Skip to content

aws/config: fix null EvaluationResults crash in CEL program #18751

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kcreddy wants to merge 3 commits into from
Closed

aws/config: fix null EvaluationResults crash in CEL program #18751

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cedb645
aws/config: fix null EvaluationResults crash in CEL program
kcreddy May 1, 2026
a2f6db8
update PR number
kcreddy May 5, 2026
2d43303
Add type() to the condition and remove optional access
kcreddy May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
aws/config: fix null EvaluationResults crash in CEL program 
The GetComplianceDetailsByConfigRule AWS API can return
{"EvaluationResults": null} instead of an empty array when no
compliance results exist for a rule. The CEL program used
has(body.EvaluationResults) && size(body.EvaluationResults) > 0
to check for results, but has() returns true for null values and
size(null) has no overload in CEL, causing a runtime crash.

Replace with size(body.?EvaluationResults.orValue([])) > 0 which
uses optional field access to safely handle both missing and null
values.

Update the system test mock to return null EvaluationResults for
one config rule, covering this scenario.
  • Loading branch information
@kcreddy
kcreddy committed May 1, 2026
commit cedb6458178d4b5262d2f0a94ffe4677b0c9dff2
5 changes: 5 additions & 0 deletions packages/aws/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "6.14.1"
changes:
- description: Fix CEL evaluation failure in AWS Config when GetComplianceDetailsByConfigRule returns null EvaluationResults.
type: bugfix
link: https://github.com/elastic/integrations/pull/1
- version: "6.14.0"
changes:
- description: Enable agentless deployment for AWS RDS metrics.
Expand Down
4 changes: 3 additions & 1 deletion packages/aws/data_stream/config/_dev/deploy/docker/files/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,8 @@ rules:
]
}
`}}
# Returns null EvaluationResults to verify the program handles null gracefully
# (AWS API can return null instead of an empty array when no results exist).
- path: /
methods: ["POST"]
request_headers:
Expand All @@ -200,7 +202,7 @@ rules:
body: |-
{{ minify_json `
{
"EvaluationResults": []
"EvaluationResults": null
}
`}}
- path: /
Expand Down
4 changes: 2 additions & 2 deletions packages/aws/data_stream/config/agent/stream/cel.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,8 +311,8 @@ program: |
// Response Processing: Successfully got compliance details
bytes(resp.Body).decode_json().as(body,
{
"events": (has(body.EvaluationResults) && size(body.EvaluationResults) > 0) ?
body.EvaluationResults.orValue([]).map(evt,
"events": (size(body.?EvaluationResults.orValue([])) > 0) ?
body.EvaluationResults.map(evt,
{
"message": evt.with(
{
Expand Down
2 changes: 1 addition & 1 deletion packages/aws/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 3.4.0
name: aws
title: AWS
version: 6.14.0
version: 6.14.1
description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
type: integration
categories:
Expand Down
Loading