fix(checks_loader): Handle multiple services and severities (#8302)

prowler/CHANGELOG.md

@@ -29,6 +29,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Use subscription ID in Azure mutelist [(#8290)](https://github.com/prowler-cloud/prowler/pull/8290)
 - `ServiceName` field in Network Firewall checks metadata [(#8280)](https://github.com/prowler-cloud/prowler/pull/8280)
 - Update `entra_users_mfa_capable` check to use the correct resource name and ID [(#8288)](https://github.com/prowler-cloud/prowler/pull/8288)
+- Handle multiple services and severities while listing checks [(#8302)](https://github.com/prowler-cloud/prowler/pull/8302)
 
 ---
 

prowler/lib/check/checks_loader.py

@@ -66,16 +66,15 @@ def load_checks_to_execute(
                 checks_to_execute.update(check_severities[severity])
 
             if service_list:
+                checks_from_services = set()
                 for service in service_list:
-                    checks_to_execute = (
-                        set(
-                            CheckMetadata.list(
-                                bulk_checks_metadata=bulk_checks_metadata,
-                                service=service,
-                            )
-                        )
-                        & checks_to_execute
+                    service_checks = CheckMetadata.list(
+                        bulk_checks_metadata=bulk_checks_metadata,
+                        service=service,
                     )
+                    checks_from_services.update(service_checks)
+                checks_to_execute = checks_from_services & checks_to_execute
+
         # Handle if there are checks passed using -C/--checks-file
         elif checks_file:
             checks_to_execute = parse_checks_from_file(checks_file, provider)

tests/lib/check/check_loader_test.py

@@ -14,6 +14,11 @@ S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME_CUSTOM_ALIAS = (
 S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_SEVERITY = "medium"
 S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME_SERVICE = "s3"
 
+IAM_USER_NO_MFA_NAME = "iam_user_no_mfa"
+IAM_USER_NO_MFA_NAME_CUSTOM_ALIAS = "iam_user_no_mfa"
+IAM_USER_NO_MFA_NAME_SERVICE = "iam"
+IAM_USER_NO_MFA_SEVERITY = "high"
+
 CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME = "cloudtrail_threat_detection_enumeration"
 
 
@@ -54,6 +59,40 @@ class TestCheckLoader:
             Compliance=[],
         )
 
+    def get_custom_check_iam_metadata(self):
+        return CheckMetadata(
+            Provider="aws",
+            CheckID=IAM_USER_NO_MFA_NAME,
+            CheckTitle="Check IAM User No MFA.",
+            CheckType=["Data Protection"],
+            CheckAliases=[IAM_USER_NO_MFA_NAME_CUSTOM_ALIAS],
+            ServiceName=IAM_USER_NO_MFA_NAME_SERVICE,
+            SubServiceName="",
+            ResourceIdTemplate="arn:partition:iam::account-id:user/user_name",
+            Severity=IAM_USER_NO_MFA_SEVERITY,
+            ResourceType="AwsIamUser",
+            Description="Check IAM User No MFA.",
+            Risk="IAM users should have Multi-Factor Authentication (MFA) enabled.",
+            RelatedUrl="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html",
+            Remediation=Remediation(
+                Code=Code(
+                    NativeIaC="",
+                    Terraform="https://docs.prowler.com/checks/aws/iam-policies/bc_aws_iam_20#terraform",
+                    CLI="aws iam create-virtual-mfa-device --user-name <USER_NAME> --serial-number <SERIAL_NUMBER>",
+                    Other="https://github.com/cloudmatos/matos/tree/master/remediations/aws/iam/iam/enable-mfa",
+                ),
+                Recommendation=Recommendation(
+                    Text="You can enable MFA for your IAM user to prevent unauthorized access to your AWS account.",
+                    Url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html",
+                ),
+            ),
+            Categories=[],
+            DependsOn=[],
+            RelatedTo=[],
+            Notes="",
+            Compliance=[],
+        )
+
     def get_threat_detection_check_metadata(self):
         return CheckMetadata(
             Provider="aws",
@@ -130,6 +169,24 @@ class TestCheckLoader:
             provider=self.provider,
         )
 
+    def test_load_checks_to_execute_with_severities_and_services_multiple(self):
+        bulk_checks_metatada = {
+            S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata(),
+            IAM_USER_NO_MFA_NAME: self.get_custom_check_iam_metadata(),
+        }
+        service_list = ["s3", "iam"]
+        severities = ["medium", "high"]
+
+        assert {
+            S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME,
+            IAM_USER_NO_MFA_NAME,
+        } == load_checks_to_execute(
+            bulk_checks_metadata=bulk_checks_metatada,
+            service_list=service_list,
+            severities=severities,
+            provider=self.provider,
+        )
+
     def test_load_checks_to_execute_with_severities_and_services_not_within_severity(
         self,
     ):