prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  [Bug]: False positives on some checks?
  ### Steps to Reproduce
  
  Hi,
  
  it looks like some checks produce false positives (they are tagged as warning because I've allowlisted them):
  
  ```
  Check ID: ec2_ebs_snapshots_encrypted - ec2 [medium]
          WARNING eu-central-1: EBS Snapshot snap-112 is unencrypted.
          WARNING eu-central-1: EBS Snapshot snap-113 is encrypted.  <<<<
  ```
  
  
  ```
  Check ID: iam_policy_allows_privilege_escalation - iam [high]
          WARNING eu-central-1: Custom Policy arn:aws:iam::112:policy/aws_admin_access does not allow privilege  escalation
  ```
  
  Are you maybe simply overring the status (also "PASS") by WARNING in case of an allowlist match?
  
  
  Another type of issue but more like a question:
  
  _sns_topics_not_publicly_accessible_ triggers with 
  ` WARNING eu-central-1: SNS topic cloudwatch-pagerduty-alarms-ec2-state-changes policy with public access but has a Condition`
  which is (from the User's perspective) a false positive as well because we have a condition, which prowler cannot evaluate?
  
  
  
  
  ### Expected behavior
  
  none
  
  ### Actual Result with Screenshots or Logs
  
  none
  
  ### How did you install Prowler?
  
  Cloning the repository from github.com (git clone)
  
  ### Environment Resource
  
  locally
  
  ### OS used
  
  Linux
  
  ### Prowler version
  
  3.4.1
  
  ### Pip version
  
  none
  
  ### Context
  
  _No response_
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py`
  Content:
  ```
  1 from prowler.lib.check.models import Check, Check_Report_AWS
  2 from prowler.providers.aws.services.sns.sns_client import sns_client
  3 
  4 
  5 class sns_topics_not_publicly_accessible(Check):
  6     def execute(self):
  7         findings = []
  8         for topic in sns_client.topics:
  9             report = Check_Report_AWS(self.metadata())
  10             report.region = topic.region
  11             report.resource_id = topic.name
  12             report.resource_arn = topic.arn
  13             report.resource_tags = topic.tags
  14             report.status = "PASS"
  15             report.status_extended = f"SNS topic {topic.name} without public access"
  16             if topic.policy:
  17                 for statement in topic.policy["Statement"]:
  18                     # Only check allow statements
  19                     if statement["Effect"] == "Allow":
  20                         if (
  21                             "*" in statement["Principal"]
  22                             or (
  23                                 "AWS" in statement["Principal"]
  24                                 and "*" in statement["Principal"]["AWS"]
  25                             )
  26                             or (
  27                                 "CanonicalUser" in statement["Principal"]
  28                                 and "*" in statement["Principal"]["CanonicalUser"]
  29                             )
  30                         ):
  31                             if "Condition" not in statement:
  32                                 report.status = "FAIL"
  33                                 report.status_extended = (
  34                                     f"SNS topic {topic.name} policy with public access"
  35                                 )
  36                             else:
  37                                 report.status = "FAIL"
  38                                 report.status_extended = f"SNS topic {topic.name} policy with public access but has a Condition"
  39 
  40             findings.append(report)
  41 
  42         return findings
  43
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
  --- a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
  +++ b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
  @@ -12,7 +12,7 @@
               report.resource_arn = topic.arn
               report.resource_tags = topic.tags
               report.status = "PASS"
  -            report.status_extended = f"SNS topic {topic.name} without public access"
  +            report.status_extended = f"SNS topic {topic.name} is not publicly accesible"
               if topic.policy:
                   for statement in topic.policy["Statement"]:
                       # Only check allow statements
  @@ -31,11 +31,11 @@
                               if "Condition" not in statement:
                                   report.status = "FAIL"
                                   report.status_extended = (
  -                                    f"SNS topic {topic.name} policy with public access"
  +                                    f"SNS topic {topic.name} is publicly accesible"
                                   )
                               else:
  -                                report.status = "FAIL"
  -                                report.status_extended = f"SNS topic {topic.name} policy with public access but has a Condition"
  +                                report.status = "PASS"
  +                                report.status_extended = f"SNS topic {topic.name} is publicly accesible but has a Condition that could filter it"
   
               findings.append(report)
  
verification_info: {"golden_diff": "diff --git a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py\n--- a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py\n+++ b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py\n@@ -12,7 +12,7 @@\n             report.resource_arn = topic.arn\n             report.resource_tags = topic.tags\n             report.status = \"PASS\"\n-            report.status_extended = f\"SNS topic {topic.name} without public access\"\n+            report.status_extended = f\"SNS topic {topic.name} is not publicly accesible\"\n             if topic.policy:\n                 for statement in topic.policy[\"Statement\"]:\n                     # Only check allow statements\n@@ -31,11 +31,11 @@\n                             if \"Condition\" not in statement:\n                                 report.status = \"FAIL\"\n                                 report.status_extended = (\n-                                    f\"SNS topic {topic.name} policy with public access\"\n+                                    f\"SNS topic {topic.name} is publicly accesible\"\n                                 )\n                             else:\n-                                report.status = \"FAIL\"\n-                                report.status_extended = f\"SNS topic {topic.name} policy with public access but has a Condition\"\n+                                report.status = \"PASS\"\n+                                report.status_extended = f\"SNS topic {topic.name} is publicly accesible but has a Condition that could filter it\"\n \n             findings.append(report)\n", "issue": "[Bug]: False positives on some checks?\n### Steps to Reproduce\n\nHi,\r\n\r\nit looks like some checks produce false positives (they are tagged as warning because I've allowlisted them):\r\n\r\n```\r\nCheck ID: ec2_ebs_snapshots_encrypted - ec2 [medium]\r\n        WARNING eu-central-1: EBS Snapshot snap-112 is unencrypted.\r\n        WARNING eu-central-1: EBS Snapshot snap-113 is encrypted.  <<<<\r\n```\r\n\r\n\r\n```\r\nCheck ID: iam_policy_allows_privilege_escalation - iam [high]\r\n        WARNING eu-central-1: Custom Policy arn:aws:iam::112:policy/aws_admin_access does not allow privilege  escalation\r\n```\r\n\r\nAre you maybe simply overring the status (also \"PASS\") by WARNING in case of an allowlist match?\r\n\r\n\r\nAnother type of issue but more like a question:\r\n\r\n_sns_topics_not_publicly_accessible_ triggers with \r\n` WARNING eu-central-1: SNS topic cloudwatch-pagerduty-alarms-ec2-state-changes policy with public access but has a Condition`\r\nwhich is (from the User's perspective) a false positive as well because we have a condition, which prowler cannot evaluate?\r\n\r\n\r\n\n\n### Expected behavior\n\nnone\n\n### Actual Result with Screenshots or Logs\n\nnone\n\n### How did you install Prowler?\n\nCloning the repository from github.com (git clone)\n\n### Environment Resource\n\nlocally\n\n### OS used\n\nLinux\n\n### Prowler version\n\n3.4.1\n\n### Pip version\n\nnone\n\n### Context\n\n_No response_\n", "before_files": [{"content": "from prowler.lib.check.models import Check, Check_Report_AWS\nfrom prowler.providers.aws.services.sns.sns_client import sns_client\n\n\nclass sns_topics_not_publicly_accessible(Check):\n    def execute(self):\n        findings = []\n        for topic in sns_client.topics:\n            report = Check_Report_AWS(self.metadata())\n            report.region = topic.region\n            report.resource_id = topic.name\n            report.resource_arn = topic.arn\n            report.resource_tags = topic.tags\n            report.status = \"PASS\"\n            report.status_extended = f\"SNS topic {topic.name} without public access\"\n            if topic.policy:\n                for statement in topic.policy[\"Statement\"]:\n                    # Only check allow statements\n                    if statement[\"Effect\"] == \"Allow\":\n                        if (\n                            \"*\" in statement[\"Principal\"]\n                            or (\n                                \"AWS\" in statement[\"Principal\"]\n                                and \"*\" in statement[\"Principal\"][\"AWS\"]\n                            )\n                            or (\n                                \"CanonicalUser\" in statement[\"Principal\"]\n                                and \"*\" in statement[\"Principal\"][\"CanonicalUser\"]\n                            )\n                        ):\n                            if \"Condition\" not in statement:\n                                report.status = \"FAIL\"\n                                report.status_extended = (\n                                    f\"SNS topic {topic.name} policy with public access\"\n                                )\n                            else:\n                                report.status = \"FAIL\"\n                                report.status_extended = f\"SNS topic {topic.name} policy with public access but has a Condition\"\n\n            findings.append(report)\n\n        return findings\n", "path": "prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py"}], "after_files": [{"content": "from prowler.lib.check.models import Check, Check_Report_AWS\nfrom prowler.providers.aws.services.sns.sns_client import sns_client\n\n\nclass sns_topics_not_publicly_accessible(Check):\n    def execute(self):\n        findings = []\n        for topic in sns_client.topics:\n            report = Check_Report_AWS(self.metadata())\n            report.region = topic.region\n            report.resource_id = topic.name\n            report.resource_arn = topic.arn\n            report.resource_tags = topic.tags\n            report.status = \"PASS\"\n            report.status_extended = f\"SNS topic {topic.name} is not publicly accesible\"\n            if topic.policy:\n                for statement in topic.policy[\"Statement\"]:\n                    # Only check allow statements\n                    if statement[\"Effect\"] == \"Allow\":\n                        if (\n                            \"*\" in statement[\"Principal\"]\n                            or (\n                                \"AWS\" in statement[\"Principal\"]\n                                and \"*\" in statement[\"Principal\"][\"AWS\"]\n                            )\n                            or (\n                                \"CanonicalUser\" in statement[\"Principal\"]\n                                and \"*\" in statement[\"Principal\"][\"CanonicalUser\"]\n                            )\n                        ):\n                            if \"Condition\" not in statement:\n                                report.status = \"FAIL\"\n                                report.status_extended = (\n                                    f\"SNS topic {topic.name} is publicly accesible\"\n                                )\n                            else:\n                                report.status = \"PASS\"\n                                report.status_extended = f\"SNS topic {topic.name} is publicly accesible but has a Condition that could filter it\"\n\n            findings.append(report)\n\n        return findings\n", "path": "prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py"}]}