Repository: prowler-cloud/prowler

Issue:
[Bug]: False positives on some checks?
### Steps to Reproduce

Hi,

it looks like some checks produce false positives (they are tagged as warning because I've allowlisted them):

```
Check ID: ec2_ebs_snapshots_encrypted - ec2 [medium]
        WARNING eu-central-1: EBS Snapshot snap-112 is unencrypted.
        WARNING eu-central-1: EBS Snapshot snap-113 is encrypted.  <<<<
```


```
Check ID: iam_policy_allows_privilege_escalation - iam [high]
        WARNING eu-central-1: Custom Policy arn:aws:iam::112:policy/aws_admin_access does not allow privilege  escalation
```

Are you maybe simply overring the status (also "PASS") by WARNING in case of an allowlist match?


Another type of issue but more like a question:

_sns_topics_not_publicly_accessible_ triggers with 
` WARNING eu-central-1: SNS topic cloudwatch-pagerduty-alarms-ec2-state-changes policy with public access but has a Condition`
which is (from the User's perspective) a false positive as well because we have a condition, which prowler cannot evaluate?




### Expected behavior

none

### Actual Result with Screenshots or Logs

none

### How did you install Prowler?

Cloning the repository from github.com (git clone)

### Environment Resource

locally

### OS used

Linux

### Prowler version

3.4.1

### Pip version

none

### Context

_No response_


Discussion:
Hi @HarryBo112, I'm going to answer each question down below:

> it looks like some checks produce false positives (they are tagged as warning because I've allowlisted them):
> 
> ```
> Check ID: ec2_ebs_snapshots_encrypted - ec2 [medium]
>         WARNING eu-central-1: EBS Snapshot snap-112 is unencrypted.
>         WARNING eu-central-1: EBS Snapshot snap-113 is encrypted.  <<<<
> ```
> 
> ```
> Check ID: iam_policy_allows_privilege_escalation - iam [high]
>         WARNING eu-central-1: Custom Policy arn:aws:iam::112:policy/aws_admin_access does not allow privilege  escalation
> ```
> 
> Are you maybe simply overring the status (also "PASS") by WARNING in case of an allowlist match?

That is right, the behaviour of the allowlist is just to add a `WARNING` instead of `INFO`, `PASS` or `FAIL` to any output format. Please, refer to the documentation here https://docs.prowler.cloud/en/latest/tutorials/allowlist/ to get more details and how the allowlist works.

> 
> Another type of issue but more like a question:
> 
> _sns_topics_not_publicly_accessible_ triggers with ` WARNING eu-central-1: SNS topic cloudwatch-pagerduty-alarms-ec2-state-changes policy with public access but has a Condition` which is (from the User's perspective) a false positive as well because we have a condition, which prowler cannot evaluate?
> 
We're going to review this and we'll get back to you soon.

Thanks for using Prowler!




Resolving patch:
diff --git a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
--- a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
+++ b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
@@ -12,7 +12,7 @@ def execute(self):
             report.resource_arn = topic.arn
             report.resource_tags = topic.tags
             report.status = "PASS"
-            report.status_extended = f"SNS topic {topic.name} without public access"
+            report.status_extended = f"SNS topic {topic.name} is not publicly accesible"
             if topic.policy:
                 for statement in topic.policy["Statement"]:
                     # Only check allow statements
@@ -31,11 +31,11 @@ def execute(self):
                             if "Condition" not in statement:
                                 report.status = "FAIL"
                                 report.status_extended = (
-                                    f"SNS topic {topic.name} policy with public access"
+                                    f"SNS topic {topic.name} is publicly accesible"
                                 )
                             else:
-                                report.status = "FAIL"
-                                report.status_extended = f"SNS topic {topic.name} policy with public access but has a Condition"
+                                report.status = "PASS"
+                                report.status_extended = f"SNS topic {topic.name} is publicly accesible but has a Condition that could filter it"
 
             findings.append(report)
 


Test patch:
diff --git a/tests/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible_test.py b/tests/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible_test.py
--- a/tests/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible_test.py
+++ b/tests/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible_test.py
@@ -1,4 +1,3 @@
-from re import search
 from unittest import mock
 from uuid import uuid4
 
@@ -61,7 +60,7 @@ def test_no_topics(self):
             result = check.execute()
             assert len(result) == 0
 
-    def test_topics_not_public(self):
+    def test_topic_not_public(self):
         sns_client = mock.MagicMock
         sns_client.topics = []
         sns_client.topics.append(
@@ -84,11 +83,16 @@ def test_topics_not_public(self):
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "PASS"
-            assert search("without public access", result[0].status_extended)
+            assert (
+                result[0].status_extended
+                == f"SNS topic {topic_name} is not publicly accesible"
+            )
             assert result[0].resource_id == topic_name
             assert result[0].resource_arn == topic_arn
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_tags == []
 
-    def test_topics_no_policy(self):
+    def test_topic_no_policy(self):
         sns_client = mock.MagicMock
         sns_client.topics = []
         sns_client.topics.append(
@@ -106,11 +110,16 @@ def test_topics_no_policy(self):
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "PASS"
-            assert search("without public access", result[0].status_extended)
+            assert (
+                result[0].status_extended
+                == f"SNS topic {topic_name} is not publicly accesible"
+            )
             assert result[0].resource_id == topic_name
             assert result[0].resource_arn == topic_arn
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_tags == []
 
-    def test_topics_public_with_condition(self):
+    def test_topic_public_with_condition(self):
         sns_client = mock.MagicMock
         sns_client.topics = []
         sns_client.topics.append(
@@ -132,12 +141,17 @@ def test_topics_public_with_condition(self):
             check = sns_topics_not_publicly_accessible()
             result = check.execute()
             assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert search("but has a Condition", result[0].status_extended)
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"SNS topic {topic_name} is publicly accesible but has a Condition that could filter it"
+            )
             assert result[0].resource_id == topic_name
             assert result[0].resource_arn == topic_arn
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_tags == []
 
-    def test_topics_no_key(self):
+    def test_topic_public(self):
         sns_client = mock.MagicMock
         sns_client.topics = []
         sns_client.topics.append(
@@ -160,6 +174,11 @@ def test_topics_no_key(self):
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "FAIL"
-            assert search("with public access", result[0].status_extended)
+            assert (
+                result[0].status_extended
+                == f"SNS topic {topic_name} is publicly accesible"
+            )
             assert result[0].resource_id == topic_name
             assert result[0].resource_arn == topic_arn
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_tags == []