fulfilling the requirement as written. @lcymburajr can you PR our cfn template changes?
I have fixed 3.2 pattern issue and updated cfn template with additional checks. Also put sam template as well there to create lambda functions and config event rule.