Inverted logic in rule AVD-AWS-0141

[nikpivkin]

The key is active and the Trivy does not alert.

resource "aws_iam_access_key" "this" {
 	user = "root"
	status = "Active"
}

trivy conf iam-key
2023-10-26T16:25:59.639+0700    INFO    Misconfiguration scanning is enabled
2023-10-26T16:26:00.055+0700    INFO    Detected config files: 2

The key is inactive and Trivy warns:

resource "aws_iam_access_key" "this" {
 	user = "root"
	status = "Inactive"
}

trivy conf iam-key
2023-10-26T16:26:34.436+0700    INFO    Misconfiguration scanning is enabled
2023-10-26T16:26:34.844+0700    INFO    Detected config files: 2

main.tf (terraform)

Tests: 3 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

CRITICAL: Access key exists for root user
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════

CIS recommends that all access keys be associated with the root user be removed. Removing access keys associated with the root user limits vectors that the account can be compromised by. Removing the root user access keys also encourages the creation and use of role-based accounts that are least privileged.


See https://avd.aquasec.com/misconfig/avd-aws-0141
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 main.tf:1-4
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1 ┌ resource "aws_iam_access_key" "this" {
   2 │          user = "root"
   3 │  status = "Inactive"
   4 └ }
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────