create-benchmark-rules.yaml Events Register as Failures

[dkintgen]

Hello,

The create-benchmark-rules.yaml template creates some checks as Metrics and some as Events. The ones created as Events do not seem to satisfy the CIS Benchmark requirements, at least as they are coded in the aws-cis-foundation-benchmark-checklist.py script.

So, my first question is, is having an Event instead of a Metric/Alarm for certain checks (3.8 and 3.9 are examples) actually violations of the Benchmark? If they are violations, is it possible to construct those as Metric/Alarm combinations instead of Events? If they are not violations, is there a way to modify the script to check for Events for these particular rules?

[jason-archidera]

I think the same is true for 3.4, 3.5, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14 as well.

I'm getting "Result = False" for them. The 'create-benchmark-rules.yaml' covers these, but as events instead of Metric/Alarms.