From 816fa572df0abbecb448e76c0d4a3ea200979344 Mon Sep 17 00:00:00 2001
From: StasonJatham <karl@karlcloud.de>
Date: Tue, 22 Sep 2026 15:36:08 +0200
Subject: [PATCH] drop MRAP and CloudFront from findings

MRAP aliases (<alias>.mrap.accesspoint.s3-global.amazonaws.com) were 91,560 of
91,561 S3 findings: AWS-generated, not customer buckets, never publicly
resolvable, and they monopolised pipeline capacity. CloudFront distributions are
CDN endpoints, not buckets or databases. Both are now excluded so real buckets
and databases get the capacity.
---
 internal/classify/aws.go           | 12 ++++++++----
 internal/classify/classify_test.go |  4 ++--
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/internal/classify/aws.go b/internal/classify/aws.go
index 568289a..3c94297 100644
--- a/internal/classify/aws.go
+++ b/internal/classify/aws.go
@@ -25,10 +25,12 @@ func classifyCloudFront(s *scanner) (model.Match, bool) {
 	if n != 3 || s.label(n-1) != "net" || s.label(n-2) != "cloudfront" {
 		return model.Match{}, false
 	}
+	// CloudFront distributions are CDN endpoints, not buckets or databases, so
+	// they are identified but not stored as findings.
 	return model.Match{
 		Provider:         model.ProviderAWS,
 		Service:          model.ServiceWebApp,
-		ResourceSpecific: true,
+		ResourceSpecific: false,
 		PublicSemantic:   model.PublicSemanticPublicEndpoint,
 		Resource:         s.label(0),
 	}, true
@@ -113,11 +115,13 @@ func classifyAWSS3(s *scanner) (model.Match, bool) {
 		}
 	}
 
-	// Multi-region access point: <res>.mrap.accesspoint.s3-global.amazonaws.com
+	// Multi-region access point aliases (<alias>.mrap.accesspoint.s3-global...) are
+	// AWS-generated and appear in CT in enormous volume. They are not customer
+	// bucket names, do not resolve publicly, and were flooding the pipeline, so
+	// they are deliberately not treated as findings.
 	if n >= 6 && s.label(n-5) == "mrap" && s.label(n-4) == "accesspoint" &&
 		s.label(n-3) == "s3-global" {
-		return aws(model.ProviderAWS, model.ServiceS3,
-			model.PublicSemanticNone, s.label(0), ""), true
+		return model.Match{}, false
 	}
 
 	// S3 Express: <bucket>.s3express-<zone>.<region>.amazonaws.com
diff --git a/internal/classify/classify_test.go b/internal/classify/classify_test.go
index dbc3782..41f00b8 100644
--- a/internal/classify/classify_test.go
+++ b/internal/classify/classify_test.go
@@ -59,7 +59,6 @@ func TestClassifyMatches(t *testing.T) {
 		{"ap-123456.s3-accesspoint.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "ap-123456", "us-east-1", true, 0}},
 		{"x.s3-accesspoint.dualstack.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "us-east-1", true, 0}},
 		{"x.s3-accesspoint-fips.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "us-east-1", true, 0}},
-		{"x.mrap.accesspoint.s3-global.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "", true, 0}},
 		{"bucket.s3express-zone1.eu-west-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "bucket", "eu-west-1", true, 0}},
 		{"bucket-01.s3-eu-west-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "bucket-01", "eu-west-1", true, 0}},
 		// AWS databases
@@ -94,7 +93,7 @@ func TestClassifyMatches(t *testing.T) {
 		{"project.firebaseio.com", want{model.ProviderGCP, model.ServiceFirebaseDB, "project", "", true, 0}},
 		{"project.europe-west1.firebasedatabase.app", want{model.ProviderGCP, model.ServiceFirebaseDB, "project", "europe-west1", true, 0}},
 		{"myproject.appspot.com", want{model.ProviderGCP, model.ServiceWebApp, "myproject", "", true, 0}},
-		{"d111111abcdef8.cloudfront.net", want{model.ProviderAWS, model.ServiceWebApp, "d111111abcdef8", "", true, model.PublicSemanticPublicEndpoint}},
+		{"d111111abcdef8.cloudfront.net", want{model.ProviderAWS, model.ServiceWebApp, "d111111abcdef8", "", false, model.PublicSemanticPublicEndpoint}},
 		// Cloudflare
 		{"acct.r2.cloudflarestorage.com", want{model.ProviderCloudflare, model.ServiceObjectStorage, "acct", "", true, 0}},
 		{"mybucket.r2.dev", want{model.ProviderCloudflare, model.ServiceObjectStorage, "mybucket", "", true, model.PublicSemanticPublicURL}},
@@ -138,6 +137,7 @@ func TestClassifyRejects(t *testing.T) {
 		"cache.amazonaws.com",
 		"use1.cache.amazonaws.com",
 		"s3-global.amazonaws.com",
+		"x.mrap.accesspoint.s3-global.amazonaws.com",
 		// Azure bare service endpoints
 		"blob.core.windows.net",
 		"database.windows.net",