Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(mutelist): change logic for tags in aws mutelist #4803

Merged
merged 1 commit into from
Aug 20, 2024
Merged

fix(mutelist): change logic for tags in aws mutelist #4803

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 27 additions & 1 deletion docs/tutorials/mutelist.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,13 @@ Mutelist option works along with other options and will modify the output in the

## How the Mutelist Works

The Mutelist uses an "ANDed" and "ORed" logic to determine which resources, checks, regions, and tags should be muted. For each check, the Mutelist checks if the account, region, and resource match the specified criteria, using an "ANDed" logic. If tags are specified, the mutelist uses and "ORed" logic to see if at least one tag is present in the resource.
The **Mutelist** uses both "AND" and "OR" logic to determine which resources, checks, regions, and tags should be muted. For each check, the Mutelist evaluates whether the account, region, and resource match the specified criteria using "AND" logic. If tags are specified, the Mutelist can apply either "AND" or "OR" logic.

If any of the criteria do not match, the check is not muted.

???+ note
Remember that mutelist can be used with regular expressions.

## Mutelist Specification

???+ note
Expand Down Expand Up @@ -52,6 +55,29 @@ Mutelist:
Tags:
- "test=test" # Will ignore every resource containing the string "test" and the tags 'test=test' and
- "project=test|project=stage" # either of ('project=test' OR project=stage) in account 123456789012 and every region
"*":
Regions:
- "*"
Resources:
- "test"
Tags:
- "test=test"
- "project=test" # This will mute every resource containing the string "test" and BOTH tags at the same time.
"*":
Regions:
- "*"
Resources:
- "test"
Tags: # This will mute every resource containing the string "test" and the ones that contain EITHER the `test=test` OR `project=test` OR `project=dev`
- "test=test|project=(test|dev)"
"*":
Regions:
- "*"
Resources:
- "test"
Tags:
- "test=test" # This will mute every resource containing the string "test" and the tags `test=test` and either `project=test` OR `project=stage` in every account and region.
- "project=test|project=stage"

"*":
Checks:
Expand Down
23 changes: 17 additions & 6 deletions prowler/lib/mutelist/mutelist.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,9 @@ def is_muted_in_check(
muted_in_resource = self.is_item_matched(
muted_resources, finding_resource
)
muted_in_tags = self.is_item_matched(muted_tags, finding_tags)
muted_in_tags = self.is_item_matched(
muted_tags, finding_tags, tag=True
)

# For a finding to be muted requires the following set to True:
# - muted_in_check -> True
Expand Down Expand Up @@ -279,7 +281,9 @@ def is_excepted(
)

excepted_tags = exceptions.get("Tags", [])
is_tag_excepted = self.is_item_matched(excepted_tags, finding_tags)
is_tag_excepted = self.is_item_matched(
excepted_tags, finding_tags, tag=True
)

if (
not is_account_excepted
Expand All @@ -303,7 +307,7 @@ def is_excepted(
return False

@staticmethod
def is_item_matched(matched_items, finding_items):
def is_item_matched(matched_items, finding_items, tag=False) -> bool:
"""
Check if any of the items in matched_items are present in finding_items.

Expand All @@ -317,12 +321,19 @@ def is_item_matched(matched_items, finding_items):
try:
is_item_matched = False
if matched_items and (finding_items or finding_items == ""):
if tag:
is_item_matched = True
for item in matched_items:
if item.startswith("*"):
item = ".*" + item[1:]
if re.search(item, finding_items):
is_item_matched = True
break
if tag:
if not re.search(item, finding_items):
is_item_matched = False
break
else:
if re.search(item, finding_items):
is_item_matched = True
break
return is_item_matched
except Exception as error:
logger.error(
Expand Down
212 changes: 204 additions & 8 deletions tests/providers/aws/lib/mutelist/aws_mutelist_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@ def test_is_muted_lambda_concrete_check(self):
"",
)

def test_is_muted_tags(self):
def test_is_muted_tags_example1(self):
# Mutelist
mutelist_content = {
"Accounts": {
Expand All @@ -1132,7 +1132,7 @@ def test_is_muted_tags(self):
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)

assert mutelist.is_muted(
assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
Expand All @@ -1158,6 +1158,203 @@ def test_is_muted_tags(self):
)
)

def test_is_muted_tags_example2(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["environment=dev", "project=test(?!\.)"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)

assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler",
"environment=dev | project=test",
)

assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler",
"environment=dev",
)

assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev | project=prowler",
)

assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev | project=test.",
)

def test_is_muted_tags_and_logic(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["environment=dev", "project=prowler"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)

assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev | project=prowler",
)

assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev | project=myproj",
)

def test_is_muted_tags_or_logic_example1(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["environment=dev|project=.*"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)

assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev",
)

assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"project=prowler",
)

def test_is_muted_tags_or_logic_example2(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["project=(test|stage)"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)

assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"project=test",
)

def test_is_muted_tags_and_or_logic(self):
# Mutelist
mutelist_content = {
"Accounts": {
"*": {
"Checks": {
"check_test": {
"Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
"Resources": ["*"],
"Tags": ["team=dev", "environment=dev|project=.*"],
}
}
}
}
}
mutelist = AWSMutelist(mutelist_content=mutelist_content)

assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"team=dev | environment=dev",
)

assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"team=dev | project=prowler",
)

assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"team=ops",
)

assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"environment=dev",
)

assert not mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"check_test",
AWS_REGION_US_EAST_1,
"prowler-test",
"project=myproj",
)

def test_is_muted_specific_account_with_other_account_excepted(self):
# Mutelist
mutelist_content = {
Expand Down Expand Up @@ -1315,24 +1512,23 @@ def test_is_excepted(self):
"Tags": ["environment=test", "project=.*"],
}
mutelist = AWSMutelist(mutelist_content={})

assert mutelist.is_excepted(
assert not mutelist.is_excepted(
exceptions,
AWS_ACCOUNT_NUMBER,
"eu-central-1",
"test",
"environment=test",
)

assert mutelist.is_excepted(
assert not mutelist.is_excepted(
exceptions,
AWS_ACCOUNT_NUMBER,
"eu-south-3",
"test",
"environment=test",
)

assert mutelist.is_excepted(
assert not mutelist.is_excepted(
exceptions,
AWS_ACCOUNT_NUMBER,
"eu-south-3",
Expand Down Expand Up @@ -1413,7 +1609,7 @@ def test_is_excepted_in_account_and_tags(self):
"Accounts": [AWS_ACCOUNT_NUMBER],
"Regions": [],
"Resources": [],
"Tags": ["environment=test"],
"Tags": ["environment=test", "project=example"],
}
mutelist = AWSMutelist(mutelist_content={})

Expand All @@ -1422,7 +1618,7 @@ def test_is_excepted_in_account_and_tags(self):
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_CENTRAL_1,
"resource_1",
"environment=test",
"environment=test | project=example",
)

assert not mutelist.is_excepted(
Expand Down