bug: secretsmanager/remove_unused_secrets_manager_secrets.sql where condition #13773
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
SecretsManager.3 control.
The check 'fail' condition would became 'last_accessed_date before 90 days' since last_accessed_date was not updated within 90 days. Current sql would be false positive.
Expected Behavior
Patch it works:
diff --git a/plugins/source/aws/policies/queries/secretsmanager/remove_unused_secrets_manager_secrets.sql b/plugins/source/aws/policies/queries/secretsmanager/remove_unused_secrets_manager_secrets.sql
index f9ba93ae4..97eb9e4f8 100644
--- a/plugins/source/aws/policies/queries/secretsmanager/remove_unused_secrets_manager_secrets.sql
+++ b/plugins/source/aws/policies/queries/secretsmanager/remove_unused_secrets_manager_secrets.sql
@@ -7,7 +7,7 @@ select
account_id,
arn as resource_id,
case when
- (last_accessed_date is null and created_date > now() - INTERVAL '90 days')
- or (last_accessed_date is not null and last_accessed_date > now() - INTERVAL '90 days')
+ (last_accessed_date is null and created_date < now() - INTERVAL '90 days')
+ or (last_accessed_date is not null and last_accessed_date < now() - INTERVAL '90 days')
then 'fail' else 'pass' end as status
from aws_secretsmanager_secrets
CloudQuery (redacted) config
N/A
Steps To Reproduce
No response
CloudQuery (redacted) logs
N/A
CloudQuery version
main
Additional Context
No response
Pull request (optional)
- I can submit a pull request
Metadata
Metadata
Assignees
Labels
No labels