mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-12 07:45:16 +00:00
85 lines
3.4 KiB
YAML
85 lines
3.4 KiB
YAML
### Account, Check and/or Region can be * to apply for all the cases.
|
||
### Resources and tags are lists that can have either Regex or Keywords.
|
||
### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
|
||
### Use an alternation Regex to match one of multiple tags with "ORed" logic.
|
||
### For each check you can except Accounts, Regions, Resources and/or Tags.
|
||
########################### ALLOWLIST EXAMPLE ###########################
|
||
Allowlist:
|
||
Accounts:
|
||
"123456789012":
|
||
Checks:
|
||
"iam_user_hardware_mfa_enabled":
|
||
Regions:
|
||
- "us-east-1"
|
||
Resources:
|
||
- "user-1" # Will ignore user-1 in check iam_user_hardware_mfa_enabled
|
||
- "user-2" # Will ignore user-2 in check iam_user_hardware_mfa_enabled
|
||
"ec2_*":
|
||
Regions:
|
||
- "*"
|
||
Resources:
|
||
- "*" # Will ignore every EC2 check in every account and region
|
||
"*":
|
||
Regions:
|
||
- "*"
|
||
Resources:
|
||
- "test"
|
||
Tags:
|
||
- "test=test" # Will ignore every resource containing the string "test" and the tags 'test=test' and
|
||
- "project=test|project=stage" # either of ('project=test' OR project=stage) in account 123456789012 and every region
|
||
|
||
"*":
|
||
Checks:
|
||
"s3_bucket_object_versioning":
|
||
Regions:
|
||
- "eu-west-1"
|
||
- "us-east-1"
|
||
Resources:
|
||
- "ci-logs" # Will ignore bucket "ci-logs" AND ALSO bucket "ci-logs-replica" in specified check and regions
|
||
- "logs" # Will ignore EVERY BUCKET containing the string "logs" in specified check and regions
|
||
- ".+-logs" # Will ignore all buckets containing the terms ci-logs, qa-logs, etc. in specified check and regions
|
||
"*":
|
||
Regions:
|
||
- "*"
|
||
Resources:
|
||
- "*"
|
||
Tags:
|
||
- "environment=dev" # Will ignore every resource containing the tag 'environment=dev' in every account and region
|
||
|
||
"*":
|
||
Checks:
|
||
"ecs_task_definitions_no_environment_secrets":
|
||
Regions:
|
||
- "*"
|
||
Resources:
|
||
- "*"
|
||
Exceptions:
|
||
Accounts:
|
||
- "0123456789012"
|
||
Regions:
|
||
- "eu-west-1"
|
||
- "eu-south-2" # Will ignore every resource in check ecs_task_definitions_no_environment_secrets except the ones in account 0123456789012 located in eu-south-2 or eu-west-1
|
||
|
||
"123456789012":
|
||
Checks:
|
||
"*":
|
||
Regions:
|
||
- "*"
|
||
Resources:
|
||
- "*"
|
||
Exceptions:
|
||
Resources:
|
||
- "test"
|
||
Tags:
|
||
- "environment=prod" # Will ignore every resource except in account 123456789012 except the ones containing the string "test" and tag environment=prod
|
||
|
||
|
||
|
||
# EXAMPLE: CONTROL TOWER (to migrate)
|
||
# When using Control Tower, guardrails prevent access to certain protected resources. The allowlist
|
||
# below ensures that warnings instead of errors are reported for the affected resources.
|
||
#extra734:aws-controltower-logs-[[:digit:]]+-[[:alpha:]\-]+
|
||
#extra734:aws-controltower-s3-access-logs-[[:digit:]]+-[[:alpha:]\-]+
|
||
#extra764:aws-controltower-logs-[[:digit:]]+-[[:alpha:]\-]+
|
||
#extra764:aws-controltower-s3-access-logs-[[:digit:]]+-[[:alpha:]\-]+
|