bug: secretsmanager/secrets_should_be_rotated_within_a_specified_number_of_days.sql where condition #13774
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
SecretsManager.4 control.
The check 'fail' condition would became 'last_rotated_date before 90 days' since last_rotated_date was not updated within 90 days. Current sql would be false positive.
Expected Behavior
Patch it works:
diff --git a/plugins/source/aws/policies/queries/secretsmanager/secrets_should_be_rotated_within_a_specified_number_of_days.sql b/plugins/source/aws/policies/queries/secretsmanager/secrets_should_be_rotated_within_a_specified_number_of_days.sql
index 06cefca7d..fe52cdc25 100644
--- a/plugins/source/aws/policies/queries/secretsmanager/secrets_should_be_rotated_within_a_specified_number_of_days.sql
+++ b/plugins/source/aws/policies/queries/secretsmanager/secrets_should_be_rotated_within_a_specified_number_of_days.sql
@@ -7,7 +7,7 @@ select
account_id,
arn as resource_id,
case when
- (last_rotated_date is null and created_date > now() - INTERVAL '90 days')
- or (last_rotated_date is not null and last_rotated_date > now() - INTERVAL '90 days')
+ (last_rotated_date is null and created_date < now() - INTERVAL '90 days')
+ or (last_rotated_date is not null and last_rotated_date < now() - INTERVAL '90 days')
then 'fail' else 'pass' end as status
from aws_secretsmanager_secrets
CloudQuery (redacted) config
N/A
Steps To Reproduce
No response
CloudQuery (redacted) logs
N/A
CloudQuery version
main
Additional Context
No response
Pull request (optional)
- I can submit a pull request
Metadata
Metadata
Assignees
Labels
No labels