Skip to content

Bug while running the kms_key_rotation_enabled #4617

Description

@JOSHUAJEBARAJ

Steps to Reproduce

Hey folks, when I run a Prowler scan on the KMS service in the GCP, one of the checks doesn't check kms_key_rotation_enabled doesn't check for all condition

  1. Go to the console and create the KMS key
  2. Under Key rotation select the Key rotation period as 90 days and for the Starting on field select the date which is more than 90 days

Now run the scan using the below command

python3 prowler.py gcp --project-ids xxxxx --check kms_key_rotation_enabled

Expected behavior

According to the CIS benchmark for this check
Ensure outcome values for rotationPeriod and nextRotationTime satisfy the below
criteria:

  • rotationPeriod is <= 129600m
  • rotationPeriod is <= 7776000s
  • rotationPeriod is <= 2160h
  • rotationPeriod is <= 90d
    and
  • nextRotationTime is <= 90days from current DATE
    Taken from the CIS benchmark
    But currently prowler is only looking for only checking for rotation-period and here
    But actually we have to check for both the fields

Actual Result with Screenshots or Logs

Currently its looking for only the rotationPeriod field which leads to wrong result as the key has the next-rotation-time more than 90 days marked as pass

How did you install Prowler?

Cloning the repository from github.com (git clone)

Environment Resource

Local

OS used

Mac is

Prowler version

Prowler 4.2.1

Pip version

pip 20.3.4

Context

n/A

Metadata

Metadata

Assignees

Labels

bugprovider/gcpIssues/PRs related with the Google Cloud Platform providerseverity/mediumResults in some unexpected or undesired behavior.status/waiting-for-revisionWaiting for maintainer's revision

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions