From 80c4802b362fbd2763a201c478b088f8c8635a2f Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Fri, 30 Aug 2024 10:13:00 +0200
Subject: [PATCH] chore(aws_mutelist): Add more Control Tower resources and
 tests (#4900)

---
 prowler/config/aws_mutelist.yaml              |   7 +-
 .../aws/lib/mutelist/aws_mutelist_test.py     | 129 ++++++++++++++++++
 2 files changed, 134 insertions(+), 2 deletions(-)

diff --git a/prowler/config/aws_mutelist.yaml b/prowler/config/aws_mutelist.yaml
index cbc12d36d6..134445781e 100644
--- a/prowler/config/aws_mutelist.yaml
+++ b/prowler/config/aws_mutelist.yaml
@@ -19,8 +19,11 @@ Mutelist:
             - "StackSet-AWSControlTowerSecurityResources-*"
             - "StackSet-AWSControlTowerLoggingResources-*"
             - "StackSet-AWSControlTowerExecutionRole-*"
-            - "AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER"
-            - "AWSControlTowerBP-BASELINE-CONFIG-MASTER"
+            - "AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER*"
+            - "AWSControlTowerBP-BASELINE-CONFIG-MASTER*"
+            - "StackSet-AWSControlTower*"
+            - "CLOUDTRAIL-ENABLED-ON-SHARED-ACCOUNTS-*"
+            - "AFT-Backend*"
         "cloudtrail_*":
           Regions:
             - "*"
diff --git a/tests/providers/aws/lib/mutelist/aws_mutelist_test.py b/tests/providers/aws/lib/mutelist/aws_mutelist_test.py
index 3006380819..848f59bf91 100644
--- a/tests/providers/aws/lib/mutelist/aws_mutelist_test.py
+++ b/tests/providers/aws/lib/mutelist/aws_mutelist_test.py
@@ -1,5 +1,6 @@
 import io
 from json import dumps
+from os import path
 
 import botocore
 import yaml
@@ -843,6 +844,134 @@ class TestAWSMutelist:
             "",
         )
 
+    def test_is_muted_aws_default_mutelist(
+        self,
+    ):
+
+        mutelist = AWSMutelist(
+            mutelist_path=f"{path.dirname(path.realpath(__file__))}/../../../../../prowler/config/aws_mutelist.yaml"
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerBP-BASELINE-CONFIG-AAAAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-READ-PROHIBITED-AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerGuardrailAWS-GR-DETECT",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "CLOUDTRAIL-ENABLED-ON-SHARED-ACCOUNTS-AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerBP-BASELINE-ROLES-AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerBP-SECURITY-TOPICS-AAAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES-AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerSecurityResources-AAAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-WRITE-PROHIBITED-AAAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "AFT-Backend/AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "AWSControlTowerBP-BASELINE-CONFIG-MASTER/AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER/AAA",
+            "",
+        )
+
+        assert mutelist.is_muted(
+            AWS_ACCOUNT_NUMBER,
+            "cloudformation_stacks_termination_protection_enabled",
+            AWS_REGION_EU_WEST_1,
+            "StackSet-AWSControlTowerBP-VPC-ACCOUNT-FACTORY-V1-AAA",
+            "",
+        )
+
     def test_is_muted_single_account(self):
         # Mutelist
         mutelist_content = {