Adding trusted_account_ids causes VPC endpoint trust boundary checks to fail

Issue search

• I have searched the existing issues and this bug has not been reported yet

This is a follow-up to #12816. That issue is closed, but the behavior remains reproducible with the official Prowler 5.42.0 image.

Which component is affected?

Prowler CLI/SDK

Cloud Provider (if applicable)

AWS

Steps to Reproduce

1. Run vpc_endpoint_connections_trust_boundaries with the default configuration. Do not pass --config-file:

mkdir -p "$PWD/output-default"

docker run --rm -it \
  --env AWS_ACCESS_KEY_ID \
  --env AWS_SECRET_ACCESS_KEY \
  --env AWS_SESSION_TOKEN \
  --mount type=bind,source="$PWD/output-default",target=/home/prowler/output \
  prowlercloud/prowler:5.42.0 aws \
  --region eu-central-1 \
  --check vpc_endpoint_connections_trust_boundaries \
  --output-formats csv \
  --output-directory /home/prowler/output

1. Create a configuration that explicitly trusts one related account:

aws:
  trusted_account_ids:
    - "111122223333"

The audited account in this example is 444455556666. It is not included in the file because the check already treats the audited account as trusted.

1. Run the same image and check with that configuration:

mkdir -p "$PWD/output-configured"

docker run --rm -it \
  --env AWS_ACCESS_KEY_ID \
  --env AWS_SECRET_ACCESS_KEY \
  --env AWS_SESSION_TOKEN \
  --mount type=bind,source="$PWD/config.yaml",target=/home/prowler/config.yaml,readonly \
  --mount type=bind,source="$PWD/output-configured",target=/home/prowler/output \
  prowlercloud/prowler:5.42.0 aws \
  --region eu-central-1 \
  --check vpc_endpoint_connections_trust_boundaries \
  --config-file /home/prowler/config.yaml \
  --output-formats csv \
  --output-directory /home/prowler/output

The affected endpoint policies use wildcard principals restricted by aws:PrincipalAccount:

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "*",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "aws:PrincipalAccount": [
        "444455556666",
        "111122223333"
      ]
    }
  }
}

Expected behavior

Adding a trusted account should not make endpoint policies that previously passed become failures.

The example policy allows access only from the audited account and the explicitly trusted related account. Both accounts are trusted, so the endpoint should pass the check.

A policy restricted to only one of those trusted accounts should also pass. A policy allowing an account that is not trusted should fail.

Actual Result with Screenshots or Logs

Using the same official image, AWS credentials, region, check, and endpoint inventory:

The configured run reports:

Overview Results:
100.0% (25) Failed | 0.0% (0) Passed | 0.0% (0) Muted

Supplying one additional trusted account changes all 20 previously passing endpoints into failures, including endpoints whose policies allow access only from the audited account and the explicitly trusted account.

How did you install Prowler?

Docker, using the official image:

prowlercloud/prowler:5.42.0

Environment Resource

Docker container running locally on a developer workstation.

OS used

Host: macOS

Container: Debian GNU/Linux 13 (trixie), ARM64

Prowler version

5.42.0

Python version

3.12.13

Pip version

Not applicable. The official runtime image does not include pip.

Context

Prowler's default trusted_account_ids value is empty:

aws:
  trusted_account_ids: []

The regression appears only after an additional trusted account is explicitly configured. The audited account should not need to be duplicated in the configuration.

Related issue: #12816