karl/bucketeer
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drop MRAP and CloudFront from findings

Browse Source 
MRAP aliases (<alias>.mrap.accesspoint.s3-global.amazonaws.com) were 91,560 of
91,561 S3 findings: AWS-generated, not customer buckets, never publicly
resolvable, and they monopolised pipeline capacity. CloudFront distributions are
CDN endpoints, not buckets or databases. Both are now excluded so real buckets
and databases get the capacity.
This commit is contained in:
StasonJatham committed 2026-09-22 15:36:08 +02:00
1 parent 7034aab4b6
commit 816fa572df
2 files changed
+10 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/classify/classify_test.go
+2 -2
View File
@@ -59,7 +59,6 @@ func TestClassifyMatches(t *testing.T) {
{"ap-123456.s3-accesspoint.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "ap-123456", "us-east-1", true, 0}},
{"x.s3-accesspoint.dualstack.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "us-east-1", true, 0}},
{"x.s3-accesspoint-fips.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "us-east-1", true, 0}},
{"x.mrap.accesspoint.s3-global.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "", true, 0}},
{"bucket.s3express-zone1.eu-west-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "bucket", "eu-west-1", true, 0}},
{"bucket-01.s3-eu-west-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "bucket-01", "eu-west-1", true, 0}},
// AWS databases
@@ -94,7 +93,7 @@ func TestClassifyMatches(t *testing.T) {
{"project.firebaseio.com", want{model.ProviderGCP, model.ServiceFirebaseDB, "project", "", true, 0}},
{"project.europe-west1.firebasedatabase.app", want{model.ProviderGCP, model.ServiceFirebaseDB, "project", "europe-west1", true, 0}},
{"myproject.appspot.com", want{model.ProviderGCP, model.ServiceWebApp, "myproject", "", true, 0}},
{"d111111abcdef8.cloudfront.net", want{model.ProviderAWS, model.ServiceWebApp, "d111111abcdef8", "", true, model.PublicSemanticPublicEndpoint}},
{"d111111abcdef8.cloudfront.net", want{model.ProviderAWS, model.ServiceWebApp, "d111111abcdef8", "", false, model.PublicSemanticPublicEndpoint}},
// Cloudflare
{"acct.r2.cloudflarestorage.com", want{model.ProviderCloudflare, model.ServiceObjectStorage, "acct", "", true, 0}},
{"mybucket.r2.dev", want{model.ProviderCloudflare, model.ServiceObjectStorage, "mybucket", "", true, model.PublicSemanticPublicURL}},
@@ -138,6 +137,7 @@ func TestClassifyRejects(t *testing.T) {
"cache.amazonaws.com",
"use1.cache.amazonaws.com",
"s3-global.amazonaws.com",
"x.mrap.accesspoint.s3-global.amazonaws.com",
// Azure bare service endpoints
"blob.core.windows.net",
"database.windows.net",