From 0331af02acb52de6f03196ae9b7bc3b69fe738b4 Mon Sep 17 00:00:00 2001 From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> Date: Fri, 25 Oct 2024 23:33:35 +0200 Subject: [PATCH] feat(mq): add new check `mq_broker_logging_enabled` (#5483) Co-authored-by: Sergio --- .../mq_broker_active_deployment_mode.py | 4 +- .../mq/mq_broker_logging_enabled/__init__.py | 0 .../mq_broker_logging_enabled.metadata.json | 32 +++ .../mq_broker_logging_enabled.py | 45 +++ .../providers/aws/services/mq/mq_service.py | 12 +- .../mq_broker_active_deployment_mode_test.py | 4 +- .../mq_broker_logging_enabled_test.py | 261 ++++++++++++++++++ .../aws/services/mq/mq_service_test.py | 8 +- 8 files changed, 358 insertions(+), 8 deletions(-) create mode 100644 prowler/providers/aws/services/mq/mq_broker_logging_enabled/__init__.py create mode 100644 prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.metadata.json create mode 100644 prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py create mode 100644 tests/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled_test.py diff --git a/prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py b/prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py index 8b4febf014..4beb81eba0 100644 --- a/prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py +++ b/prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py @@ -14,10 +14,10 @@ class mq_broker_active_deployment_mode(Check): report.resource_arn = broker.arn report.resource_tags = broker.tags report.status = "FAIL" - report.status_extended = f"MQ Broker {broker.name} does not have an active/standby deployment mode." + report.status_extended = f"MQ Apache ActiveMQ Broker {broker.name} does not have an active/standby deployment mode." if broker.deployment_mode == DeploymentMode.ACTIVE_STANDBY_MULTI_AZ: report.status = "PASS" - report.status_extended = f"MQ Broker {broker.name} does have an active/standby deployment mode." + report.status_extended = f"MQ Apache ActiveMQ Broker {broker.name} does have an active/standby deployment mode." findings.append(report) diff --git a/prowler/providers/aws/services/mq/mq_broker_logging_enabled/__init__.py b/prowler/providers/aws/services/mq/mq_broker_logging_enabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.metadata.json b/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.metadata.json new file mode 100644 index 0000000000..60804d10f2 --- /dev/null +++ b/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.metadata.json @@ -0,0 +1,32 @@ +{ + "Provider": "aws", + "CheckID": "mq_broker_logging_enabled", + "CheckTitle": "MQ brokers should stream audit logs to CloudWatch.", + "CheckType": [ + "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls" + ], + "ServiceName": "mq", + "SubServiceName": "", + "ResourceIdTemplate": "arn:aws:mq:region:account-id:broker:broker-id", + "Severity": "medium", + "ResourceType": "AwsAmazonMQBroker", + "Description": "Ensure MQ brokers are configured to stream audit logs to CloudWatch to enhance monitoring and detect security-related issues.", + "Risk": "Without streaming audit logs to CloudWatch, monitoring and alerting on suspicious activity or security incidents is limited. This reduces visibility into the broker's operations and potential security breaches.", + "RelatedUrl": "https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/security-logging-monitoring.html", + "Remediation": { + "Code": { + "CLI": "aws mq update-broker --broker-id --logs 'audit=true'", + "NativeIaC": "https://docs.prowler.com/checks/aws/logging-policies/bc_aws_logging_10/#terraform", + "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/mq-controls.html#mq-2", + "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/MQ/log-exports.html" + }, + "Recommendation": { + "Text": "Ensure MQ brokers are configured to stream audit logs to CloudWatch to enhance monitoring and detect security-related issues.", + "Url": "https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/configure-logging-monitoring-activemq.html" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py b/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py new file mode 100644 index 0000000000..9d978b999c --- /dev/null +++ b/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py @@ -0,0 +1,45 @@ +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.mq.mq_client import mq_client +from prowler.providers.aws.services.mq.mq_service import EngineType + + +class mq_broker_logging_enabled(Check): + """Ensure that MQ Brokers have logging enabled + + This check will return FAIL if the MQ Broker does not have logging enabled. + """ + + def execute(self): + """Execute the check + + Returns: List[Check_Report_AWS]: List of check reports + """ + findings = [] + for broker in mq_client.brokers.values(): + report = Check_Report_AWS(self.metadata()) + report.region = broker.region + report.resource_id = broker.id + report.resource_arn = broker.arn + report.resource_tags = broker.tags + report.status = "FAIL" + report.status_extended = ( + f"MQ Broker {broker.name} does not have logging enabled." + ) + logging_enabled = False + + if broker.engine_type == EngineType.ACTIVEMQ: + logging_enabled = ( + broker.general_logging_enabled and broker.audit_logging_enabled + ) + elif broker.engine_type == EngineType.RABBITMQ: + logging_enabled = broker.general_logging_enabled + + if logging_enabled: + report.status = "PASS" + report.status_extended = ( + f"MQ Broker {broker.name} does have logging enabled." + ) + + findings.append(report) + + return findings diff --git a/prowler/providers/aws/services/mq/mq_service.py b/prowler/providers/aws/services/mq/mq_service.py index a88649bb3c..c66c05a485 100644 --- a/prowler/providers/aws/services/mq/mq_service.py +++ b/prowler/providers/aws/services/mq/mq_service.py @@ -50,6 +50,12 @@ class MQ(AWSService): broker.auto_minor_version_upgrade = describe_broker.get( "AutoMinorVersionUpgrade", False ) + broker.general_logging_enabled = describe_broker.get("Logs", {}).get( + "General", False + ) + broker.audit_logging_enabled = describe_broker.get("Logs", {}).get( + "Audit", False + ) broker.tags = [describe_broker.get("Tags", {})] except Exception as error: @@ -80,9 +86,9 @@ class Broker(BaseModel): name: str id: str region: str - engine_type: EngineType = EngineType.ACTIVEMQ - deployment_mode: DeploymentMode = DeploymentMode.SINGLE_INSTANCE - auto_minor_version_upgrade: bool = False + auto_minor_version_upgrade: bool = Field(default=False) + general_logging_enabled: bool = Field(default=False) + audit_logging_enabled: bool = Field(default=False) engine_type: EngineType = EngineType.ACTIVEMQ deployment_mode: DeploymentMode = DeploymentMode.SINGLE_INSTANCE tags: List[Dict[str, str]] = Field(default_factory=list) diff --git a/tests/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode_test.py b/tests/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode_test.py index adedafa34a..6cc9765e76 100644 --- a/tests/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode_test.py +++ b/tests/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode_test.py @@ -120,7 +120,7 @@ class Test_mq_activemq_broker_active_standby_mode: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"MQ Broker {broker_name} does have an active/standby deployment mode." + == f"MQ Apache ActiveMQ Broker {broker_name} does have an active/standby deployment mode." ) assert result[0].resource_id == broker_id assert ( @@ -173,7 +173,7 @@ class Test_mq_activemq_broker_active_standby_mode: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"MQ Broker {broker_name} does not have an active/standby deployment mode." + == f"MQ Apache ActiveMQ Broker {broker_name} does not have an active/standby deployment mode." ) assert result[0].resource_id == broker_id assert ( diff --git a/tests/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled_test.py b/tests/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled_test.py new file mode 100644 index 0000000000..831035ca22 --- /dev/null +++ b/tests/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled_test.py @@ -0,0 +1,261 @@ +from unittest import mock + +from boto3 import client +from moto import mock_aws + +from tests.providers.aws.utils import ( + AWS_ACCOUNT_NUMBER, + AWS_REGION_US_EAST_1, + set_mocked_aws_provider, +) + + +class Test_mq_broker_logging_enabled: + @mock_aws + def test_no_brokers(self): + from prowler.providers.aws.services.mq.mq_service import MQ + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled.mq_client", + new=MQ(aws_provider), + ): + # Test Check + from prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled import ( + mq_broker_logging_enabled, + ) + + check = mq_broker_logging_enabled() + result = check.execute() + + assert len(result) == 0 + + @mock_aws + def test_rabbitmq_broker_logging_enabled(self): + mq_client = client("mq", region_name=AWS_REGION_US_EAST_1) + broker_name = "test-broker" + engine_type = "RABBITMQ" + broker_id = mq_client.create_broker( + BrokerName=broker_name, + EngineType=engine_type, + EngineVersion="5.15.0", + HostInstanceType="mq.t2.micro", + Users=[ + { + "Username": "admin", + "Password": "admin", + }, + ], + DeploymentMode="SINGLE_INSTANCE", + PubliclyAccessible=False, + AutoMinorVersionUpgrade=True, + Logs={ + "General": True, + }, + )["BrokerId"] + + from prowler.providers.aws.services.mq.mq_service import MQ + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled.mq_client", + new=MQ(aws_provider), + ): + # Test Check + from prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled import ( + mq_broker_logging_enabled, + ) + + check = mq_broker_logging_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"MQ Broker {broker_name} does have logging enabled." + ) + assert result[0].resource_id == broker_id + assert ( + result[0].resource_arn + == f"arn:{aws_provider.identity.partition}:mq:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:broker:{broker_id}" + ) + assert result[0].region == AWS_REGION_US_EAST_1 + + @mock_aws + def test_rabbitmq_broker_logging_disabled(self): + mq_client = client("mq", region_name=AWS_REGION_US_EAST_1) + broker_name = "test-broker" + engine_type = "RABBITMQ" + broker_id = mq_client.create_broker( + BrokerName=broker_name, + EngineType=engine_type, + EngineVersion="5.15.0", + HostInstanceType="mq.t2.micro", + Users=[ + { + "Username": "admin", + "Password": "admin", + }, + ], + DeploymentMode="SINGLE_INSTANCE", + PubliclyAccessible=False, + AutoMinorVersionUpgrade=True, + Logs={ + "General": False, + }, + )["BrokerId"] + + from prowler.providers.aws.services.mq.mq_service import MQ + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled.mq_client", + new=MQ(aws_provider), + ): + # Test Check + from prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled import ( + mq_broker_logging_enabled, + ) + + check = mq_broker_logging_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"MQ Broker {broker_name} does not have logging enabled." + ) + assert result[0].resource_id == broker_id + assert ( + result[0].resource_arn + == f"arn:{aws_provider.identity.partition}:mq:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:broker:{broker_id}" + ) + assert result[0].region == AWS_REGION_US_EAST_1 + + @mock_aws + def test_activemq_broker_logging_enabled(self): + mq_client = client("mq", region_name=AWS_REGION_US_EAST_1) + broker_name = "test-broker" + engine_type = "ACTIVEMQ" + broker_id = mq_client.create_broker( + BrokerName=broker_name, + EngineType=engine_type, + EngineVersion="5.15.0", + HostInstanceType="mq.t2.micro", + Users=[ + { + "Username": "admin", + "Password": "admin", + }, + ], + DeploymentMode="SINGLE_INSTANCE", + PubliclyAccessible=False, + AutoMinorVersionUpgrade=True, + Logs={ + "General": True, + "Audit": True, + }, + )["BrokerId"] + + from prowler.providers.aws.services.mq.mq_service import MQ + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled.mq_client", + new=MQ(aws_provider), + ): + # Test Check + from prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled import ( + mq_broker_logging_enabled, + ) + + check = mq_broker_logging_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"MQ Broker {broker_name} does have logging enabled." + ) + assert result[0].resource_id == broker_id + assert ( + result[0].resource_arn + == f"arn:{aws_provider.identity.partition}:mq:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:broker:{broker_id}" + ) + assert result[0].region == AWS_REGION_US_EAST_1 + + @mock_aws + def test_activemq_broker_logging_disabled(self): + mq_client = client("mq", region_name=AWS_REGION_US_EAST_1) + broker_name = "test-broker" + engine_type = "ACTIVEMQ" + broker_id = mq_client.create_broker( + BrokerName=broker_name, + EngineType=engine_type, + EngineVersion="5.15.0", + HostInstanceType="mq.t2.micro", + Users=[ + { + "Username": "admin", + "Password": "admin", + }, + ], + DeploymentMode="SINGLE_INSTANCE", + PubliclyAccessible=False, + AutoMinorVersionUpgrade=True, + Logs={ + "General": True, + "Audit": False, + }, + )["BrokerId"] + + from prowler.providers.aws.services.mq.mq_service import MQ + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled.mq_client", + new=MQ(aws_provider), + ): + # Test Check + from prowler.providers.aws.services.mq.mq_broker_logging_enabled.mq_broker_logging_enabled import ( + mq_broker_logging_enabled, + ) + + check = mq_broker_logging_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"MQ Broker {broker_name} does not have logging enabled." + ) + assert result[0].resource_id == broker_id + assert ( + result[0].resource_arn + == f"arn:{aws_provider.identity.partition}:mq:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:broker:{broker_id}" + ) + assert result[0].region == AWS_REGION_US_EAST_1 diff --git a/tests/providers/aws/services/mq/mq_service_test.py b/tests/providers/aws/services/mq/mq_service_test.py index 6b14ba8e09..b6bf6a6e12 100644 --- a/tests/providers/aws/services/mq/mq_service_test.py +++ b/tests/providers/aws/services/mq/mq_service_test.py @@ -86,11 +86,17 @@ class Test_MQ_Service: "Username": "user", } ], - Tags={"key": "value"}, ) broker_arn = broker["BrokerArn"] broker["BrokerId"] + mq_client.create_tags( + ResourceArn=broker_arn, + Tags={ + "key": "value", + }, + ) + # MQ Client for this test class aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) mq = MQ(aws_provider)