Update aws_cis_v120_2_3.yaml

Author: acx1729

compliance/controls/aws/aws_cis_v120_2_3.yaml

@@ -18,30 +18,34 @@ Query:
         t.account_id,
         t.tags,
         t._ctx,
+        t.platform_account_id,
+        t.platform_resource_id,
         COUNT(acl_grant) FILTER (WHERE acl_grant -> 'Grantee' ->> 'URI' LIKE '%acs.amazonaws.com/groups/global/AllUsers') AS all_user_grants,
         COUNT(acl_grant) FILTER (WHERE acl_grant -> 'Grantee' ->> 'URI' LIKE '%acs.amazonaws.com/groups/global/AuthenticatedUsers') AS auth_user_grants,
         COUNT(s) FILTER (WHERE s ->> 'Effect' = 'Allow' AND p = '*') AS anon_statements
       FROM
         aws_cloudtrail_trail AS t
       LEFT JOIN aws_s3_bucket AS b ON t.s3_bucket_name = b.name
       LEFT JOIN jsonb_array_elements(acl -> 'Grants') AS acl_grant ON TRUE
-      LEFT JOIN jsonb_array_elements(policy_std -> 'Statement') AS s  ON TRUE
+      LEFT JOIN jsonb_array_elements(policy_std -> 'Statement') AS s ON TRUE
       LEFT JOIN jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p ON TRUE
       GROUP BY
         t.s3_bucket_name,
         b.arn,
         t.region,
         t.account_id,
         t.tags,
-        t._ctx
+        t._ctx,
+        t.platform_account_id,
+        t.platform_resource_id
     )
     SELECT
       CASE
         WHEN arn IS NULL THEN 'arn:aws:s3::' || name
         ELSE arn
       END AS resource,
-      t.platform_account_id AS platform_account_id,
-      t.platform_resource_id AS platform_resource_id,
+      platform_account_id,
+      platform_resource_id,
       CASE
         WHEN arn IS NULL THEN 'skip'
         WHEN all_user_grants > 0 THEN 'alarm'
@@ -60,4 +64,4 @@ Query:
       public_bucket_data;
 Severity: low
 Tags: {}
-Title: 2.3 Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible
+Title: 2.3 Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible