Prowler ignores mutelist

[m-minning]

Steps to Reproduce

1. prowler aws --ignore-exit-code-3 --filter-region us-east-1 eu-central-1 --role arn:aws:iam::${AWS_ACCOUNT_ID}:role/Prowler --status FAIL --security-hub --mutelist-file prowler/mutelist.yaml --excluded-checks awslambda_function_no_secrets_in_code cloudfront_distributions_logging_enabled cloudfront_distributions_using_deprecated_ssl_protocols cloudfront_distributions_using_waf cloudwatch_log_group_no_secrets_in_logs dynamodb_tables_pitr_enabled iam_root_hardware_mfa_enabled wafv2_webacl_logging_enabled
2. aws
3. multi-account
4. see expected behavior

Expected behavior

We have the mutelist stored in the location prowler/mutelist.yml and expected that the findings (in the example below ec2) would be muted but it looks like the mutelist is ignored. We also tried to use the account number instead of * but the behavior is the same.

Actual Result with Screenshots or Logs

Mutelist:
  Accounts:
    '*':
      Checks:
        'ec2_instance_secrets_user_data':
          Regions:
            - 'eu-central-1'
          Tags:
            - 'Project=Project1|Project=Project2'
        'ec2_launch_template_no_secrets':
          Regions:
            - 'eu-central-1'
          Resources:
            - 'Project1LaunchTemplate*'
            - 'Project2LaunchTemplate'
        'ecs_task_definitions_no_environment_secrets':
          Regions:
            - 'eu-central-1'
          Resources:
            - 'Project3Task*'
            - 'Project4Task*'

_
 _ __  _ __ _____      _| | ___ _ __
| '_ \| '__/ _ \ \ /\ / / |/ _ \ '__|
| |_) | | | (_) \ V  V /| |  __/ |
| .__/|_|  \___/ \_/\_/ |_|\___|_|v4.2.4
|_| the handy multi-cloud security tool
Date: 2024-07-09 14:13:48
Color code for results:
- MANUAL (Manual check)
- PASS (Recommended value)
- MUTED (Muted by muted list)
- FAIL (Fix required)

-> Using the AWS credentials below:
  · AWS-CLI Profile: default
  · AWS Regions: us-east-1, eu-central-1
  · AWS Account: 123456789
  · User Id: UserId
  · Caller Identity ARN: arn:aws:sts::123456789:assumed-role/RoleName
-> Using the following configuration:
  · Config File: /home/prowler/.local/lib/python3.12/site-packages/prowler/config/config.yaml
  · Mutelist File: prowler/mutelist.yaml
  · Scanning unused services and resources: False
Executing 351 checks, please wait...
...
Check ID: ec2_instance_secrets_user_data - ec2 [critical]
    FAIL eu-central-1: Potential secret found in EC2 instance i-1234567890 User Data -> Telegram Bot Token on line 26.
    FAIL eu-central-1: Potential secret found in EC2 instance i-0987654321 User Data -> AWS Access Key on line 50.
Check ID: ec2_launch_template_no_secrets - ec2 [critical]
    FAIL eu-central-1: Potential secret found in User Data for EC2 Launch Template Project1LaunchTemplate in template versions: 1.
    FAIL eu-central-1: Potential secret found in User Data for EC2 Launch Template Project1LaunchTemplate2 in template versions: 7, 1.
...
╭────────────┬───────────────────┬─────────────┬────────────┬────────┬──────────┬───────┬─────────╮
│ Provider   │ Service           │ Status      │   Critical │   High │   Medium │   Low │   Muted │
├────────────┼───────────────────┼─────────────┼────────────┼────────┼──────────┼───────┼─────────┤
│ aws        │ ec2               │ FAIL (111)  │          4 │      5 │       57 │    45 │       0 │
├────────────┼───────────────────┼─────────────┼────────────┼────────┼──────────┼───────┼─────────┤
...

How did you install Prowler?

Docker (docker pull toniblyx/prowler)

Environment Resource

We use OpenID Connect to run our jobs on GitLab SaaS runners hosted in GCE

OS used

Google Container-Optimized OS (https://docs.gitlab.com/ee/ci/runners/hosted_runners/linux.html)

Prowler version

4.2.4

Pip version

24.0

Context

I don't know if this is a bug or if anything is wrong with our configuration.

[jfagoagas]

Hello @m-minning, we will take a look at this and get back to you soon. In the meantime, would you mind to run Prowler again with --log-level ERROR argument and send the logs to us? That will help us to better debug your issue.

Thanks for using Prowler!

[m-minning]

Thanks @jfagoagas for your fast reply. It's having some trouble with the mutelist.

2024-07-10 08:08:33,473 [File: mutelist.py:28]  [Module: mutelist]   ERROR: SchemaError -- Mutelist YAML is malformed - Key 'Accounts' error:
Key '*' error:
Key 'Checks' error:
Key 'ec2_instance_secrets_user_data' error:
Missing key: 'Resources'[25]

Edit: It works with the example. I'm trying now to migrate our mutelist step by step to see when the error starts

[jfagoagas]

Hi @m-minning by the error you shared it seems that your Mutelist is not valid since you must have the Regions and Resources keys under the check. So you will need to leave your Mutelist file with the following:

Mutelist:
  Accounts:
    '*':
      Checks:
        'ec2_instance_secrets_user_data': --> This key is missing the `Resources` key.
          Regions:
            - 'eu-central-1'
          Tags:
            - 'Project=Project1|Project=Project2'
          Resources:
            - '*' --> Include all using the * or the resource name.
        'ec2_launch_template_no_secrets': --> This key is valid
          Regions:
            - 'eu-central-1'
          Resources:
            - 'Project1LaunchTemplate*'
            - 'Project2LaunchTemplate'
        'ecs_task_definitions_no_environment_secrets': --> This key is valid
          Regions:
            - 'eu-central-1'
          Resources:
            - 'Project3Task*'
            - 'Project4Task*'

I have included some clarifications to help explain the issue with the mutelist.

You can also get more information about the Mutelist in our public documentation at https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/mutelist/#aws-mutelist.

Thanks!

[m-minning]

Thanks @jfagoagas, that helped. I was totally blind and didn't see it.