From 07178ac69a927900fdac06e7258625ecc3c231fe Mon Sep 17 00:00:00 2001 From: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com> Date: Wed, 11 Dec 2024 16:10:12 +0100 Subject: [PATCH] feat(glacier): add new fixer `glacier_vaults_policy_public_access_fixer` (#5950) --- ...acier_vaults_policy_public_access_fixer.py | 38 +++++++++ ..._vaults_policy_public_access_fixer_test.py | 81 +++++++++++++++++++ ...lacier_vaults_policy_public_access_test.py | 18 +++++ 3 files changed, 137 insertions(+) create mode 100644 prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer.py create mode 100644 tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer_test.py diff --git a/prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer.py b/prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer.py new file mode 100644 index 0000000000..c9362e07bf --- /dev/null +++ b/prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer.py @@ -0,0 +1,38 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.glacier.glacier_client import glacier_client + + +def fixer(resource_id: str, region: str) -> bool: + """ + Modify the Glacier vault's policy to remove public access. + Specifically, this fixer delete the vault policy that has public access. + Requires the glacier:DeleteVaultAccessPolicy permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "glacier:DeleteVaultAccessPolicy", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The Glacier vault name. + region (str): AWS region where the Glacier vault exists. + Returns: + bool: True if the operation is successful (policy updated), False otherwise. + """ + try: + regional_client = glacier_client.regional_clients[region] + + regional_client.delete_vault_access_policy(vaultName=resource_id) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer_test.py b/tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer_test.py new file mode 100644 index 0000000000..87c808d722 --- /dev/null +++ b/tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer_test.py @@ -0,0 +1,81 @@ +from unittest import mock + +import botocore +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_public_vault(self, operation_name, kwarg): + if operation_name == "DeleteVaultAccessPolicy": + return { + "ResponseMetadata": { + "HTTPStatusCode": 204, + "RequestId": "test-request-id", + } + } + return mock_make_api_call(self, operation_name, kwarg) + + +def mock_make_api_call_public_vault_error(self, operation_name, kwarg): + if operation_name == "DeleteVaultAccessPolicy": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "VaultNotFound", + "Message": "VaultNotFound", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_glacier_vaults_policy_public_access_fixer: + @mock_aws + def test_glacier_vault_public(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", + new=mock_make_api_call_public_vault, + ): + from prowler.providers.aws.services.glacier.glacier_service import Glacier + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access_fixer.glacier_client", + new=Glacier(aws_provider), + ): + from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access_fixer import ( + fixer, + ) + + assert fixer(resource_id="test-vault", region=AWS_REGION_EU_WEST_1) + + @mock_aws + def test_glacier_vault_public_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", + new=mock_make_api_call_public_vault_error, + ): + from prowler.providers.aws.services.glacier.glacier_service import Glacier + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access_fixer.glacier_client", + new=Glacier(aws_provider), + ): + from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access_fixer import ( + fixer, + ) + + assert not fixer(resource_id="test-vault", region=AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_test.py b/tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_test.py index 2d10ed7d97..d267e1bc66 100644 --- a/tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_test.py +++ b/tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_test.py @@ -11,6 +11,9 @@ class Test_glacier_vaults_policy_public_access: with mock.patch( "prowler.providers.aws.services.glacier.glacier_service.Glacier", new=glacier_client, + ), mock.patch( + "prowler.providers.aws.services.glacier.glacier_client.glacier_client", + new=glacier_client, ): # Test Check from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import ( @@ -37,6 +40,9 @@ class Test_glacier_vaults_policy_public_access: with mock.patch( "prowler.providers.aws.services.glacier.glacier_service.Glacier", new=glacier_client, + ), mock.patch( + "prowler.providers.aws.services.glacier.glacier_client.glacier_client", + new=glacier_client, ): # Test Check from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import ( @@ -89,6 +95,9 @@ class Test_glacier_vaults_policy_public_access: with mock.patch( "prowler.providers.aws.services.glacier.glacier_service.Glacier", new=glacier_client, + ), mock.patch( + "prowler.providers.aws.services.glacier.glacier_client.glacier_client", + new=glacier_client, ): # Test Check from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import ( @@ -141,6 +150,9 @@ class Test_glacier_vaults_policy_public_access: with mock.patch( "prowler.providers.aws.services.glacier.glacier_service.Glacier", new=glacier_client, + ), mock.patch( + "prowler.providers.aws.services.glacier.glacier_client.glacier_client", + new=glacier_client, ): # Test Check from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import ( @@ -193,6 +205,9 @@ class Test_glacier_vaults_policy_public_access: with mock.patch( "prowler.providers.aws.services.glacier.glacier_service.Glacier", new=glacier_client, + ), mock.patch( + "prowler.providers.aws.services.glacier.glacier_client.glacier_client", + new=glacier_client, ): # Test Check from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import ( @@ -249,6 +264,9 @@ class Test_glacier_vaults_policy_public_access: with mock.patch( "prowler.providers.aws.services.glacier.glacier_service.Glacier", new=glacier_client, + ), mock.patch( + "prowler.providers.aws.services.glacier.glacier_client.glacier_client", + new=glacier_client, ): # Test Check from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import (