diff --git a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py index 7c66a80ce1..76ca16cba2 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py +++ b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py @@ -31,6 +31,9 @@ class bedrock_model_invocation_logs_encryption_enabled(Check): if ( log_group_arn in logs_client.log_groups and not logs_client.log_groups[log_group_arn].kms_id + ) or ( + log_group_arn + ":*" in logs_client.log_groups + and not logs_client.log_groups[log_group_arn + ":*"].kms_id ): cloudwatch_encryption = False if not s3_encryption and not cloudwatch_encryption: diff --git a/prowler/providers/aws/services/bedrock/bedrock_service.py b/prowler/providers/aws/services/bedrock/bedrock_service.py index 3cf9f9dcfb..c1c616e8ef 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_service.py +++ b/prowler/providers/aws/services/bedrock/bedrock_service.py @@ -3,6 +3,7 @@ from typing import Optional from pydantic import BaseModel from prowler.lib.logger import logger +from prowler.lib.scan_filters.scan_filters import is_resource_filtered from prowler.providers.aws.lib.service.service import AWSService @@ -48,12 +49,15 @@ class Bedrock(AWSService): logger.info("Bedrock - Listing Guardrails...") try: for guardrail in regional_client.list_guardrails().get("guardrails", []): - self.guardrails[guardrail["arn"]] = Guardrail( - id=guardrail["id"], - name=guardrail["name"], - arn=guardrail["arn"], - region=regional_client.region, - ) + if not self.audit_resources or ( + is_resource_filtered(guardrail["arn"], self.audit_resources) + ): + self.guardrails[guardrail["arn"]] = Guardrail( + id=guardrail["id"], + name=guardrail["name"], + arn=guardrail["arn"], + region=regional_client.region, + ) except Exception as error: logger.error( f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"