drop MRAP and CloudFront from findings

MRAP aliases (<alias>.mrap.accesspoint.s3-global.amazonaws.com) were 91,560 of
91,561 S3 findings: AWS-generated, not customer buckets, never publicly
resolvable, and they monopolised pipeline capacity. CloudFront distributions are
CDN endpoints, not buckets or databases. Both are now excluded so real buckets
and databases get the capacity.

internal/classify/aws.go

@@ -25,10 +25,12 @@ func classifyCloudFront(s *scanner) (model.Match, bool) {
 	if n != 3 || s.label(n-1) != "net" || s.label(n-2) != "cloudfront" {
 		return model.Match{}, false
 	}
+	// CloudFront distributions are CDN endpoints, not buckets or databases, so
+	// they are identified but not stored as findings.
 	return model.Match{
 		Provider:         model.ProviderAWS,
 		Service:          model.ServiceWebApp,
-		ResourceSpecific: true,
+		ResourceSpecific: false,
 		PublicSemantic:   model.PublicSemanticPublicEndpoint,
 		Resource:         s.label(0),
 	}, true
@@ -113,11 +115,13 @@ func classifyAWSS3(s *scanner) (model.Match, bool) {
 		}
 	}
 
-	// Multi-region access point: <res>.mrap.accesspoint.s3-global.amazonaws.com
+	// Multi-region access point aliases (<alias>.mrap.accesspoint.s3-global...) are
+	// AWS-generated and appear in CT in enormous volume. They are not customer
+	// bucket names, do not resolve publicly, and were flooding the pipeline, so
+	// they are deliberately not treated as findings.
 	if n >= 6 && s.label(n-5) == "mrap" && s.label(n-4) == "accesspoint" &&
 		s.label(n-3) == "s3-global" {
-		return aws(model.ProviderAWS, model.ServiceS3,
+		return model.Match{}, false
-			model.PublicSemanticNone, s.label(0), ""), true
 	}
 
 	// S3 Express: <bucket>.s3express-<zone>.<region>.amazonaws.com

internal/classify/classify_test.go

@@ -59,7 +59,6 @@ func TestClassifyMatches(t *testing.T) {
 		{"ap-123456.s3-accesspoint.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "ap-123456", "us-east-1", true, 0}},
 		{"x.s3-accesspoint.dualstack.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "us-east-1", true, 0}},
 		{"x.s3-accesspoint-fips.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "us-east-1", true, 0}},
-		{"x.mrap.accesspoint.s3-global.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "", true, 0}},
 		{"bucket.s3express-zone1.eu-west-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "bucket", "eu-west-1", true, 0}},
 		{"bucket-01.s3-eu-west-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "bucket-01", "eu-west-1", true, 0}},
 		// AWS databases
@@ -94,7 +93,7 @@ func TestClassifyMatches(t *testing.T) {
 		{"project.firebaseio.com", want{model.ProviderGCP, model.ServiceFirebaseDB, "project", "", true, 0}},
 		{"project.europe-west1.firebasedatabase.app", want{model.ProviderGCP, model.ServiceFirebaseDB, "project", "europe-west1", true, 0}},
 		{"myproject.appspot.com", want{model.ProviderGCP, model.ServiceWebApp, "myproject", "", true, 0}},
-		{"d111111abcdef8.cloudfront.net", want{model.ProviderAWS, model.ServiceWebApp, "d111111abcdef8", "", true, model.PublicSemanticPublicEndpoint}},
+		{"d111111abcdef8.cloudfront.net", want{model.ProviderAWS, model.ServiceWebApp, "d111111abcdef8", "", false, model.PublicSemanticPublicEndpoint}},
 		// Cloudflare
 		{"acct.r2.cloudflarestorage.com", want{model.ProviderCloudflare, model.ServiceObjectStorage, "acct", "", true, 0}},
 		{"mybucket.r2.dev", want{model.ProviderCloudflare, model.ServiceObjectStorage, "mybucket", "", true, model.PublicSemanticPublicURL}},
@@ -138,6 +137,7 @@ func TestClassifyRejects(t *testing.T) {
 		"cache.amazonaws.com",
 		"use1.cache.amazonaws.com",
 		"s3-global.amazonaws.com",
+		"x.mrap.accesspoint.s3-global.amazonaws.com",
 		// Azure bare service endpoints
 		"blob.core.windows.net",
 		"database.windows.net",