ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(mutelist): Handle exceptions before match (#4024)

Browse Source
This commit is contained in:
Pepe Fagoaga
2024-05-20 12:30:50 +02:00
committed by GitHub
parent 0f7c301896
commit 73b3484ce8
2 changed files with 50 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/lib/mutelist/mutelist.py
+15 -11
View File
@@ -211,14 +211,22 @@ def is_muted_in_check(
# map lambda to awslambda
muted_check = re.sub("^lambda", "awslambda", muted_check)
check_match = (
"*" == muted_check
or check == muted_check
or re.search(muted_check, check)
)
# Check if the finding is excepted
exceptions = muted_check_info.get("Exceptions")
if is_excepted(
exceptions,
audited_account,
finding_region,
finding_resource,
finding_tags,
if (
is_excepted(
exceptions,
audited_account,
finding_region,
finding_resource,
finding_tags,
)
and check_match
):
# Break loop and return default value since is excepted
break
@@ -230,11 +238,7 @@ def is_muted_in_check(
if not muted_tags:
muted_tags = "*"
# If there is a *, it affects to all checks
if (
"*" == muted_check
or check == muted_check
or re.search(muted_check, check)
):
if check_match:
muted_in_check = True
muted_in_region = is_muted_in_region(muted_regions, finding_region)
muted_in_resource = is_muted_in_resource(
tests/lib/mutelist/mutelist_test.py
+35
View File
@@ -452,6 +452,41 @@ class TestMutelist:
)
)
def test_is_muted_exceptions_before_match(self):
# Mutelist example
mutelist = {
"Accounts": {
"*": {
"Checks": {
"accessanalyzer_enabled": {
"Exceptions": {
"Accounts": [],
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": [],
"Tags": [],
},
"Regions": ["*"],
"Resources": ["*"],
"Tags": ["*"],
},
"sns_*": {
"Regions": ["*"],
"Resources": ["aws-controltower-*"],
},
}
}
}
}
assert is_muted(
mutelist,
AWS_ACCOUNT_NUMBER,
"sns_topics_not_publicly_accessible",
AWS_REGION_EU_WEST_1,
"aws-controltower-AggregateSecurityNotifications",
"",
)
def test_is_muted_all_and_single_account(self):
# Mutelist example
mutelist = {