-
Notifications
You must be signed in to change notification settings - Fork 82
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(cloudtrail): support accounts for org trails #425
Conversation
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
cc @Issif |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Really good, I've just some minor suggestions. To complete the changes, could you also update the version and the changelog please
Support accounts for organization trails. When open parameter is 's3://bucket_name/prefix_name/AWSLogs/O-ID/' and 'S3AccountList' is not set get all events for all accounts in the organization CloudTrail bucket. If 'S3AccountList' is configured get events for the account IDs specified in the comma separated list. S3Interval also works for organisation trails. Fixes: falcosecurity#423 Signed-off-by: Uli Heilmeier <uh@heilmeier.eu>
Thanks. I've changed the version. |
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: leogr, uhei The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
LGTM label has been added. Git tree hash: 2a2f6f8a6981a7355c2b56c744fcba83e5458229
|
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area plugins
What this PR does / why we need it:
Support accounts for organization trails. When open parameter is 's3://bucket_name/prefix_name/AWSLogs/O-ID/' and 'S3AccountList' is not set get all events for all accounts in the organization CloudTrail bucket.
If 'S3AccountList' is configured get events for the account IDs specified in the comma separated list.
S3Interval also works for organisation trails.
Which issue(s) this PR fixes:
Fixes #423