Orchestrator - Discovery + Run scan job

runtime_scan/pkg/provider/aws/client.go

@@ -304,18 +304,30 @@ func (c *Client) ListAllRegions(ctx context.Context) ([]Region, error) {
 	return ret, nil
 }
 
+// AND logic - if excludeTags = {tag1:val1, tag2:val2},
+// then instance will be excluded only if he have ALL this tags ({tag1:val1, tag2:val2})
 func hasExcludeTags(excludeTags []Tag, instanceTags []ec2types.Tag) bool {
-	var excludedTagsMap = make(map[string]string)
+	var instanceTagsMap = make(map[string]string)
 
-	for _, tag := range excludeTags {
-		excludedTagsMap[tag.key] = tag.val
+	if len(excludeTags) == 0 {
+		return false
 	}
-	for _, instanceTag := range instanceTags {
-		if val, ok := excludedTagsMap[*instanceTag.Key]; ok {
-			if strings.Compare(val, *instanceTag.Value) == 0 {
-				return true
-			}
+	if len(instanceTags) == 0 {
+		return false
+	}
+
+	for _, tag := range instanceTags {
+		instanceTagsMap[*tag.Key] = *tag.Value
+	}
+
+	for _, tag := range excludeTags {
+		val, ok := instanceTagsMap[tag.key]
+		if !ok {
+			return false
+		}
+		if !(strings.Compare(val, tag.val) == 0) {
+			return false
 		}
 	}
-	return false
+	return true
 }

runtime_scan/pkg/provider/aws/client_test.go

@@ -314,7 +314,7 @@ func Test_hasExcludedTags(t *testing.T) {
 			want: false,
 		},
 		{
-			name: "instance has excluded tags",
+			name: "instance does not have ALL the excluded tags",
 			args: args{
 				excludeTags: []Tag{
 					{
@@ -337,10 +337,40 @@ func Test_hasExcludedTags(t *testing.T) {
 					},
 				},
 			},
+			want: false,
+		},
+		{
+			name: "instance has ALL excluded tags",
+			args: args{
+				excludeTags: []Tag{
+					{
+						key: tagName1,
+						val: tagVal1,
+					},
+					{
+						key: tagName2,
+						val: tagVal2,
+					},
+				},
+				instanceTags: []ec2types.Tag{
+					{
+						Key:   &tagName1,
+						Value: &tagVal1,
+					},
+					{
+						Key:   &tagName2,
+						Value: &tagVal2,
+					},
+					{
+						Key:   utils.StringPtr("stam"),
+						Value: utils.StringPtr("stam"),
+					},
+				},
+			},
 			want: true,
 		},
 		{
-			name: "instance does not have excluded tags",
+			name: "instance does not have excluded tags at all",
 			args: args{
 				excludeTags: []Tag{
 					{

runtime_scan/pkg/provider/aws/types.go

@@ -28,7 +28,7 @@ type ScanScope struct {
 	// Only targets that have these tags will be selected for scanning within the selected scan scope.
 	// Multiple tags will be treated as an AND operator.
 	TagSelector []Tag
-	// Targets that have these tags will be excluded from the scan, even match the tag selector.
+	// Targets that have these tags will be excluded from the scan, even if they match the tag selector.
 	// Multiple tags will be treated as an AND operator.
 	ExcludeTags []Tag
 }