IAM Audit log policy validation seems producing false positives

[xingao267]

I have the following constraints and CAI data

apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPIAMAuditLogConstraintV1
metadata:
  name: iam_enable_audit_logs
spec:
  severity: high
  match:
    target:
    - "organization/12345678/*"
    - "folder/4567/*"
  parameters:
    log_types:
    - DATA_READ
    - DATA_WRITE
    - ADMIN_READ
    services:
    - allServices

{"ancestors":["folders/88888888","organizations/12345678"],"name":"//cloudresourcemanager.googleapis.com/projects/good","asset_type":"cloudresourcemanager.googleapis.com/Project","iam_policy":{"version":1,"etag":"BwWKImhngxs=","audit_configs":[{"service":"allServices","audit_log_configs":[{"log_type":1},{"log_type":2},{"log_type":3}]}]}}

It seems should be good and do not report violations. But when I run the CFT scorecard on those, it gives the following violation

Other,iam_enable_audit_logs,//cloudresourcemanager.googleapis.com/projects/good,"IAM policy for //cloudresourcemanager.googleapis.com/projects/good does not have correct audit logs enabled in service(s) [""allServices""]"

[morgante]

For your case, I suspect it's because there are additional audit logs enabled besides allServices. A fix will need to be made on the policy template (happy to accept a PR).

[xingao267]

My testing CAI dataset only has that one entry. I suspect there is other bug in the rego rule. I tried to understand https://github.com/forseti-security/policy-library/blob/master/validator/iam_audit_log.rego and follow the logic there but it was quite involving. Might need some help or guidance from the original author @t12g

[xingao267]

I did a bit more investigation. It looks like input.asset.audit_configs is empty after CAI data is read into CFT Scorecard or CV. input.asset.bindings is there though.

[morgante]

This might be a problem with the asset protos not including audit configus.

[briantkennedy]

What's the setup you have for forseti / config validator?

[xingao267]

I'm testing with CFT Scorecard using cft 0.3.4.

I guess the proto might be here https://github.com/googleapis/googleapis/blob/master/google/iam/v1/policy.proto where audit_config is not there.