From 13e40eb03e2cfb9ad2197a73fecf69db33dbd9b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Fri, 27 Sep 2024 18:37:19 +0200 Subject: [PATCH] feat(aws): add tags to Global Accelerator (#5233) --- .../globalaccelerator_service.py | 18 +++++++++++++++++- ...vanced_protection_in_global_accelerators.py | 1 + .../globalaccelerator_service_test.py | 17 +++++++++++++++++ ...d_protection_in_global_accelerators_test.py | 8 ++++++++ 4 files changed, 43 insertions(+), 1 deletion(-) diff --git a/prowler/providers/aws/services/globalaccelerator/globalaccelerator_service.py b/prowler/providers/aws/services/globalaccelerator/globalaccelerator_service.py index 3695561782..706056c5b3 100644 --- a/prowler/providers/aws/services/globalaccelerator/globalaccelerator_service.py +++ b/prowler/providers/aws/services/globalaccelerator/globalaccelerator_service.py @@ -1,3 +1,5 @@ +from typing import Optional + from pydantic import BaseModel from prowler.lib.logger import logger @@ -5,7 +7,6 @@ from prowler.lib.scan_filters.scan_filters import is_resource_filtered from prowler.providers.aws.lib.service.service import AWSService -################### GlobalAccelerator class GlobalAccelerator(AWSService): def __init__(self, provider): # Call AWSService's __init__ @@ -18,6 +19,7 @@ class GlobalAccelerator(AWSService): self.region = "us-west-2" self.client = self.session.client(self.service, self.region) self._list_accelerators() + self.__threading_call__(self._list_tags, self.accelerators.values()) def _list_accelerators(self): logger.info("GlobalAccelerator - Listing Accelerators...") @@ -46,9 +48,23 @@ class GlobalAccelerator(AWSService): f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + def _list_tags(self, resource: any): + try: + resource.tags = ( + self.regional_clients[resource.region] + .list_tags_for_resource(ResourceArn=resource.arn) + .get("Tags", []) + ) + + except Exception as error: + logger.error( + f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + class Accelerator(BaseModel): arn: str name: str region: str enabled: bool + tags: Optional[list] diff --git a/prowler/providers/aws/services/shield/shield_advanced_protection_in_global_accelerators/shield_advanced_protection_in_global_accelerators.py b/prowler/providers/aws/services/shield/shield_advanced_protection_in_global_accelerators/shield_advanced_protection_in_global_accelerators.py index 2c1b8869ed..9fdadc561d 100644 --- a/prowler/providers/aws/services/shield/shield_advanced_protection_in_global_accelerators/shield_advanced_protection_in_global_accelerators.py +++ b/prowler/providers/aws/services/shield/shield_advanced_protection_in_global_accelerators/shield_advanced_protection_in_global_accelerators.py @@ -14,6 +14,7 @@ class shield_advanced_protection_in_global_accelerators(Check): report.region = shield_client.region report.resource_id = accelerator.name report.resource_arn = accelerator.arn + report.resource_tags = accelerator.tags report.status = "FAIL" report.status_extended = f"Global Accelerator {accelerator.name} is not protected by AWS Shield Advanced." diff --git a/tests/providers/aws/services/globalaccelerator/globalaccelerator_service_test.py b/tests/providers/aws/services/globalaccelerator/globalaccelerator_service_test.py index c73c5d85fe..19c35763fa 100644 --- a/tests/providers/aws/services/globalaccelerator/globalaccelerator_service_test.py +++ b/tests/providers/aws/services/globalaccelerator/globalaccelerator_service_test.py @@ -42,6 +42,8 @@ def mock_make_api_call(self, operation_name, kwarg): } if operation_name == "GetSubscriptionState": return {"SubscriptionState": "ACTIVE"} + if operation_name == "ListTagsForResource": + return {"Tags": [{"Key": "Name", "Value": "TestAccelerator"}]} return make_api_call(self, operation_name, kwarg) @@ -94,3 +96,18 @@ class Test_GlobalAccelerator_Service: == AWS_REGION_US_WEST_2 ) assert globalaccelerator.accelerators[TEST_ACCELERATOR_ARN].enabled + + def test_list_tags(self): + # GlobalAccelerator client for this test class + aws_provider = set_mocked_aws_provider() + globalaccelerator = GlobalAccelerator(aws_provider) + + assert len(globalaccelerator.accelerators) == 1 + assert ( + globalaccelerator.accelerators[TEST_ACCELERATOR_ARN].tags[0]["Key"] + == "Name" + ) + assert ( + globalaccelerator.accelerators[TEST_ACCELERATOR_ARN].tags[0]["Value"] + == "TestAccelerator" + ) diff --git a/tests/providers/aws/services/shield/shield_advanced_protection_in_global_accelerators/shield_advanced_protection_in_global_accelerators_test.py b/tests/providers/aws/services/shield/shield_advanced_protection_in_global_accelerators/shield_advanced_protection_in_global_accelerators_test.py index 7b435287c8..eb1a04bbf1 100644 --- a/tests/providers/aws/services/shield/shield_advanced_protection_in_global_accelerators/shield_advanced_protection_in_global_accelerators_test.py +++ b/tests/providers/aws/services/shield/shield_advanced_protection_in_global_accelerators/shield_advanced_protection_in_global_accelerators_test.py @@ -43,6 +43,7 @@ class Test_shield_advanced_protection_in_global_accelerators: name=accelerator_name, region=AWS_REGION_EU_WEST_1, enabled=True, + tags=[{"Key": "Name", "Value": "TestAccelerator"}], ) } @@ -85,6 +86,9 @@ class Test_shield_advanced_protection_in_global_accelerators: result[0].status_extended == f"Global Accelerator {accelerator_id} is protected by AWS Shield Advanced." ) + assert result[0].resource_tags == [ + {"Key": "Name", "Value": "TestAccelerator"} + ] def test_shield_enabled_globalaccelerator_not_protected(self): # GlobalAccelerator Client @@ -98,6 +102,7 @@ class Test_shield_advanced_protection_in_global_accelerators: name=accelerator_name, region=AWS_REGION_EU_WEST_1, enabled=True, + tags=[{"Key": "Name", "Value": "TestAccelerator"}], ) } @@ -131,6 +136,9 @@ class Test_shield_advanced_protection_in_global_accelerators: result[0].status_extended == f"Global Accelerator {accelerator_id} is not protected by AWS Shield Advanced." ) + assert result[0].resource_tags == [ + {"Key": "Name", "Value": "TestAccelerator"} + ] def test_shield_disabled_globalaccelerator_not_protected(self): # GlobalAccelerator Client