fix(bedrock): add filtering and handle different ARNs (#5453)

prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py

@@ -31,6 +31,9 @@ class bedrock_model_invocation_logs_encryption_enabled(Check):
                     if (
                         log_group_arn in logs_client.log_groups
                         and not logs_client.log_groups[log_group_arn].kms_id
+                    ) or (
+                        log_group_arn + ":*" in logs_client.log_groups
+                        and not logs_client.log_groups[log_group_arn + ":*"].kms_id
                     ):
                         cloudwatch_encryption = False
                 if not s3_encryption and not cloudwatch_encryption:

prowler/providers/aws/services/bedrock/bedrock_service.py

@@ -3,6 +3,7 @@ from typing import Optional
 from pydantic import BaseModel
 
 from prowler.lib.logger import logger
+from prowler.lib.scan_filters.scan_filters import is_resource_filtered
 from prowler.providers.aws.lib.service.service import AWSService
 
 
@@ -48,12 +49,15 @@ class Bedrock(AWSService):
         logger.info("Bedrock - Listing Guardrails...")
         try:
             for guardrail in regional_client.list_guardrails().get("guardrails", []):
-                self.guardrails[guardrail["arn"]] = Guardrail(
-                    id=guardrail["id"],
-                    name=guardrail["name"],
-                    arn=guardrail["arn"],
-                    region=regional_client.region,
-                )
+                if not self.audit_resources or (
+                    is_resource_filtered(guardrail["arn"], self.audit_resources)
+                ):
+                    self.guardrails[guardrail["arn"]] = Guardrail(
+                        id=guardrail["id"],
+                        name=guardrail["name"],
+                        arn=guardrail["arn"],
+                        region=regional_client.region,
+                    )
         except Exception as error:
             logger.error(
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"