Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(allowlist): add exceptions to allowlist #2527

Merged
merged 4 commits into from
Jun 27, 2023

Conversation

sergargar
Copy link
Member

Description

Now, you can add exceptions to your allowlist at the check level, for example:

Allowlist:
  Accounts:
    "*":
      Checks:
        "ecs_task_definitions_no_environment_secrets":
          Regions:
            - "*"
          Resources:
            - "*"
          Exceptions:
            Accounts:
              - "0123456789012"
            Regions:
              - "eu-west-1"
              - "eu-south-2"        # Will ignore every resource in check ecs_task_definitions_no_environment_secrets except the ones in account 0123456789012 located in eu-south-2 or eu-west-1

    "123456789012":
      Checks:
        "*":
          Regions:
            - "*"
          Resources:
            - "*"
          Exceptions:
            Resources:
              - "test"
            Tags:
              - "environment=prod"   # Will ignore every resource except in account 123456789012 except the ones containing the string "test" and tag environment=prod

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@sergargar sergargar requested a review from a team June 26, 2023 12:07
@sergargar sergargar linked an issue Jun 26, 2023 that may be closed by this pull request
Copy link
Member

@jfagoagas jfagoagas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome!

@@ -45,6 +45,34 @@ Allowlist:
Tags:
- "environment=dev" # Will ignore every resource containing the tag 'environment=dev' in every account and region

"*":
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please update the documentation with this feature.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@sergargar sergargar requested a review from jfagoagas June 27, 2023 10:03
Copy link
Member

@jfagoagas jfagoagas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔝

@sergargar sergargar merged commit fa99ee9 into master Jun 27, 2023
@sergargar sergargar deleted the 2412-improve-allowlist-exceptions branch June 27, 2023 10:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve Allowlist exceptions
2 participants