topic Re: Receiving false positive alert for AWS config recording is disabled in Prisma cloud in General Topics

Receiving false positive alert for AWS config recording is disabled in Prisma cloud

Deepak_K — Fri, 25 Dec 2020 05:38:51 GMT

We tried with the mentioned steps and enabled the recording following below recommendation:

1. Sign in to the AWS Management Console

2. Select the specific region from the top down, for which the alert is generated

3. Navigate to service 'Config' from the 'Services' dropdown.

If AWS Config set up exists,

a. Go to Settings

b. Click on 'Turn On' button under 'Recording is Off' section,

c. provide required information for bucket and role with proper permission

If AWS Config set up doesn't exist

a. Click on 'Get Started'

b. For Step 1, Tick the check box for 'Record all resources supported in this region' under section 'Resource types to record'

c. Under section 'Amazon S3 bucket', select bucket with permission to Config services

d. Under section 'AWS Config role', select a role with permission to Config services

e. Click on 'Next'

f. For Step 2, Select required rule and click on 'Next' otherwise click on 'Skip'

g. For Step 3, Review the created 'Settings' and click on 'Confirm'

Anyone facing this issue ?

Re: Receiving false positive alert for AWS config recording is disabled in Prisma cloud

Proctor4526 — Mon, 28 Dec 2020 06:50:47 GMT

Receiving false positive alert for AWS config recording is disabled in Prisma cloud. We tried with the mentioned steps and enabled

Re: Receiving false positive alert for AWS config recording is disabled in Prisma cloud

Deepak_K — Mon, 28 Dec 2020 12:13:48 GMT

Are you receiving the same alerts ?

Re: Receiving false positive alert for AWS config recording is disabled in Prisma cloud

NAnders — Fri, 29 Apr 2022 17:48:00 GMT

Recently experienced this (false positive?) alert as well -- triggered for a region that is disabled / not even capable of being used. Weird that it didn't also trigger for any of the other regions that we also have disabled. Would be great if we could get an explaination of why/how this happened, and just for a single disabled region, and not any of the others?