Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Falco rule resource shows a priority change even if the resource isn't changed #59

Closed
ukitazume opened this issue Nov 17, 2020 · 2 comments · Fixed by #60
Closed

Falco rule resource shows a priority change even if the resource isn't changed #59

ukitazume opened this issue Nov 17, 2020 · 2 comments · Fixed by #60

Comments

@ukitazume
Copy link
Collaborator

When using sysdig_secure_rule_falco with priority = informational, terraform plan and apply shows ~ priority = "info" -> "informational" even if that rule doesn't change like here.

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # sysdig_secure_rule_falco.foo will be updated in-place
  ~ resource "sysdig_secure_rule_falco" "foo" {
        append      = false
        condition   = "spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint"
        description = "this is other example of policy"
        id          = "20958"
        name        = "AOther example of Policy"
        output      = "A shell was spawned in a container with an attached terminal (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository)"
      ~ priority    = "info" -> "informational"
        source      = "syscall"
        tags        = [
            "container",
            "shell",
            "mitre_execution",
        ]
        version     = 1
    }

Plan: 0 to add, 1 to change, 0 to destroy.
@tembleking
Copy link
Member

Thanks for reporting @ukitazume, the linked PR solves this problem, the field must be info instead of informational.

@ukitazume
Copy link
Collaborator Author

So quick!! thanks alot @tembleking

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants