Find secrets in EC2 User Data findings do not stop incrementing

[cerontrustly]

Hello,

Since version 3.8.0 of Prowler I notice the findings related to check "Find secrets in EC2 User Data." they don't stop growing in Security Hub. As I have a pretty volatile EC2 environment I notice the findings related to instances that have already been removed are still there. Is this a normal characteristic?

Thank you!

[alexzon-tr]

The same is happening with the control Check if EC2 instances have detailed monitoring enabled.
When the resource does not exist anymore, I believe Prowler should archive the finding (I'm talking about the integration with Security Hub). Instead, the findings are just left there, without any update.

[toniblyx]

Thank you both for the notice, we will give it a look, I´ll create an issue to keep better track.

[alexzon-tr]

I've just discovered the same problem with a Lambda-related control.
The Lambda Function has been deleted but the finding was not archived. It just stays there and is not updated.

Is it safe to say that this is happening with every finding related to a deleted resource?

[MrCloudSec]

Hi @alexzon-tr and @cerontrustly , which commands of Prowler are you running? Just specific checks or all of them?

[alexzon-tr]

We exclude some checks already made by AWS Security Hub.
Command:
docker run -v ${working.directory}:/prowler/tmp --env "AWS_ACCESS_KEY_ID" --env "AWS_SECRET_ACCESS_KEY" toniblyx/prowler:stable -f $region -e $excluded_checks -M json-asff -S -z

[MrCloudSec]

I cannot reproduce this error, are you still facing it in the latest version 3.11.2? Thanks.

[alexzon-tr]

Yes.
I've downloaded all Active Prowler findings from Security Hub to do a manual analysis.
When looking at the "UpdatedAt" field, there are hundreds of findings for each day Prowler ran since August 18.
I believe the desired behavior is to update the findings every run when the resource still exists or archive it otherwise.