feat(experimental): filter groups

[ekristen]

Overview

By default all filters are part of group default, this allows you to set group: <value> for any filter.

Filters within the same group are OR, meaning if any are true, then the resource is filtered.

If more than 1 filter group is present, they are ANDed together and both groups must be true for the filter to match.

Example Output

This is the filter definition

    filters:
      IAMUser:
        - value: "testing"
          type: contains
          group: group1
        - property: tag:test
          value: "alpha"
          group: group2

WITHOUT filter groups, both resources get filtered because they match 1 or more filters.

global - IAMUser - testing - [CreateDate: "2024-10-15T22:42:39Z", Name: "testing", Path: "/", UserID: "AIDAZI2LHXQ5T2ABOSX2H"] - filtered by config
global - IAMUser - testing12345 - [CreateDate: "2024-10-15T22:42:52Z", Name: "testing12345", Path: "/", UserID: "AIDAZI2LHXQ5YFP5X4QVZ", tag:test: "alpha"] - filtered by config
Scan complete: 2 total, 0 nukeable, 2 filtered.

WITH filter groups enabled via --feature-flag filter-groups, only a single resource gets filtered because it has to match BOTH because there are two groups defined.

global - IAMUser - testing - [CreateDate: "2024-10-15T22:42:39Z", Name: "testing", Path: "/", UserID: "AIDAZI2LHXQ5T2ABOSX2H"] - would remove
global - IAMUser - testing12345 - [CreateDate: "2024-10-15T22:42:52Z", Name: "testing12345", Path: "/", UserID: "AIDAZI2LHXQ5YFP5X4QVZ", tag:test: "alpha"] - filtered by config
Scan complete: 2 total, 1 nukeable, 1 filtered.

References

• Resolves Request: support for logical "and" for filters #378

[ekristen]

🎉 This PR is included in version 3.28.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀