Skip to content

fix(query): avoid S3 notification standalone target FPs#8053

Open
omribz156 wants to merge 1 commit into
Checkmarx:masterfrom
omribz156:codex/kics-s3-notification-fp
Open

fix(query): avoid S3 notification standalone target FPs#8053
omribz156 wants to merge 1 commit into
Checkmarx:masterfrom
omribz156:codex/kics-s3-notification-fp

Conversation

@omribz156
Copy link
Copy Markdown

Closes #8052

Reason for Proposed Changes

  • The S3 bucket notification query flagged standalone SNS/SQS/Lambda resources when no aws_s3_bucket_notification existed in the file, which creates false positives for unrelated resources.

Proposed Changes

  • Removed the branch that treats every standalone SNS/SQS/Lambda resource as missing an S3 bucket notification.
  • Kept the existing checks for target resources that are present but not referenced by an existing aws_s3_bucket_notification.
  • Moved the standalone SNS/SQS/Lambda fixtures from positive cases to negative cases.

Verification

  • go test ./test -run "TestQueries/.*s3_bucket_notifications_disabled.*" -count=1 -timeout 10m -v
  • git diff --check

This was implemented with Codex assistance, with the final patch manually reviewed and kept focused on the query regression.

I submit this contribution under the Apache-2.0 license.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug(terraform aws): false positive: "S3 bucket notifications disabled" flags resources not related to S3

1 participant