diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 6c1c912403..a940eb9f95 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -29,6 +29,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Use subscription ID in Azure mutelist [(#8290)](https://github.com/prowler-cloud/prowler/pull/8290) - `ServiceName` field in Network Firewall checks metadata [(#8280)](https://github.com/prowler-cloud/prowler/pull/8280) - Update `entra_users_mfa_capable` check to use the correct resource name and ID [(#8288)](https://github.com/prowler-cloud/prowler/pull/8288) +- Handle multiple services and severities while listing checks [(#8302)](https://github.com/prowler-cloud/prowler/pull/8302) --- diff --git a/prowler/lib/check/checks_loader.py b/prowler/lib/check/checks_loader.py index f45b0e917d..3c7e065fc0 100644 --- a/prowler/lib/check/checks_loader.py +++ b/prowler/lib/check/checks_loader.py @@ -66,16 +66,15 @@ def load_checks_to_execute( checks_to_execute.update(check_severities[severity]) if service_list: + checks_from_services = set() for service in service_list: - checks_to_execute = ( - set( - CheckMetadata.list( - bulk_checks_metadata=bulk_checks_metadata, - service=service, - ) - ) - & checks_to_execute + service_checks = CheckMetadata.list( + bulk_checks_metadata=bulk_checks_metadata, + service=service, ) + checks_from_services.update(service_checks) + checks_to_execute = checks_from_services & checks_to_execute + # Handle if there are checks passed using -C/--checks-file elif checks_file: checks_to_execute = parse_checks_from_file(checks_file, provider) diff --git a/tests/lib/check/check_loader_test.py b/tests/lib/check/check_loader_test.py index 69ea5715f3..d61c7149d5 100644 --- a/tests/lib/check/check_loader_test.py +++ b/tests/lib/check/check_loader_test.py @@ -14,6 +14,11 @@ S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME_CUSTOM_ALIAS = ( S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_SEVERITY = "medium" S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME_SERVICE = "s3" +IAM_USER_NO_MFA_NAME = "iam_user_no_mfa" +IAM_USER_NO_MFA_NAME_CUSTOM_ALIAS = "iam_user_no_mfa" +IAM_USER_NO_MFA_NAME_SERVICE = "iam" +IAM_USER_NO_MFA_SEVERITY = "high" + CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME = "cloudtrail_threat_detection_enumeration" @@ -54,6 +59,40 @@ class TestCheckLoader: Compliance=[], ) + def get_custom_check_iam_metadata(self): + return CheckMetadata( + Provider="aws", + CheckID=IAM_USER_NO_MFA_NAME, + CheckTitle="Check IAM User No MFA.", + CheckType=["Data Protection"], + CheckAliases=[IAM_USER_NO_MFA_NAME_CUSTOM_ALIAS], + ServiceName=IAM_USER_NO_MFA_NAME_SERVICE, + SubServiceName="", + ResourceIdTemplate="arn:partition:iam::account-id:user/user_name", + Severity=IAM_USER_NO_MFA_SEVERITY, + ResourceType="AwsIamUser", + Description="Check IAM User No MFA.", + Risk="IAM users should have Multi-Factor Authentication (MFA) enabled.", + RelatedUrl="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html", + Remediation=Remediation( + Code=Code( + NativeIaC="", + Terraform="https://docs.prowler.com/checks/aws/iam-policies/bc_aws_iam_20#terraform", + CLI="aws iam create-virtual-mfa-device --user-name --serial-number ", + Other="https://github.com/cloudmatos/matos/tree/master/remediations/aws/iam/iam/enable-mfa", + ), + Recommendation=Recommendation( + Text="You can enable MFA for your IAM user to prevent unauthorized access to your AWS account.", + Url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html", + ), + ), + Categories=[], + DependsOn=[], + RelatedTo=[], + Notes="", + Compliance=[], + ) + def get_threat_detection_check_metadata(self): return CheckMetadata( Provider="aws", @@ -130,6 +169,24 @@ class TestCheckLoader: provider=self.provider, ) + def test_load_checks_to_execute_with_severities_and_services_multiple(self): + bulk_checks_metatada = { + S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata(), + IAM_USER_NO_MFA_NAME: self.get_custom_check_iam_metadata(), + } + service_list = ["s3", "iam"] + severities = ["medium", "high"] + + assert { + S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME, + IAM_USER_NO_MFA_NAME, + } == load_checks_to_execute( + bulk_checks_metadata=bulk_checks_metatada, + service_list=service_list, + severities=severities, + provider=self.provider, + ) + def test_load_checks_to_execute_with_severities_and_services_not_within_severity( self, ):