How to mute recurring security findings for expected configurations

If you have security findings that are flagging expected configurations in your infrastructure, you can mute these findings to prevent them from appearing in future scans.

When to mute findings

It's appropriate to mute findings when:

• The flagged configuration is intentional and expected (e.g., hardcoded ARN values in ECS task definitions, S3 buckets with public read access for static content)

• The finding will repeatedly appear across multiple resources or deployments

• You have a valid business justification for the configuration

How to mute findings

When muting a finding, you should:

1. Navigate to the specific finding you want to mute

2. Select the mute option

3. Provide clear justification explaining why the configuration is acceptable (e.g., "ARN values are intentionally hardcoded for resource discovery" or "S3 bucket requires public read access to serve static content")

Once muted with proper justification, the finding should not reappear in future scans, even when new resources with the same configuration are deployed.

Working with audit partners

If you're unsure whether a finding should be muted, especially in regulated environments, you can request guidance on what auditors typically look for when reviewing security evidence. This can help ensure your muting decisions align with compliance requirements.