How does Prowler determine when a finding's Compliance Status is set to WARNING instead of FAILED|PASSED?

[leonardorosilva]

Hi team,
I'm using Prowler v4.6.2, integrated with AWS Security Hub, and I've noticed that several findings display a "WARNING" in the Compliance Status field.

Some of these findings are related to resources deployed by AWS Control Tower, so I was trying to understand how Prowler classifies this "WARNING" state.

I've read through the documentation, but the definition of the warning compliance status isn't very clear.
For example, the control:
"Check if SNS topics have policy set as Public"

It appears as a warning, even though the SNS topic policy has:

• a Principal defined as a specific AWS service (not "*"), and

• a Condition restricting access to our aws:PrincipalOrgID.

Could you please clarify:
How does Prowler determine when a finding's Compliance Status is set to WARNING instead of FAILED|PASSED?
Thanks in advance for the clarification!

[HugoPBrito]

Hi @leonardorosilva,

That’s happening because you have muted findings, and Prowler uses ASFF for SecurityHub integration. Since ASFF doesn’t support MUTED finding status, we replace it with a WARNING.

You can see the exact line where we assign that value:

prowler/prowler/lib/outputs/asff/asff.py

Line 187 in c0df0cd

json_asff_status = "WARNING"

[leonardorosilva]

Hello @HugoPBrito

Thanks for clarifying that!
In our setup, we run Prowler and send the findings directly to Security Hub — there’s no step in the process where we manually mute any findings.

Would there be any other condition that could cause the WARNING status besides muted findings (for example, specific ASFF fields or partial evaluations in a check)?

[HugoPBrito]

Hi again @leonardorosilva,

Since you’re not using a custom mutelist, the default prowler mutelist for aws is being automatically applied (https://github.com/prowler-cloud/prowler/blob/v4.6/prowler/config/aws_mutelist.yaml).

It’s configured to silence findings such as those from resources created by AWS Control Tower. That’s why those specific findings are being marked as warnings.

I hope this answers your question!

[leonardorosilva]

Thank you so much.

[HugoPBrito]

My pleasure!