Incorrect report for CIS 3.5 (AWS Config) about steampipe-mod-aws-compliance

[rajlearner17]

@rhoboat Appreciate checking this out. The result you have mentioned is correct for the use case you have tested. We have already addressed this issue in detail here. I guess it's time to close this one with a good test result from you 😄

Once again thank you 👍 for responding. Pls keep us posted, in case you come across any other observations

[cbruno10]

@bwhaley Thanks for the report!

Our query does look incorrect and should only alarm for the account if no region has IncludeGlobalResourceTypes enabled.

I also believe we have another issue for this query which could prevent it from returning the correct result (#27), so we'll look into both of these issues and see how we can get the control working properly.

Related to the other potential bug above, can you please paste here what regions you have enabled in your .steampipe/config/aws.spc file? Thanks!

[rajlearner17]

Reported here

[rhoboat]

Adding onto this, when I added 22 regions to the ~/.steampipe/config/aws.spc file as below:

  regions = [
    "us-east-1",
    "us-east-2",
    "us-west-1",
    "us-west-2",
    "eu-west-1",
    "eu-west-2",
    "eu-west-3",
    "eu-south-1",
    "eu-central-1",
    "eu-north-1",
    "ap-south-1",
    "ap-northeast-1",
    "me-south-1",
    "ap-east-1",
    "ap-southeast-3",
    "ap-northeast-3",
    "ap-southeast-1",
    "af-south-1",
    "sa-east-1",
    "ap-southeast-2",
    "ap-northeast-2",
    "ca-central-1"
  ]

I got the following result:

As you can see, there are 22-16 = 6 regions where the check fails. In this particular AWS account, I can confirm that we have AWS Config disabled for those 6 regions.

So I'm not sure this is a bug, actually.