diff --git a/prowler/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled.py b/prowler/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled.py index 9ef750a440..7c067a9a41 100644 --- a/prowler/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled.py +++ b/prowler/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled.py @@ -6,29 +6,30 @@ class acm_certificates_transparency_logs_enabled(Check): def execute(self): findings = [] for certificate in acm_client.certificates: - report = Check_Report_AWS(self.metadata()) - report.region = certificate.region - if certificate.type == "IMPORTED": - report.status = "PASS" - report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} is imported." - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags - else: - if not certificate.transparency_logging: - report.status = "FAIL" - report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has Certificate Transparency logging disabled." + if certificate.in_use or acm_client.provider.scan_unused_services: + report = Check_Report_AWS(self.metadata()) + report.region = certificate.region + if certificate.type == "IMPORTED": + report.status = "PASS" + report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} is imported." report.resource_id = certificate.id report.resource_details = certificate.name report.resource_arn = certificate.arn report.resource_tags = certificate.tags else: - report.status = "PASS" - report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has Certificate Transparency logging enabled." - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags - findings.append(report) + if not certificate.transparency_logging: + report.status = "FAIL" + report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has Certificate Transparency logging disabled." + report.resource_id = certificate.id + report.resource_details = certificate.name + report.resource_arn = certificate.arn + report.resource_tags = certificate.tags + else: + report.status = "PASS" + report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has Certificate Transparency logging enabled." + report.resource_id = certificate.id + report.resource_details = certificate.name + report.resource_arn = certificate.arn + report.resource_tags = certificate.tags + findings.append(report) return findings diff --git a/tests/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled_test.py b/tests/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled_test.py index 7e801ab706..a95edabe41 100644 --- a/tests/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled_test.py +++ b/tests/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled_test.py @@ -26,12 +26,53 @@ class Test_acm_certificates_transparency_logs_enabled: assert len(result) == 0 + def test_unused_acm_certificate(self): + certificate_id = str(uuid.uuid4()) + certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}" + certificate_name = "test-certificate.com" + certificate_type = "AMAZON_ISSUED" + certificate_key_algorithm = "RSA-2048" + + acm_client = mock.MagicMock + acm_client.certificates = [ + Certificate( + arn=certificate_arn, + id=certificate_id, + name=certificate_name, + type=certificate_type, + key_algorithm=certificate_key_algorithm, + expiration_days=365, + transparency_logging=True, + in_use=False, + region=AWS_REGION, + ) + ] + + acm_client.provider = mock.MagicMock(scan_unused_services=False) + + with mock.patch( + "prowler.providers.aws.services.acm.acm_service.ACM", + new=acm_client, + ), mock.patch( + "prowler.providers.aws.services.acm.acm_client.acm_client", + new=acm_client, + ): + # Test Check + from prowler.providers.aws.services.acm.acm_certificates_transparency_logs_enabled.acm_certificates_transparency_logs_enabled import ( + acm_certificates_transparency_logs_enabled, + ) + + check = acm_certificates_transparency_logs_enabled() + result = check.execute() + + assert len(result) == 0 + def test_acm_certificate_with_logging(self): certificate_id = str(uuid.uuid4()) certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}" certificate_name = "test-certificate.com" certificate_type = "AMAZON_ISSUED" - certificate_key_algorithm = "RSA_2048" + certificate_key_algorithm = "RSA-2048" acm_client = mock.MagicMock acm_client.certificates = [ @@ -76,7 +117,7 @@ class Test_acm_certificates_transparency_logs_enabled: certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}" certificate_name = "test-certificate.com" certificate_type = "AMAZON_ISSUED" - certificate_key_algorithm = "RSA_2048" + certificate_key_algorithm = "RSA-2048" acm_client = mock.MagicMock acm_client.certificates = [ @@ -120,7 +161,7 @@ class Test_acm_certificates_transparency_logs_enabled: certificate_id = str(uuid.uuid4()) certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}" certificate_name = "test-certificate.com" - certificate_key_algorithm = "RSA_2048" + certificate_key_algorithm = "RSA-2048" certificate_type = "IMPORTED" acm_client = mock.MagicMock