Skip to content

Commit

Permalink
chore(mutelist): remove space within mutelist name (#3690)
Browse files Browse the repository at this point in the history
  • Loading branch information
MrCloudSec authored Apr 8, 2024
1 parent 8198ea4 commit 185b4cb
Show file tree
Hide file tree
Showing 14 changed files with 39 additions and 41 deletions.
34 changes: 17 additions & 17 deletions docs/tutorials/mutelist.md
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
# Mute Listing
# Mutelisting
Sometimes you may find resources that are intentionally configured in a certain way that may be a bad practice but it is all right with it, for example an AWS S3 Bucket open to the internet hosting a web site, or an AWS Security Group with an open port needed in your use case.

Mute List option works along with other options and adds a `MUTED` instead of `MANUAL`, `PASS` or `FAIL` to any output format.
Mutelist option works along with other options and adds a `MUTED` instead of `MANUAL`, `PASS` or `FAIL` to any output format.

You can use `-w`/`--mutelist-file` with the path of your mutelist yaml file:
```
prowler <provider> -w mutelist.yaml
```

## Mute List Yaml File Syntax
## Mutelist Yaml File Syntax

???+ note
For Azure provider, the Account ID is the Subscription Name and the Region is the Location.
Expand All @@ -19,16 +19,16 @@ prowler <provider> -w mutelist.yaml
???+ note
For Kubernetes provider, the Account ID is the Cluster Name and the Region is the Namespace.

The Mute List file is a YAML file with the following syntax:
The Mutelist file is a YAML file with the following syntax:

```yaml
### Account, Check and/or Region can be * to apply for all the cases.
### Resources and tags are lists that can have either Regex or Keywords.
### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
### Use an alternation Regex to match one of multiple tags with "ORed" logic.
### For each check you can except Accounts, Regions, Resources and/or Tags.
########################### MUTE LIST EXAMPLE ###########################
Mute List:
########################### MUTELIST EXAMPLE ###########################
Mutelist:
Accounts:
"123456789012":
Checks:
Expand Down Expand Up @@ -97,7 +97,7 @@ The Mute List file is a YAML file with the following syntax:
## Mute specific AWS regions
If you want to mute failed findings only in specific regions, create a file with the following syntax and run it with `prowler aws -w mutelist.yaml`:

Mute List:
Mutelist:
Accounts:
"*":
Checks:
Expand All @@ -108,16 +108,16 @@ If you want to mute failed findings only in specific regions, create a file with
Resources:
- "*"

## Default AWS Mute List
For the AWS Provider, Prowler is executed with a Default AWS Mute List with the AWS Resources that should be muted such as all resources created by AWS Control Tower when setting up a landing zone.
You can see this Mute List file in [`prowler/config/aws_mutelist.yaml`](https://github.com/prowler-cloud/prowler/blob/master/prowler/config/aws_allowlist.yaml).
## Default AWS Mutelist
For the AWS Provider, Prowler is executed with a Default AWS Mutelist with the AWS Resources that should be muted such as all resources created by AWS Control Tower when setting up a landing zone.
You can see this Mutelist file in [`prowler/config/aws_mutelist.yaml`](https://github.com/prowler-cloud/prowler/blob/master/prowler/config/aws_allowlist.yaml).

## Supported AWS Mute List Locations
## Supported AWS Mutelist Locations

The mutelisting flag supports the following AWS locations when using the AWS Provider:

### AWS S3 URI
You will need to pass the S3 URI where your Mute List YAML file was uploaded to your bucket:
You will need to pass the S3 URI where your Mutelist YAML file was uploaded to your bucket:
```
prowler aws -w s3://<bucket>/<prefix>/mutelist.yaml
```
Expand All @@ -126,7 +126,7 @@ prowler aws -w s3://<bucket>/<prefix>/mutelist.yaml

### AWS DynamoDB Table ARN

You will need to pass the DynamoDB Mute List Table ARN:
You will need to pass the DynamoDB Mutelist Table ARN:

```
prowler aws -w arn:aws:dynamodb:<region_name>:<account_id>:table/<table_name>
Expand All @@ -135,7 +135,7 @@ prowler aws -w arn:aws:dynamodb:<region_name>:<account_id>:table/<table_name>
1. The DynamoDB Table must have the following String keys:
<img src="../img/mutelist-keys.png"/>

- The Mute List Table must have the following columns:
- The Mutelist Table must have the following columns:
- Accounts (String): This field can contain either an Account ID or an `*` (which applies to all the accounts that use this table as an mutelist).
- Checks (String): This field can contain either a Prowler Check Name or an `*` (which applies to all the scanned checks).
- Regions (List): This field contains a list of regions where this mutelist rule is applied (it can also contains an `*` to apply all scanned regions).
Expand Down Expand Up @@ -170,14 +170,14 @@ Make sure that the credentials that Prowler uses can invoke the Lambda Function:
Resource: arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME
```

The Lambda Function can then generate an Mute List dynamically. Here is the code an example Python Lambda Function that
generates an Mute List:
The Lambda Function can then generate an Mutelist dynamically. Here is the code an example Python Lambda Function that
generates an Mutelist:

```
def handler(event, context):
checks = {}
checks["vpc_flow_logs_enabled"] = { "Regions": [ "*" ], "Resources": [ "" ], Optional("Tags"): [ "key:value" ] }
al = { "Mute List": { "Accounts": { "*": { "Checks": checks } } } }
al = { "Mutelist": { "Accounts": { "*": { "Checks": checks } } } }
return al
```
2 changes: 1 addition & 1 deletion mkdocs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ nav:
- Slack Integration: tutorials/integrations.md
- Configuration File: tutorials/configuration_file.md
- Logging: tutorials/logging.md
- Mute List: tutorials/mutelist.md
- Mutelist: tutorials/mutelist.md
- Check Aliases: tutorials/check-aliases.md
- Custom Metadata: tutorials/custom-checks-metadata.md
- Scan Unused Services: tutorials/scan-unused-services.md
Expand Down
2 changes: 1 addition & 1 deletion prowler/__main__.py
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,7 @@ def prowler():
# Sort final check list
checks_to_execute = sorted(checks_to_execute)

# Setup Mute List
# Setup Mutelist
global_provider.mutelist = args.mutelist_file

# Setup Output Options
Expand Down
2 changes: 1 addition & 1 deletion prowler/config/aws_mutelist.yaml
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Mute List:
Mutelist:
Accounts:
"*":
########################### AWS CONTROL TOWER ###########################
Expand Down
4 changes: 2 additions & 2 deletions prowler/config/aws_mutelist_example.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
### Use an alternation Regex to match one of multiple tags with "ORed" logic.
### For each check you can except Accounts, Regions, Resources and/or Tags.
########################### MUTE LIST EXAMPLE ###########################
Mute List:
########################### MUTELIST EXAMPLE ###########################
Mutelist:
Accounts:
"123456789012":
Checks:
Expand Down
4 changes: 2 additions & 2 deletions prowler/config/azure_mutelist_example.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@
### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
### Use an alternation Regex to match one of multiple tags with "ORed" logic.
### For each check you can except Accounts, Regions, Resources and/or Tags.
########################### MUTE LIST EXAMPLE ###########################
Mute List:
########################### MUTELIST EXAMPLE ###########################
Mutelist:
Accounts:
"Azure subscription 1":
Checks:
Expand Down
4 changes: 2 additions & 2 deletions prowler/config/gcp_mutelist_example.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@
### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
### Use an alternation Regex to match one of multiple tags with "ORed" logic.
### For each check you can except Accounts, Regions, Resources and/or Tags.
########################### MUTE LIST EXAMPLE ###########################
Mute List:
########################### MUTELIST EXAMPLE ###########################
Mutelist:
Accounts:
"gcp-project-id-1":
Checks:
Expand Down
4 changes: 2 additions & 2 deletions prowler/config/kubernetes_mutelist_example.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@
### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
### Use an alternation Regex to match one of multiple tags with "ORed" logic.
### For each check you can except Accounts, Regions, Resources and/or Tags.
########################### MUTE LIST EXAMPLE ###########################
Mute List:
########################### MUTELIST EXAMPLE ###########################
Mutelist:
Accounts:
"k8s-cluster-1":
Checks:
Expand Down
4 changes: 2 additions & 2 deletions prowler/lib/check/check.py
Original file line number Diff line number Diff line change
Expand Up @@ -576,7 +576,7 @@ def execute_checks(
messages = [f"Config File: {Fore.YELLOW}{config_file}{Style.RESET_ALL}"]
if mutelist_file:
messages.append(
f"Mute List File: {Fore.YELLOW}{mutelist_file}{Style.RESET_ALL}"
f"Mutelist File: {Fore.YELLOW}{mutelist_file}{Style.RESET_ALL}"
)
if global_provider.type == "aws":
messages.append(
Expand Down Expand Up @@ -670,7 +670,7 @@ def execute(
global_provider.audit_metadata, services_executed, checks_executed
)

# Mute List findings
# Mutelist findings
if hasattr(global_provider, "mutelist") and global_provider.mutelist:
check_findings = mutelist_findings(
global_provider,
Expand Down
4 changes: 1 addition & 3 deletions prowler/lib/cli/parser.py
Original file line number Diff line number Diff line change
Expand Up @@ -314,9 +314,7 @@ def __init_list_checks_parser__(self):
)

def __init_mutelist_parser__(self):
mutelist_subparser = self.common_providers_parser.add_argument_group(
"Mute List"
)
mutelist_subparser = self.common_providers_parser.add_argument_group("Mutelist")
provider = sys.argv[1] if len(sys.argv) > 1 else "aws"
mutelist_subparser.add_argument(
"--mutelist-file",
Expand Down
8 changes: 4 additions & 4 deletions prowler/lib/mutelist/mutelist.py
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ def parse_mutelist_file(
s3_client = aws_session.client("s3")
mutelist = yaml.safe_load(
s3_client.get_object(Bucket=bucket, Key=key)["Body"]
)["Mute List"]
)["Mutelist"]
# Check if file is a Lambda Function ARN
elif re.search(r"^arn:(\w+):lambda:", mutelist_path):
lambda_region = mutelist_path.split(":")[3]
Expand All @@ -53,7 +53,7 @@ def parse_mutelist_file(
FunctionName=mutelist_path, InvocationType="RequestResponse"
)
lambda_payload = lambda_response["Payload"].read()
mutelist = yaml.safe_load(lambda_payload)["Mute List"]
mutelist = yaml.safe_load(lambda_payload)["Mutelist"]
# Check if file is a DynamoDB ARN
elif re.search(
r"^arn:aws(-cn|-us-gov)?:dynamodb:[a-z]{2}-[a-z-]+-[1-9]{1}:[0-9]{12}:table\/[a-zA-Z0-9._-]+$",
Expand Down Expand Up @@ -96,12 +96,12 @@ def parse_mutelist_file(
] = item["Exceptions"]
else:
with open(mutelist_path) as f:
mutelist = yaml.safe_load(f)["Mute List"]
mutelist = yaml.safe_load(f)["Mutelist"]
try:
mutelist_schema.validate(mutelist)
except Exception as error:
logger.critical(
f"{error.__class__.__name__} -- Mute List YAML is malformed - {error}[{error.__traceback__.tb_lineno}]"
f"{error.__class__.__name__} -- Mutelist YAML is malformed - {error}[{error.__traceback__.tb_lineno}]"
)
sys.exit(1)
return mutelist
Expand Down
4 changes: 2 additions & 2 deletions tests/lib/mutelist/fixtures/aws_mutelist.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
### Use an alternation Regex to match one of multiple tags with "ORed" logic.
### For each check you can except Accounts, Regions, Resources and/or Tags.
########################### MUTE LIST EXAMPLE ###########################
Mute List:
########################### MUTELIST EXAMPLE ###########################
Mutelist:
Accounts:
"123456789012":
Checks:
Expand Down
2 changes: 1 addition & 1 deletion tests/lib/mutelist/mutelist_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ def test_s3_mutelist(self):
)

with open("tests//lib/mutelist/fixtures/aws_mutelist.yaml") as f:
assert yaml.safe_load(f)["Mute List"] == parse_mutelist_file(
assert yaml.safe_load(f)["Mutelist"] == parse_mutelist_file(
"s3://test-mutelist/mutelist.yaml",
aws_provider.session.current_session,
aws_provider.identity.account,
Expand Down
2 changes: 1 addition & 1 deletion tests/providers/aws/aws_provider_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -529,7 +529,7 @@ def test_aws_provider_mutelist(self):
}
}
}
mutelist_content = {"Mute List": mutelist}
mutelist_content = {"Mutelist": mutelist}

config_file = tempfile.NamedTemporaryFile(delete=False)
with open(config_file.name, "w") as allowlist_file:
Expand Down

0 comments on commit 185b4cb

Please sign in to comment.