fix(keyExpectedValue): ansible-aws queries convert to a recommendatio…

…n rather than a current status
Checkmarx · Jul 13, 2022 · adf6035 · adf6035
1 parent 207bcf3
commit adf6035
Show file tree

Hide file tree

Showing 43 changed files with 64 additions and 64 deletions.
diff --git a/assets/queries/ansible/aws/api_gateway_endpoint_config_is_not_private/query.rego b/assets/queries/ansible/aws/api_gateway_endpoint_config_is_not_private/query.rego
@@ -16,7 +16,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.endpoint_type", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'aws_api_gateway.endpoint_type' is 'PRIVATE'",
+		"keyExpectedValue": "'aws_api_gateway.endpoint_type' should be set to 'PRIVATE'",
 		"keyActualValue": "'aws_api_gateway.endpoint_type' is not 'PRIVATE'",
 	}
 }
diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/query.rego b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/query.rego
@@ -22,7 +22,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.%s", [task.name, modules[m], content_info.attribute]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("'%s.%s' has a authorizer set", [modules[m], content_info.attribute]),
+		"keyExpectedValue": sprintf("'%s.%s' should have an authorizer set", [modules[m], content_info.attribute]),
 		"keyActualValue": sprintf("'%s.%s' does not have a authorizer set", [modules[m], content_info.attribute]),
 	}
 }
@@ -43,7 +43,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.swagger_text", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("'%s.swagger_text' has a authorizer set", [modules[m]]),
+		"keyExpectedValue": sprintf("'%s.swagger_text' should have an authorizer set", [modules[m]]),
 		"keyActualValue": sprintf("'%s.swagger_text' does not have a authorizer set", [modules[m]]),
 	}
 }
@@ -62,7 +62,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("'%s' has swagger_file, swagger_text or swagger_dict set", [modules[m]]),
+		"keyExpectedValue": sprintf("'%s' should have swagger_file, swagger_text or swagger_dict set", [modules[m]]),
 		"keyActualValue": sprintf("'%s' does not have swagger_file, swagger_text or swagger_dict set", [modules[m]]),
 	}
 }

diff --git a/assets/queries/ansible/aws/api_gateway_without_ssl_certificate/query.rego b/assets/queries/ansible/aws/api_gateway_without_ssl_certificate/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "aws_api_gateway.validate_certs is set",
+		"keyExpectedValue": "aws_api_gateway.validate_certs should be set",
 		"keyActualValue": "aws_api_gateway.validate_certs is undefined",
 	}
 }

diff --git a/assets/queries/ansible/aws/auto_scaling_group_with_no_associated_elb/query.rego b/assets/queries/ansible/aws/auto_scaling_group_with_no_associated_elb/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("%s.load_balancers is set and not empty", [modules[m]]),
+		"keyExpectedValue": sprintf("%s.load_balancers should be set and not empty", [modules[m]]),
 		"keyActualValue": sprintf("%s.load_balancers is undefined", [modules[m]]),
 	}
 }

diff --git a/.../queries/ansible/aws/batch_job_definition_with_privileged_container_properties/query.rego b/.../queries/ansible/aws/batch_job_definition_with_privileged_container_properties/query.rego
@@ -16,7 +16,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.privileged", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.privileged is 'false' or not set", [task.name, modules[m]]),
+		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.privileged should be set to 'false' or not set", [task.name, modules[m]]),
 		"keyActualValue": sprintf("name={{%s}}.{{%s}}.privileged is 'true'", [task.name, modules[m]]),
 	}
 }
diff --git a/assets/queries/ansible/aws/ca_certificate_identifier_is_outdated/query.rego b/assets/queries/ansible/aws/ca_certificate_identifier_is_outdated/query.rego
@@ -36,7 +36,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.ca_certificate_identifier", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "rds_instance.ca_certificate_identifier is equal to 'rds-ca-2019'",
+		"keyExpectedValue": "rds_instance.ca_certificate_identifier should be equal to 'rds-ca-2019'",
 		"keyActualValue": "rds_instance.ca_certificate_identifier is not equal to 'rds-ca-2019'",
 	}
 }
diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_256/query.rego b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_256/query.rego
@@ -16,7 +16,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.community.aws.aws_acm.certificate", [task.name]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'community.aws.aws_acm.certificate' uses a RSA key with a length equal to or higher than 256 bytes",
+		"keyExpectedValue": "'community.aws.aws_acm.certificate' should use a RSA key with a length equal to or higher than 256 bytes",
 		"keyActualValue": "'community.aws.aws_acm.certificate' does not use a RSA key with a length equal to or higher than 256 bytes",
 	}
 }
diff --git a/assets/queries/ansible/aws/cloudfront_without_minimum_protocol_tls_1.2/query.rego b/assets/queries/ansible/aws/cloudfront_without_minimum_protocol_tls_1.2/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "cloudfront_distribution.viewer_certificate is defined",
+		"keyExpectedValue": "cloudfront_distribution.viewer_certificate should be defined",
 		"keyActualValue": "cloudfront_distribution.viewer_certificate is undefined",
 		"searchLine": common_lib.build_search_line(["playbooks", t, modules[m]], []),
 	}
@@ -39,7 +39,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.viewer_certificate.minimum_protocol_version", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.viewer_certificate.minimum_protocol_version' is TLSv1.2_x", [task.name, modules[m]]),
+		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.viewer_certificate.minimum_protocol_version' should be TLSv1.2_x", [task.name, modules[m]]),
 		"keyActualValue": sprintf("name={{%s}}.{{%s}}.viewer_certificate.minimum_protocol_version' is %s", [task.name, modules[m], protocol_version]),
 		"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "viewer_certificate", "minimum_protocol_version"], []),
 	}

diff --git a/assets/queries/ansible/aws/cloudtrail_log_file_validation_disabled/query.rego b/assets/queries/ansible/aws/cloudtrail_log_file_validation_disabled/query.rego
@@ -19,7 +19,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "cloudtrail.enable_log_file_validation or cloudtrail.log_file_validation_enabled is defined",
+		"keyExpectedValue": "cloudtrail.enable_log_file_validation or cloudtrail.log_file_validation_enabled should be defined",
 		"keyActualValue": "cloudtrail.enable_log_file_validation and cloudtrail.log_file_validation_enabled are undefined",
 	}
 }
@@ -40,7 +40,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.%s", [task.name, modules[m], attr]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("cloudtrail.%s is set to true or yes", [attr]),
+		"keyExpectedValue": sprintf("cloudtrail.%s should be set to true or yes", [attr]),
 		"keyActualValue": sprintf("cloudtrail.%s is not set to true nor yes", [attr]),
 	}
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/query.rego b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/query.rego
@@ -17,7 +17,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "cloudtrail.kms_key_id is set",
+		"keyExpectedValue": "cloudtrail.kms_key_id should be set",
 		"keyActualValue": "cloudtrail.kms_key_id is undefined",
 	}
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_not_integrated_with_cloudwatch/query.rego b/assets/queries/ansible/aws/cloudtrail_not_integrated_with_cloudwatch/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.%s is defined", [task.name, modules[m], properties[p]]),
+		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.%s should be defined", [task.name, modules[m], properties[p]]),
 		"keyActualValue": sprintf("name={{%s}}.{{%s}}.%s is not defined", [task.name, modules[m], properties[p]]),
 	}
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_sns_topic_name_undefined/query.rego b/assets/queries/ansible/aws/cloudtrail_sns_topic_name_undefined/query.rego
@@ -17,7 +17,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "cloudtrail.sns_topic_name is set",
+		"keyExpectedValue": "cloudtrail.sns_topic_name should be set",
 		"keyActualValue": "cloudtrail.sns_topic_name is undefined",
 	}
 }
@@ -35,7 +35,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.sns_topic_name", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "cloudtrail.sns_topic_name is set",
+		"keyExpectedValue": "cloudtrail.sns_topic_name should be set",
 		"keyActualValue": "cloudtrail.sns_topic_name is empty",
 	}
 }
diff --git a/assets/queries/ansible/aws/cloudwatch_without_retention_period_specified/query.rego b/assets/queries/ansible/aws/cloudwatch_without_retention_period_specified/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "cloudwatchlogs_log_group.retention is set",
+		"keyExpectedValue": "cloudwatchlogs_log_group.retention should be set",
 		"keyActualValue": "cloudwatchlogs_log_group.retention is undefined",
 	}
 }
@@ -39,7 +39,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.retention", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "cloudwatchlogs_log_group.retention is set and valid",
+		"keyExpectedValue": "cloudwatchlogs_log_group.retention should be set and valid",
 		"keyActualValue": "cloudwatchlogs_log_group.retention is set and invalid",
 	}
 }
diff --git a/assets/queries/ansible/aws/db_security_group_open_to_large_scope/query.rego b/assets/queries/ansible/aws/db_security_group_open_to_large_scope/query.rego
@@ -19,7 +19,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.rules.cidr_ip", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'ec2_group.rules.cidr_ip' is one of [10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12]",
+		"keyExpectedValue": "'ec2_group.rules.cidr_ip' should be one of [10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12]",
 		"keyActualValue": sprintf("'ec2_group.rules.cidr_ip' is [%s]", [values]),
 	}
 }

diff --git a/assets/queries/ansible/aws/db_security_group_with_public_scope/query.rego b/assets/queries/ansible/aws/db_security_group_with_public_scope/query.rego
@@ -20,7 +20,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.rules.cidr_ip", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'ec2_group.rules.cidr_ip' is one of [10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12]",
+		"keyExpectedValue": "'ec2_group.rules.cidr_ip' should be one of [10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12]",
 		"keyActualValue": sprintf("'ec2_group.rules.cidr_ip' is [%s]", [values]),
 	}
 }
@@ -40,7 +40,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.rules_egress.cidr_ip", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'ec2_group.rules_egress.cidr_ip' is one of [10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12]",
+		"keyExpectedValue": "'ec2_group.rules_egress.cidr_ip' should be one of [10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12]",
 		"keyActualValue": sprintf("'ec2_group.rules_egress.cidr_ip' is [%s]", [values]),
 	}
 }

diff --git a/assets/queries/ansible/aws/ecs_service_without_running_tasks/query.rego b/assets/queries/ansible/aws/ecs_service_without_running_tasks/query.rego
@@ -17,7 +17,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("%s.deployment_configuration is defined", [modules[m]]),
+		"keyExpectedValue": sprintf("%s.deployment_configuration should be defined", [modules[m]]),
 		"keyActualValue": sprintf("%&s.deployment_configuration is undefined", [modules[m]]),
 	}
 }
@@ -36,7 +36,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.deployment_configuration", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("%s.deployment_configuration has at least 1 task running", [modules[m]]),
+		"keyExpectedValue": sprintf("%s.deployment_configuration should have at least 1 task running", [modules[m]]),
 		"keyActualValue": sprintf("%&s.deployment_configuration must have at least 1 task running", [modules[m]]),
 	}
 }

diff --git a/assets/queries/ansible/aws/ecs_task_definition_network_mode_not_recommended/query.rego b/assets/queries/ansible/aws/ecs_task_definition_network_mode_not_recommended/query.rego
@@ -16,7 +16,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.network_mode", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'ecs_taskdefinition.network_mode' is 'awsvpc'",
+		"keyExpectedValue": "'ecs_taskdefinition.network_mode' should be set to 'awsvpc'",
 		"keyActualValue": sprintf("'ecs_taskdefinition.network_mode' is '%s'", [ecs_taskdefinition.network_mode]),
 	}
 }
diff --git a/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/query.rego b/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.containers.name={{%s}}.env", [task.name, modules[m], container.name]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'ecs_taskdefinition.containers.env' doesn't have 'password' value",
+		"keyExpectedValue": "'ecs_taskdefinition.containers.env' shouldn't have 'password' value",
 		"keyActualValue": "'ecs_taskdefinition.containers.env' has 'password' value",
 	}
 }

diff --git a/assets/queries/ansible/aws/iam_password_without_lowercase_letter/query.rego b/assets/queries/ansible/aws/iam_password_without_lowercase_letter/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.require_lowercase", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "iam_password_policy.require_lowercase is set and true",
+		"keyExpectedValue": "iam_password_policy.require_lowercase should be set and true",
 		"keyActualValue": "iam_password_policy.require_lowercase is undefined",
 	}
 }
@@ -36,7 +36,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.require_lowercase", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "iam_password_policy.require_lowercase is true",
+		"keyExpectedValue": "iam_password_policy.require_lowercase should be true",
 		"keyActualValue": "iam_password_policy.require_lowercase is false",
 	}
 }
diff --git a/assets/queries/ansible/aws/iam_password_without_minimum_length/query.rego b/assets/queries/ansible/aws/iam_password_without_minimum_length/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "iam_password_policy.min_pw_length/minimum_password_length is set and no less than 8",
+		"keyExpectedValue": "iam_password_policy.min_pw_length/minimum_password_length should be set and no less than 8",
 		"keyActualValue": "iam_password_policy.min_pw_length/minimum_password_length is undefined",
 	}
 }
@@ -37,7 +37,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.{{min_pw_length}}", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("iam_password_policy.%s is set and no less than 8", [variableName]),
+		"keyExpectedValue": sprintf("iam_password_policy.%s should be set and no less than 8", [variableName]),
 		"keyActualValue": sprintf("iam_password_policy.%s is less than 8", [variableName]),
 	}
 }

diff --git a/assets/queries/ansible/aws/iam_password_without_uppercase_letter/query.rego b/assets/queries/ansible/aws/iam_password_without_uppercase_letter/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.require_uppercase", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "iam_password_policy.require_uppercase set and true",
+		"keyExpectedValue": "iam_password_policy.require_uppercase should be set and true",
 		"keyActualValue": "iam_password_policy.require_uppercase undefined",
 	}
 }
@@ -36,7 +36,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.require_uppercase", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "iam_password_policy.require_uppercase is true",
+		"keyExpectedValue": "iam_password_policy.require_uppercase should be true",
 		"keyActualValue": "iam_password_policy.require_uppercase is false",
 	}
 }
diff --git a/assets/queries/ansible/aws/iam_policies_with_full_privileges/query.rego b/assets/queries/ansible/aws/iam_policies_with_full_privileges/query.rego
@@ -22,7 +22,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.policy", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "iam_managed_policy.policy.Statement.Action not contains '*'",
+		"keyExpectedValue": "iam_managed_policy.policy.Statement.Action should not contain '*'",
 		"keyActualValue": "iam_managed_policy.policy.Statement.Action contains '*'",
 		"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "policy"], []),
 	}

diff --git a/assets/queries/ansible/aws/iam_policy_grants_full_permissions/query.rego b/assets/queries/ansible/aws/iam_policy_grants_full_permissions/query.rego
@@ -22,7 +22,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.policy", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "iam_managed_policy.policy.Statement.Resource not equal '*'",
+		"keyExpectedValue": "iam_managed_policy.policy.Statement.Resource should not equal '*'",
 		"keyActualValue": "iam_managed_policy.policy.Statement.Resource equal '*'",
 		"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "policy"], []),
 	}

diff --git a/assets/queries/ansible/aws/kinesis_not_encrypted_with_kms/query.rego b/assets/queries/ansible/aws/kinesis_not_encrypted_with_kms/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "kinesis_stream.encryption_type is set",
+		"keyExpectedValue": "kinesis_stream.encryption_type should be set",
 		"keyActualValue": "kinesis_stream.encryption_type is undefined",
 	}
 }
@@ -36,7 +36,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "kinesis_stream.encryption_state is set",
+		"keyExpectedValue": "kinesis_stream.encryption_state should be set",
 		"keyActualValue": "kinesis_stream.encryption_state is undefined",
 	}
 }
@@ -54,7 +54,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.encryption_state", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "kinesis_stream.encryption_state is set to enabled",
+		"keyExpectedValue": "kinesis_stream.encryption_state should be set to enabled",
 		"keyActualValue": "kinesis_stream.encryption_state is not set to enabled",
 	}
 }
@@ -72,7 +72,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.encryption_type", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "kinesis_stream.encryption_type is set and not NONE",
+		"keyExpectedValue": "kinesis_stream.encryption_type should be set and not NONE",
 		"keyActualValue": "kinesis_stream.encryption_type is set but NONE",
 	}
 }
@@ -91,7 +91,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "kinesis_stream.key_id is set",
+		"keyExpectedValue": "kinesis_stream.key_id should be set",
 		"keyActualValue": "kinesis_stream.key_id is undefined",
 	}
 }
diff --git a/assets/queries/ansible/aws/lambda_functions_without_x-ray_tracing/query.rego b/assets/queries/ansible/aws/lambda_functions_without_x-ray_tracing/query.rego
@@ -18,7 +18,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": "lambda.tracing_mode is set",
+		"keyExpectedValue": "lambda.tracing_mode should be set",
 		"keyActualValue": "lambda.tracing_mode is undefined",
 	}
 }
@@ -36,7 +36,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.tracing_mode", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "lambda.tracing_mode is set to 'Active'",
+		"keyExpectedValue": "lambda.tracing_mode should be set to 'Active'",
 		"keyActualValue": "lambda.tracing_mode is not set to 'Active'",
 	}
 }
diff --git a/assets/queries/ansible/aws/lambda_permission_misconfigured/query.rego b/assets/queries/ansible/aws/lambda_permission_misconfigured/query.rego
@@ -16,7 +16,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.action", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.action is 'lambda:InvokeFunction'", [task.name, modules[m]]),
+		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.action should be 'lambda:InvokeFunction'", [task.name, modules[m]]),
 		"keyActualValue": sprintf("name={{%s}}.{{%s}}.action is %s", [task.name, modules[m], lambda.action]),
 	}
 }
diff --git a/assets/queries/ansible/aws/lambda_permission_principal_is_wildcard/query.rego b/assets/queries/ansible/aws/lambda_permission_principal_is_wildcard/query.rego
@@ -15,7 +15,7 @@ CxPolicy[result] {
 		"resourceName": task.name,
 		"searchKey": sprintf("name={{%s}}.{{%s}}.principal", [task.name, modules[m]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.principal doesn't contain a wildcard", [task.name, modules[m]]),
+		"keyExpectedValue": sprintf("name={{%s}}.{{%s}}.principal shouldn't contain a wildcard", [task.name, modules[m]]),
 		"keyActualValue": sprintf("name={{%s}}.{{%s}}.principal contains a wildcard", [task.name, modules[m]]),
 	}
 }