[Bug]: cloudwatch_log_group_retention_policy_specific_days_enabled alert on AWS managed log group about prowler

[christiandavilakoobin]

OK then! If not is an easy one, it doesn't worth the time to implement it. I'll keep on the allowlist. Thank you!

[sergargar]

Hi @christiandavilakoobin, thanks for reaching us out!
For this use case, Prowler has the allowlist feature where you can ignore this type of resources, the syntax would be like:

Allowlist:
  Accounts:
    "*":
      Checks:
        "cloudwatch_log_group_retention_policy_specific_days_enabled":
          Regions:
            - "*"
          Resources:
            - "RDSOSMetrics"

[christiandavilakoobin]

Hi @sergargar! Thank you for your response! I know about the allowlist, and I've already add this to that allowlist, but as this cloudwatch group is an internal AWS, I just thought that it shouldn't be necessary to add it to an allowlist. It's like saying that the AWS policy is wrong, but just ignore it.

[sergargar]

Good point @christiandavilakoobin, but by looking at the describe_log_groups API call, there is no automatic way to check which log groups are managed by AWS.