diff --git a/docs/tutorials/mutelist.md b/docs/tutorials/mutelist.md index f67594c0ab..44d9f9e90b 100644 --- a/docs/tutorials/mutelist.md +++ b/docs/tutorials/mutelist.md @@ -9,10 +9,13 @@ Mutelist option works along with other options and will modify the output in the ## How the Mutelist Works -The Mutelist uses an "ANDed" and "ORed" logic to determine which resources, checks, regions, and tags should be muted. For each check, the Mutelist checks if the account, region, and resource match the specified criteria, using an "ANDed" logic. If tags are specified, the mutelist uses and "ORed" logic to see if at least one tag is present in the resource. +The **Mutelist** uses both "AND" and "OR" logic to determine which resources, checks, regions, and tags should be muted. For each check, the Mutelist evaluates whether the account, region, and resource match the specified criteria using "AND" logic. If tags are specified, the Mutelist can apply either "AND" or "OR" logic. If any of the criteria do not match, the check is not muted. +???+ note + Remember that mutelist can be used with regular expressions. + ## Mutelist Specification ???+ note @@ -52,6 +55,29 @@ Mutelist: Tags: - "test=test" # Will ignore every resource containing the string "test" and the tags 'test=test' and - "project=test|project=stage" # either of ('project=test' OR project=stage) in account 123456789012 and every region + "*": + Regions: + - "*" + Resources: + - "test" + Tags: + - "test=test" + - "project=test" # This will mute every resource containing the string "test" and BOTH tags at the same time. + "*": + Regions: + - "*" + Resources: + - "test" + Tags: # This will mute every resource containing the string "test" and the ones that contain EITHER the `test=test` OR `project=test` OR `project=dev` + - "test=test|project=(test|dev)" + "*": + Regions: + - "*" + Resources: + - "test" + Tags: + - "test=test" # This will mute every resource containing the string "test" and the tags `test=test` and either `project=test` OR `project=stage` in every account and region. + - "project=test|project=stage" "*": Checks: diff --git a/prowler/lib/mutelist/mutelist.py b/prowler/lib/mutelist/mutelist.py index 479847492d..7e0cbac129 100644 --- a/prowler/lib/mutelist/mutelist.py +++ b/prowler/lib/mutelist/mutelist.py @@ -211,7 +211,9 @@ class Mutelist(ABC): muted_in_resource = self.is_item_matched( muted_resources, finding_resource ) - muted_in_tags = self.is_item_matched(muted_tags, finding_tags) + muted_in_tags = self.is_item_matched( + muted_tags, finding_tags, tag=True + ) # For a finding to be muted requires the following set to True: # - muted_in_check -> True @@ -279,7 +281,9 @@ class Mutelist(ABC): ) excepted_tags = exceptions.get("Tags", []) - is_tag_excepted = self.is_item_matched(excepted_tags, finding_tags) + is_tag_excepted = self.is_item_matched( + excepted_tags, finding_tags, tag=True + ) if ( not is_account_excepted @@ -303,7 +307,7 @@ class Mutelist(ABC): return False @staticmethod - def is_item_matched(matched_items, finding_items): + def is_item_matched(matched_items, finding_items, tag=False) -> bool: """ Check if any of the items in matched_items are present in finding_items. @@ -317,12 +321,19 @@ class Mutelist(ABC): try: is_item_matched = False if matched_items and (finding_items or finding_items == ""): + if tag: + is_item_matched = True for item in matched_items: if item.startswith("*"): item = ".*" + item[1:] - if re.search(item, finding_items): - is_item_matched = True - break + if tag: + if not re.search(item, finding_items): + is_item_matched = False + break + else: + if re.search(item, finding_items): + is_item_matched = True + break return is_item_matched except Exception as error: logger.error( diff --git a/tests/providers/aws/lib/mutelist/aws_mutelist_test.py b/tests/providers/aws/lib/mutelist/aws_mutelist_test.py index a7902abdec..3006380819 100644 --- a/tests/providers/aws/lib/mutelist/aws_mutelist_test.py +++ b/tests/providers/aws/lib/mutelist/aws_mutelist_test.py @@ -1115,7 +1115,7 @@ class TestAWSMutelist: "", ) - def test_is_muted_tags(self): + def test_is_muted_tags_example1(self): # Mutelist mutelist_content = { "Accounts": { @@ -1132,7 +1132,7 @@ class TestAWSMutelist: } mutelist = AWSMutelist(mutelist_content=mutelist_content) - assert mutelist.is_muted( + assert not mutelist.is_muted( AWS_ACCOUNT_NUMBER, "check_test", AWS_REGION_US_EAST_1, @@ -1158,6 +1158,203 @@ class TestAWSMutelist: ) ) + def test_is_muted_tags_example2(self): + # Mutelist + mutelist_content = { + "Accounts": { + "*": { + "Checks": { + "check_test": { + "Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1], + "Resources": ["*"], + "Tags": ["environment=dev", "project=test(?!\.)"], + } + } + } + } + } + mutelist = AWSMutelist(mutelist_content=mutelist_content) + + assert mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler", + "environment=dev | project=test", + ) + + assert not mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler", + "environment=dev", + ) + + assert not mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "environment=dev | project=prowler", + ) + + assert not mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "environment=dev | project=test.", + ) + + def test_is_muted_tags_and_logic(self): + # Mutelist + mutelist_content = { + "Accounts": { + "*": { + "Checks": { + "check_test": { + "Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1], + "Resources": ["*"], + "Tags": ["environment=dev", "project=prowler"], + } + } + } + } + } + mutelist = AWSMutelist(mutelist_content=mutelist_content) + + assert mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "environment=dev | project=prowler", + ) + + assert not mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "environment=dev | project=myproj", + ) + + def test_is_muted_tags_or_logic_example1(self): + # Mutelist + mutelist_content = { + "Accounts": { + "*": { + "Checks": { + "check_test": { + "Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1], + "Resources": ["*"], + "Tags": ["environment=dev|project=.*"], + } + } + } + } + } + mutelist = AWSMutelist(mutelist_content=mutelist_content) + + assert mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "environment=dev", + ) + + assert mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "project=prowler", + ) + + def test_is_muted_tags_or_logic_example2(self): + # Mutelist + mutelist_content = { + "Accounts": { + "*": { + "Checks": { + "check_test": { + "Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1], + "Resources": ["*"], + "Tags": ["project=(test|stage)"], + } + } + } + } + } + mutelist = AWSMutelist(mutelist_content=mutelist_content) + + assert mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "project=test", + ) + + def test_is_muted_tags_and_or_logic(self): + # Mutelist + mutelist_content = { + "Accounts": { + "*": { + "Checks": { + "check_test": { + "Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1], + "Resources": ["*"], + "Tags": ["team=dev", "environment=dev|project=.*"], + } + } + } + } + } + mutelist = AWSMutelist(mutelist_content=mutelist_content) + + assert mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "team=dev | environment=dev", + ) + + assert mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "team=dev | project=prowler", + ) + + assert not mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "team=ops", + ) + + assert not mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "environment=dev", + ) + + assert not mutelist.is_muted( + AWS_ACCOUNT_NUMBER, + "check_test", + AWS_REGION_US_EAST_1, + "prowler-test", + "project=myproj", + ) + def test_is_muted_specific_account_with_other_account_excepted(self): # Mutelist mutelist_content = { @@ -1315,8 +1512,7 @@ class TestAWSMutelist: "Tags": ["environment=test", "project=.*"], } mutelist = AWSMutelist(mutelist_content={}) - - assert mutelist.is_excepted( + assert not mutelist.is_excepted( exceptions, AWS_ACCOUNT_NUMBER, "eu-central-1", @@ -1324,7 +1520,7 @@ class TestAWSMutelist: "environment=test", ) - assert mutelist.is_excepted( + assert not mutelist.is_excepted( exceptions, AWS_ACCOUNT_NUMBER, "eu-south-3", @@ -1332,7 +1528,7 @@ class TestAWSMutelist: "environment=test", ) - assert mutelist.is_excepted( + assert not mutelist.is_excepted( exceptions, AWS_ACCOUNT_NUMBER, "eu-south-3", @@ -1413,7 +1609,7 @@ class TestAWSMutelist: "Accounts": [AWS_ACCOUNT_NUMBER], "Regions": [], "Resources": [], - "Tags": ["environment=test"], + "Tags": ["environment=test", "project=example"], } mutelist = AWSMutelist(mutelist_content={}) @@ -1422,7 +1618,7 @@ class TestAWSMutelist: AWS_ACCOUNT_NUMBER, AWS_REGION_EU_CENTRAL_1, "resource_1", - "environment=test", + "environment=test | project=example", ) assert not mutelist.is_excepted(