ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(mutelist): change logic for tags in aws mutelist (#4786)

Browse Source
This commit is contained in:
Pedro Martín
2024-08-20 13:38:06 +02:00
committed by GitHub
parent dec5fb6428
commit e11bb478d6
3 changed files with 248 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tutorials/mutelist.md
+27 -1
View File
@@ -9,10 +9,13 @@ Mutelist option works along with other options and will modify the output in the
## How the Mutelist Works
The Mutelist uses an "ANDed" and "ORed" logic to determine which resources, checks, regions, and tags should be muted. For each check, the Mutelist checks if the account, region, and resource match the specified criteria, using an "ANDed" logic. If tags are specified, the mutelist uses and "ORed" logic to see if at least one tag is present in the resource.
The **Mutelist** uses both "AND" and "OR" logic to determine which resources, checks, regions, and tags should be muted. For each check, the Mutelist evaluates whether the account, region, and resource match the specified criteria using "AND" logic. If tags are specified, the Mutelist can apply either "AND" or "OR" logic.
If any of the criteria do not match, the check is not muted.
???+ note
Remember that mutelist can be used with regular expressions.
## Mutelist Specification
???+ note
@@ -52,6 +55,29 @@ Mutelist:
Tags:
- "test=test" # Will mute every resource containing the string "test" and the tags 'test=test' and
- "project=test|project=stage" # either of ('project=test' OR project=stage) in account 123456789012 and every region
"*":
Regions:
- "*"
Resources:
- "test"
Tags:
- "test=test"
- "project=test" # This will mute every resource containing the string "test" and BOTH tags at the same time.
"*":
Regions:
- "*"
Resources:
- "test"
Tags: # This will mute every resource containing the string "test" and the ones that contain EITHER the `test=test` OR `project=test` OR `project=dev`
- "test=test|project=(test|dev)"
"*":
Regions:
- "*"
Resources:
- "test"
Tags:
- "test=test" # This will mute every resource containing the string "test" and the tags `test=test` and either `project=test` OR `project=stage` in every account and region.
- "project=test|project=stage"
"*":
Checks:
prowler/lib/mutelist/mutelist.py
+17 -6
View File
@@ -211,7 +211,9 @@ class Mutelist(ABC):
muted_in_resource = self.is_item_matched(
muted_resources, finding_resource
)
muted_in_tags = self.is_item_matched(muted_tags, finding_tags)
muted_in_tags = self.is_item_matched(
muted_tags, finding_tags, tag=True
)
# For a finding to be muted requires the following set to True:
# - muted_in_check -> True
@@ -279,7 +281,9 @@ class Mutelist(ABC):
)
excepted_tags = exceptions.get("Tags", [])
is_tag_excepted = self.is_item_matched(excepted_tags, finding_tags)
is_tag_excepted = self.is_item_matched(
excepted_tags, finding_tags, tag=True
)
if (
not is_account_excepted
@@ -303,7 +307,7 @@ class Mutelist(ABC):
return False
@staticmethod
def is_item_matched(matched_items, finding_items):
def is_item_matched(matched_items, finding_items, tag=False) -> bool:
"""
Check if any of the items in matched_items are present in finding_items.
@@ -317,12 +321,19 @@ class Mutelist(ABC):
try:
is_item_matched = False
if matched_items and (finding_items or finding_items == ""):
if tag:
is_item_matched = True
for item in matched_items:
if item.startswith("*"):
item = ".*" + item[1:]
if re.search(item, finding_items):
is_item_matched = True
break
if tag:
if not re.search(item, finding_items):
is_item_matched = False
break
else:
if re.search(item, finding_items):
is_item_matched = True
break
return is_item_matched
except Exception as error:
logger.error(
tests/providers/aws/lib/mutelist/aws_mutelist_test.py
+204 -8
View File
@@ -1115,7 +1115,7 @@ class TestAWSMutelist:
"",
)
def test_is_muted_tags(self):
def test_is_muted_tags_example1(self):
# Mutelist
mutelist_content = {
"Accounts": {
@@ -1132,7 +1132,7 @@ class TestAWSMutelist:
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)
assert mutelist.is_muted(
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
@@ -1158,6 +1158,203 @@ class TestAWSMutelist:
)
)
def test_is_muted_tags_example2(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["environment=dev", "project=test(?!\.)"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler",
"environment=dev | project=test",
)
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler",
"environment=dev",
)
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev | project=prowler",
)
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev | project=test.",
)
def test_is_muted_tags_and_logic(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["environment=dev", "project=prowler"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev | project=prowler",
)
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev | project=myproj",
)
def test_is_muted_tags_or_logic_example1(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["environment=dev|project=.*"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"project=prowler",
)
def test_is_muted_tags_or_logic_example2(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["project=(test|stage)"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"project=test",
)
def test_is_muted_tags_and_or_logic(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["team=dev", "environment=dev|project=.*"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"team=dev | environment=dev",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"team=dev | project=prowler",
)
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"team=ops",
)
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev",
)
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"project=myproj",
)
def test_is_muted_specific_account_with_other_account_excepted(self):
# Mutelist
mutelist_content = {
@@ -1315,8 +1512,7 @@ class TestAWSMutelist:
"Tags": ["environment=test", "project=.*"],
}
mutelist = AWSMutelist(mutelist_content={})
assert mutelist.is_excepted(
assert not mutelist.is_excepted(
exceptions,
AWS_ACCOUNT_NUMBER,
"eu-central-1",
@@ -1324,7 +1520,7 @@ class TestAWSMutelist:
"environment=test",
)
assert mutelist.is_excepted(
assert not mutelist.is_excepted(
exceptions,
AWS_ACCOUNT_NUMBER,
"eu-south-3",
@@ -1332,7 +1528,7 @@ class TestAWSMutelist:
"environment=test",
)
assert mutelist.is_excepted(
assert not mutelist.is_excepted(
exceptions,
AWS_ACCOUNT_NUMBER,
"eu-south-3",
@@ -1413,7 +1609,7 @@ class TestAWSMutelist:
"Accounts": [AWS_ACCOUNT_NUMBER],
"Regions": [],
"Resources": [],
"Tags": ["environment=test"],
"Tags": ["environment=test", "project=example"],
}
mutelist = AWSMutelist(mutelist_content={})
@@ -1422,7 +1618,7 @@ class TestAWSMutelist:
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_CENTRAL_1,
"resource_1",
"environment=test",
"environment=test | project=example",
)
assert not mutelist.is_excepted(