Prowler v3 scan rules enquiries

[NMuee]

Hello prowler team,

I am currently changing my prowler scan from v2 to v3, and i realize there are some minor differences would like to clarify with the team.

1. awslambda_function_invoke_api_operations_cloudtrail_logging_enabled (extra720)

In prowler v2 the cloudtrail resources are being tracked under this rule but not in prowler v3, it i would like to whitelist this rule based on my cloudtrail resources will that be doable?

2. cloudwatch_log_group_retention_policy_specific_days_enabled (extra7162)

My loggroup retention is set as "Never expired", in prowlerv2 this will be flagged as PASS, but in prowler v3 is being flagged as FAIL as they detect it as 0 days

3. codebuild_project_user_controlled_buildspec (extra7175)

For codebuild project that does not use a user controlled buildspec is flagged as PASS in prowlerv2, but failed in prowler v3

4. ecr_repositories_scan_vulnerabilities_in_latest_image (extra776)

It is said scan for vulnerabilities in latest image, however in prowlerv3, all the image even though it is not the latest are being scan too

5. trustedadvisor_errors_and_warnings (extra726)

In prowlerv2 if state is not_available it is flagged out as INFO, but in prowlerv3 it is flagged out as FAIL

6. shield_advanced_protection_in_route53_hosted_zones (extra7168)

Not sure why my Route53 HostedZone is being flagged out as FAIL and not protected, even tho they are. When i use prowlerv2 to do the scan all my route53 HostedZone are being flagged as PASS, but with prowlerv3 they are being flagged as FAIL
(I observed that prowlerv3 is referencing AWS resource instead of name that was reference in prowlerv2)

7. sns_topics_not_publicly_accessible (extra731)

sns topic with public access but has a condition is being flagged as PASS in prowlerv2, but failed in prowlerv3

Currently these are the rules that I currently observed there are differences
Would like to check with team are these differences expected?

I using the latest prowlerv3 with the latest commit 24May

[jfagoagas]

Hi @NMuee, what Prowler version are you using?

Please, check this issue #2271 since your issue seems to be the same. If this is still happening, please leave a comment in the issue.

Thanks!

[NMuee]

Hi, I am pulling from master branch with the latest commit on 24May, and I have updated the above question with more details, thankyou

[MrCloudSec]

Hi @NMuee, the following PRs that are in the latest version solve points 2, 4 and 5 respectively: #2272, #2302 and #2323. And we have fixed point 3 with #2410

However, I could not reproduce point 7 since our SNS Topics with conditions are being flagged as PASS and I do not understand what do you mean in point 1.

Could you join our Slack Channel so we can discuss this further?

[NMuee]

Hello to both,

Thank you very much for your response.
Apologise, realized that my prowler is running on the outdated version even though I had the latest commit. It works slightly difference with prowlerv2 after prowler can be installed through pip.
I have updated my prowler and some of the question listed above have been answered.

However I do still have one more

1. shield_advanced_protection_in_route53_hosted_zones (extra7168)
   Not sure why my Route53 HostedZone is being flagged out as FAIL even tho they are protected. When i use prowlerv2 to do the scan all my route53 HostedZone are being flagged as PASS, but with prowlerv3 they are being flagged as FAIL
   (I observed that prowlerv3 is referencing AWS resource instead of name that was reference in prowlerv2)

May need the team help to look into this, thankyouverymuch

To add on,
Should finding be flagged as FAIL if resources are not enabled such as Macie/Resource Explorer/DRS?

[jfagoagas]

Hi @NMuee, we've fixed the issue you reported in the following PR #2494.

Thanks for using Prowler 🚀