diff --git a/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.py b/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.py index 339f81560e..84f60beee5 100644 --- a/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.py +++ b/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.py @@ -15,7 +15,8 @@ class backup_plans_exist(Check): report.resource_id = backup_client.backup_plans[0].name findings.append(report) elif backup_client.backup_vaults: - report = Check_Report_AWS(self.metadata(), resource_metadata=backup_client) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata={}) + report.region = backup_client.region report.status = "FAIL" report.status_extended = "No Backup Plan exist." report.resource_arn = backup_client.backup_plan_arn_template diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_cross_account_sharing_disabled/cloudwatch_cross_account_sharing_disabled.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_cross_account_sharing_disabled/cloudwatch_cross_account_sharing_disabled.py index 1614ba5f6a..db6c573507 100644 --- a/prowler/providers/aws/services/cloudwatch/cloudwatch_cross_account_sharing_disabled/cloudwatch_cross_account_sharing_disabled.py +++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_cross_account_sharing_disabled/cloudwatch_cross_account_sharing_disabled.py @@ -16,7 +16,9 @@ class cloudwatch_cross_account_sharing_disabled(Check): report.resource_id = iam_client.audited_account for role in iam_client.roles: if role.name == "CloudWatch-CrossAccountSharingRole": - report = Check_Report_AWS(self.metadata(), role) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=role + ) report.region = iam_client.region report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.py b/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.py index 1d658f6626..622da37a11 100644 --- a/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.py +++ b/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.py @@ -8,10 +8,7 @@ class directconnect_virtual_interface_redundancy(Check): def execute(self): findings = [] for vgw in directconnect_client.vgws.values(): - report = Check_Report_AWS(self.metadata()) - report.resource_arn = vgw.arn - report.region = vgw.region - report.resource_id = vgw.id + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=vgw) if len(vgw.vifs) < 2: report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/efs/efs_mount_target_not_publicly_accessible/efs_mount_target_not_publicly_accessible.py b/prowler/providers/aws/services/efs/efs_mount_target_not_publicly_accessible/efs_mount_target_not_publicly_accessible.py index ede0b25329..bcec7fa812 100644 --- a/prowler/providers/aws/services/efs/efs_mount_target_not_publicly_accessible/efs_mount_target_not_publicly_accessible.py +++ b/prowler/providers/aws/services/efs/efs_mount_target_not_publicly_accessible/efs_mount_target_not_publicly_accessible.py @@ -7,11 +7,7 @@ class efs_mount_target_not_publicly_accessible(Check): def execute(self): findings = [] for fs in efs_client.filesystems.values(): - report = Check_Report_AWS(self.metadata()) - report.region = fs.region - report.resource_id = fs.id - report.resource_arn = fs.arn - report.resource_tags = fs.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fs) report.status = "PASS" report.status_extended = ( f"EFS {fs.id} does not have any public mount targets." diff --git a/prowler/providers/aws/services/elbv2/elbv2_insecure_ssl_ciphers/elbv2_insecure_ssl_ciphers.py b/prowler/providers/aws/services/elbv2/elbv2_insecure_ssl_ciphers/elbv2_insecure_ssl_ciphers.py index af1ab3d79d..848990a444 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_insecure_ssl_ciphers/elbv2_insecure_ssl_ciphers.py +++ b/prowler/providers/aws/services/elbv2/elbv2_insecure_ssl_ciphers/elbv2_insecure_ssl_ciphers.py @@ -17,12 +17,8 @@ class elbv2_insecure_ssl_ciphers(Check): "ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06", "ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06", ] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elbv2_client.loadbalancersv2.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "PASS" report.status_extended = ( f"ELBv2 {lb.name} does not have insecure SSL protocols or ciphers." diff --git a/prowler/providers/aws/services/eventbridge/eventbridge_bus_cross_account_access/eventbridge_bus_cross_account_access.py b/prowler/providers/aws/services/eventbridge/eventbridge_bus_cross_account_access/eventbridge_bus_cross_account_access.py index dd971a235d..5a566ce9f1 100644 --- a/prowler/providers/aws/services/eventbridge/eventbridge_bus_cross_account_access/eventbridge_bus_cross_account_access.py +++ b/prowler/providers/aws/services/eventbridge/eventbridge_bus_cross_account_access/eventbridge_bus_cross_account_access.py @@ -9,11 +9,7 @@ class eventbridge_bus_cross_account_access(Check): def execute(self): findings = [] for bus in eventbridge_client.buses.values(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = bus.name - report.resource_arn = bus.arn - report.resource_tags = bus.tags - report.region = bus.region + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=bus) report.status = "PASS" report.status_extended = ( f"EventBridge event bus {bus.name} does not allow cross-account access." diff --git a/prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py b/prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py index e8326ec88a..dd270ae358 100644 --- a/prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py +++ b/prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py @@ -47,7 +47,9 @@ class iam_user_accesskey_unused(Check): ) - parser.parse(user["access_key_1_last_used_date"]) if access_key_1_last_used_date.days > maximum_expiration_days: old_access_keys = True - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] + "/AccessKey1" report.resource_arn = user["arn"] @@ -63,7 +65,9 @@ class iam_user_accesskey_unused(Check): ) - parser.parse(user["access_key_2_last_used_date"]) if access_key_2_last_used_date.days > maximum_expiration_days: old_access_keys = True - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] + "/AccessKey2" report.resource_arn = user["arn"] @@ -73,7 +77,9 @@ class iam_user_accesskey_unused(Check): findings.append(report) if not old_access_keys: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] report.resource_arn = user["arn"] diff --git a/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py b/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py index e8e6f60e2f..5b02f2e821 100644 --- a/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py +++ b/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py @@ -28,7 +28,9 @@ class route53_dangling_ip_subdomain_takeover(Check): for record in record_set.records: # Check if record is an IP Address if validate_ip_address(record): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=record_set + ) report.resource_id = ( f"{record_set.hosted_zone_id}/{record_set.name}/{record}" ) @@ -38,7 +40,6 @@ class route53_dangling_ip_subdomain_takeover(Check): report.resource_tags = route53_client.hosted_zones[ record_set.hosted_zone_id ].tags - report.region = record_set.region report.status = "PASS" report.status_extended = f"Route53 record {record} (name: {record_set.name}) in Hosted Zone {route53_client.hosted_zones[record_set.hosted_zone_id].name} is not a dangling IP." # If Public IP check if it is in the AWS Account diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_models_vpc_settings_configured/sagemaker_models_vpc_settings_configured.py b/prowler/providers/aws/services/sagemaker/sagemaker_models_vpc_settings_configured/sagemaker_models_vpc_settings_configured.py index afe6e6562f..7995dde1cb 100644 --- a/prowler/providers/aws/services/sagemaker/sagemaker_models_vpc_settings_configured/sagemaker_models_vpc_settings_configured.py +++ b/prowler/providers/aws/services/sagemaker/sagemaker_models_vpc_settings_configured/sagemaker_models_vpc_settings_configured.py @@ -6,11 +6,7 @@ class sagemaker_models_vpc_settings_configured(Check): def execute(self): findings = [] for model in sagemaker_client.sagemaker_models: - report = Check_Report_AWS(self.metadata()) - report.region = model.region - report.resource_id = model.name - report.resource_arn = model.arn - report.resource_tags = model.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=model) report.status = "PASS" report.status_extended = ( f"Sagemaker notebook instance {model.name} has VPC settings enabled." diff --git a/prowler/providers/aws/services/shield/shield_advanced_protection_in_internet_facing_load_balancers/shield_advanced_protection_in_internet_facing_load_balancers.py b/prowler/providers/aws/services/shield/shield_advanced_protection_in_internet_facing_load_balancers/shield_advanced_protection_in_internet_facing_load_balancers.py index 946c3fac34..d6eb56b9ca 100644 --- a/prowler/providers/aws/services/shield/shield_advanced_protection_in_internet_facing_load_balancers/shield_advanced_protection_in_internet_facing_load_balancers.py +++ b/prowler/providers/aws/services/shield/shield_advanced_protection_in_internet_facing_load_balancers/shield_advanced_protection_in_internet_facing_load_balancers.py @@ -9,11 +9,10 @@ class shield_advanced_protection_in_internet_facing_load_balancers(Check): if shield_client.enabled: for elbv2_arn, elbv2 in elbv2_client.loadbalancersv2.items(): if elbv2.type == "application" and elbv2.scheme == "internet-facing": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=elbv2 + ) report.region = shield_client.region - report.resource_id = elbv2.name - report.resource_arn = elbv2_arn - report.resource_tags = elbv2.tags report.status = "FAIL" report.status_extended = f"ELBv2 ALB {elbv2.name} is not protected by AWS Shield Advanced." diff --git a/prowler/providers/aws/services/sns/sns_subscription_not_using_http_endpoints/sns_subscription_not_using_http_endpoints.py b/prowler/providers/aws/services/sns/sns_subscription_not_using_http_endpoints/sns_subscription_not_using_http_endpoints.py index 056c35edbb..322d426597 100644 --- a/prowler/providers/aws/services/sns/sns_subscription_not_using_http_endpoints/sns_subscription_not_using_http_endpoints.py +++ b/prowler/providers/aws/services/sns/sns_subscription_not_using_http_endpoints/sns_subscription_not_using_http_endpoints.py @@ -9,9 +9,9 @@ class sns_subscription_not_using_http_endpoints(Check): for subscription in topic.subscriptions: if subscription.arn == "PendingConfirmation": continue - report = Check_Report_AWS(self.metadata()) - report.resource_id = subscription.id - report.resource_arn = subscription.arn + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=subscription + ) report.resource_details = topic.arn report.status = "PASS" report.status_extended = ( diff --git a/prowler/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets.py b/prowler/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets.py index d70cf187e4..3e3bbe93f7 100644 --- a/prowler/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets.py +++ b/prowler/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets.py @@ -12,11 +12,9 @@ class ssm_document_secrets(Check): "secrets_ignore_patterns", [] ) for document in ssm_client.documents.values(): - report = Check_Report_AWS(self.metadata()) - report.region = document.region - report.resource_arn = document.arn - report.resource_id = document.name - report.resource_tags = document.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=document + ) report.status = "PASS" report.status_extended = ( f"No secrets found in SSM Document {document.name}."