Azure Findings Show as UNKNOWN Even With Full Permissions
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- azure, javascript
Research direction
Start by locating the Azure evaluation entry points for the ACL-related checks and the named Key Vault checks: keyExpirationEnabled, secretExpirationEnabled, rsaCertificateKeySize, and keyVaultKeyExpiryNonRbac. Reproduce the UNKNOWN results with absent Storage services and RBAC-authorized vaults, then determine whether those cases should be reported as FAIL and verify the resulting findings.
Written by the indexing model from the issue text.
Description
I’m seeing many Azure findings consistently showing as UNKNOWN even after applying all required Storage and Key Vault permissions.
This is not an IAM issue. Based on verification:
- The Storage Accounts do not have File/Queue/Table services enabled, but CloudSploit still marks ACL-related checks as UNKNOWN instead of FAIL.
- The Key Vaults are using RBAC authorisation and contain no keys/secrets/certificates with expiry, causing checks like keyExpirationEnabled, secretExpirationEnabled, rsaCertificateKeySize, and keyVaultKeyExpiryNonRbac to always return UNKNOWN.
The results do not change.
This looks like a CloudSploit evaluation logic issue, not a permissions gap.
Please confirm if these checks should return FAIL when the underlying Azure service/config isn’t present or when the vault uses RBAC mode.
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 7d 59m
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aquasecurity/cloudsploit
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
aquasecurity/cloudsploit#1311 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
aquasecurity/cloudsploit#909 · 4 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
aquasecurity/cloudsploit#2176 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
aquasecurity/cloudsploit#2174 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
aquasecurity/cloudsploit#2159 · 1 comment ·
All issues in aquasecurity/cloudsploit
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·