From 18885d0cd7f6c3015c2de480c222202ff514c053 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Fri, 9 Aug 2024 20:40:34 +0200 Subject: [PATCH] chore(ec2): Change security groups to dict (#4700) --- docs/developer-guide/checks.md | 2 +- .../dms_instance_no_public_access.py | 2 +- ...ance_port_cassandra_exposed_to_internet.py | 2 +- ..._instance_port_cifs_exposed_to_internet.py | 2 +- ...lasticsearch_kibana_exposed_to_internet.py | 2 +- ...2_instance_port_ftp_exposed_to_internet.py | 2 +- ...instance_port_kafka_exposed_to_internet.py | 2 +- ...tance_port_kerberos_exposed_to_internet.py | 2 +- ..._instance_port_ldap_exposed_to_internet.py | 2 +- ...ance_port_memcached_exposed_to_internet.py | 2 +- ...stance_port_mongodb_exposed_to_internet.py | 2 +- ...instance_port_mysql_exposed_to_internet.py | 2 +- ...nstance_port_oracle_exposed_to_internet.py | 2 +- ...nce_port_postgresql_exposed_to_internet.py | 2 +- ...2_instance_port_rdp_exposed_to_internet.py | 2 +- ...instance_port_redis_exposed_to_internet.py | 2 +- ...ance_port_sqlserver_exposed_to_internet.py | 2 +- ...2_instance_port_ssh_exposed_to_internet.py | 2 +- ...nstance_port_telnet_exposed_to_internet.py | 2 +- ...llow_ingress_from_internet_to_all_ports.py | 8 +++--- ...allow_ingress_from_internet_to_any_port.py | 13 +++++----- ...om_internet_to_port_mongodb_27017_27018.py | 10 +++---- ...ess_from_internet_to_tcp_ftp_port_20_21.py | 10 +++---- ...ow_ingress_from_internet_to_tcp_port_22.py | 10 +++---- ..._ingress_from_internet_to_tcp_port_3389.py | 10 +++---- ...et_to_tcp_port_cassandra_7199_9160_8888.py | 10 +++---- ...ort_elasticsearch_kibana_9200_9300_5601.py | 10 +++---- ...ss_from_internet_to_tcp_port_kafka_9092.py | 10 +++---- ...om_internet_to_tcp_port_memcached_11211.py | 10 +++---- ...ss_from_internet_to_tcp_port_mysql_3306.py | 10 +++---- ...m_internet_to_tcp_port_oracle_1521_2483.py | 10 +++---- ...from_internet_to_tcp_port_postgres_5432.py | 10 +++---- ...ss_from_internet_to_tcp_port_redis_6379.py | 10 +++---- ...ternet_to_tcp_port_sql_server_1433_1434.py | 10 +++---- ...ess_from_internet_to_tcp_port_telnet_23.py | 10 +++---- ...curitygroup_allow_wide_open_public_ipv4.py | 4 +-- ..._securitygroup_default_restrict_traffic.py | 4 +-- .../ec2_securitygroup_from_launch_wizard.py | 4 +-- .../ec2_securitygroup_not_used.py | 6 ++--- ...itygroup_with_many_ingress_egress_rules.py | 4 +-- .../providers/aws/services/ec2/ec2_service.py | 26 ++++++++----------- .../emr_cluster_publicly_accesible.py | 4 +-- .../rds_instance_no_public_access.py | 2 +- .../aws/services/ec2/ec2_service_test.py | 6 ++--- 44 files changed, 127 insertions(+), 132 deletions(-) diff --git a/docs/developer-guide/checks.md b/docs/developer-guide/checks.md index f03568edfa..e85cb1694e 100644 --- a/docs/developer-guide/checks.md +++ b/docs/developer-guide/checks.md @@ -222,7 +222,7 @@ class ec2_securitygroup_with_many_ingress_egress_rules(Check): max_security_group_rules = ec2_client.audit_config.get( "max_security_group_rules", 50 ) - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): ``` ```yaml title="config.yaml" diff --git a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py index f4f4cd79df..ee7a9f22e3 100644 --- a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py +++ b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py @@ -22,7 +22,7 @@ class dms_instance_no_public_access(Check): if instance.security_groups: report.status = "PASS" report.status_extended = f"DMS Replication Instance {instance.id} is set as publicly accessible but filtered with security groups." - for security_group in ec2_client.security_groups: + for security_group in ec2_client.security_groups.values(): if security_group.id in instance.security_groups: for ingress_rule in security_group.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py index 4547d3e0ad..db1d66cf54 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_cassandra_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py index ec64a6ff49..75ecf9b2a3 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py @@ -22,7 +22,7 @@ class ec2_instance_port_cifs_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py index 740f270efb..a337f6c7b3 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_elasticsearch_kibana_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py index f64276f5c8..cb02a72676 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py @@ -22,7 +22,7 @@ class ec2_instance_port_ftp_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py index 99b0e9af95..7191cb1c33 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_kafka_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py index 8220a3977e..95aae57a92 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_kerberos_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py index ebfb0ec847..da0fddbdde 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py @@ -22,7 +22,7 @@ class ec2_instance_port_ldap_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py index cf6e9b7ea3..01847510d1 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_memcached_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py index b30b820885..cd2709db11 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_mongodb_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py index 91363fd810..fb3b67decf 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_mysql_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py index 8dc2799a93..9b29cebe6a 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_oracle_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py index d9e91ef86c..6212fe93c1 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_postgresql_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py index c24610083e..6272e04637 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_rdp_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py index 56e5324111..dfe48ed1f0 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_redis_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py index 7ad33cb791..3b7bf52b5e 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_sqlserver_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py index ccc15e2f19..2d1eba9927 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_ssh_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py index 662bab579e..2c9bad6a27 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py @@ -20,7 +20,7 @@ class ec2_instance_port_telnet_exposed_to_internet(Check): report.resource_tags = instance.tags is_open_port = False if instance.security_groups: - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id in instance.security_groups: for ingress_rule in sg.ingress_rules: if check_security_group( diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py index 266fee1ac8..ecea9f35fa 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py @@ -1,13 +1,13 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_all_ports(Check): def execute(self): findings = [] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -20,13 +20,13 @@ class ec2_securitygroup_allow_ingress_from_internet_to_all_ports(Check): report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have all ports open to the Internet." report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags for ingress_rule in security_group.ingress_rules: if check_security_group(ingress_rule, "-1", any_address=True): ec2_client.set_failed_check( self.__class__.__name__, - security_group.arn, + security_group_arn, ) report.status = "FAIL" report.status_extended = f"Security group {security_group.name} ({security_group.id}) has all ports open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py index c07decc84c..4a340eccc7 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.ec2_service import NetworkInterface -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.ec2_service import NetworkInterface +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_any_port(Check): def execute(self): findings = [] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -24,12 +24,12 @@ class ec2_securitygroup_allow_ingress_from_internet_to_any_port(Check): report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have any port open to the Internet." report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: @@ -61,7 +61,6 @@ class ec2_securitygroup_allow_ingress_from_internet_to_any_port(Check): ): report.status_extended = f"Security group {security_group_name} ({security_group_id}) has at least one port open to the Internet but is exclusively not attached to any network interface." for eni in enis: - if self.is_allowed_eni_type(eni_type=eni.type): report.status = "PASS" report.status_extended = f"Security group {security_group_name} ({security_group_id}) has at least one port open to the Internet but is exclusively attached to an allowed network interface type ({eni.type})." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py index cf6a45734a..e2395deac5 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018(Check): def execute(self): findings = [] check_ports = [27017, 27018] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -22,14 +22,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018( report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have MongoDB ports 27017 and 27018 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py index e19460c6ae..cb4ce51d12 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21(Check): def execute(self): findings = [] check_ports = [20, 21] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -24,12 +24,12 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21(Check) report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have FTP ports 20 and 21 open to the Internet." report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py index 8d3d9f6f59..878fa6da60 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22(Check): def execute(self): findings = [] check_ports = [22] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -24,12 +24,12 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22(Check): report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have SSH port 22 open to the Internet." report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.py index 97b6c0b39a..25cc144234 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389(Check): def execute(self): findings = [] check_ports = [3389] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -24,12 +24,12 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389(Check): report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Microsoft RDP port 3389 open to the Internet." report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.py index a5152b759c..3f7a55ff99 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.py @@ -1,10 +1,10 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888( @@ -13,7 +13,7 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9 def execute(self): findings = [] check_ports = [7199, 9160, 8888] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -24,14 +24,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9 report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Casandra ports 7199, 8888 and 9160 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.py index 38c094a706..d665dafafc 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.py @@ -1,10 +1,10 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601( @@ -13,7 +13,7 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_ki def execute(self): findings = [] check_ports = [9200, 9300, 5601] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -24,14 +24,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_ki report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Elasticsearch/Kibana ports 9200, 9300 and 5601 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.py index c84003608a..db0619e23a 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092(Check): def execute(self): findings = [] check_ports = [9092] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -22,14 +22,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092(Check report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Kafka port 9092 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.py index 309848123b..8ba1c53243 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211(Check): def execute(self): findings = [] check_ports = [11211] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -22,14 +22,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211( report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Memcached port 11211 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.py index 182c1eb1c2..104ea17bd7 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306(Check): def execute(self): findings = [] check_ports = [3306] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -22,14 +22,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306(Check report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have MySQL port 3306 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.py index 2808585f47..58c740814c 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483(Check): def execute(self): findings = [] check_ports = [1521, 2483] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -22,14 +22,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483 report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Oracle ports 1521 and 2483 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.py index 8e0d797db7..340469b778 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432(Check): def execute(self): findings = [] check_ports = [5432] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -22,14 +22,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432(Ch report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Postgres port 5432 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.py index 8170a85929..8b78c9a22b 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379(Check): def execute(self): findings = [] check_ports = [6379] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -22,14 +22,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379(Check report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Redis port 6379 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.py index 307d53a9a7..8ee235db95 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.py @@ -1,10 +1,10 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434( @@ -13,7 +13,7 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_ def execute(self): findings = [] check_ports = [1433, 1434] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -24,14 +24,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_ report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Microsoft SQL Server ports 1433 and 1434 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.py index 1fcbf1e8c6..34d3e480f2 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.py @@ -1,17 +1,17 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.ec2.ec2_client import ec2_client -from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group -from prowler.providers.aws.services.vpc.vpc_client import vpc_client from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import ( ec2_securitygroup_allow_ingress_from_internet_to_all_ports, ) +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group +from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23(Check): def execute(self): findings = [] check_ports = [23] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -22,14 +22,14 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23(Check) report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Telnet port 23 open to the Internet." # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice if not ec2_client.is_failed_check( ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__, - security_group.arn, + security_group_arn, ): # Loop through every security group's ingress rule and check it for ingress_rule in security_group.ingress_rules: diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py index 549c8b3064..8d5e67e82d 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py @@ -9,7 +9,7 @@ class ec2_securitygroup_allow_wide_open_public_ipv4(Check): def execute(self): findings = [] cidr_treshold = 24 - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the SG is in use if ec2_client.provider.scan_unused_services or ( security_group.vpc_id in vpc_client.vpcs @@ -20,7 +20,7 @@ class ec2_securitygroup_allow_wide_open_public_ipv4(Check): report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) has no potential wide-open non-RFC1918 address." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.py index b9a4c30085..787f8b6e09 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.py @@ -6,7 +6,7 @@ from prowler.providers.aws.services.vpc.vpc_client import vpc_client class ec2_securitygroup_default_restrict_traffic(Check): def execute(self): findings = [] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Check if ignoring flag is set and if the VPC and the default SG are in used if security_group.name == "default" and ( ec2_client.provider.scan_unused_services @@ -20,7 +20,7 @@ class ec2_securitygroup_default_restrict_traffic(Check): report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.py index f67211120c..9624e57c1e 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.py @@ -5,12 +5,12 @@ from prowler.providers.aws.services.ec2.ec2_client import ec2_client class ec2_securitygroup_from_launch_wizard(Check): def execute(self): findings = [] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): report = Check_Report_AWS(self.metadata()) report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) was not created using the EC2 Launch Wizard." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py index 8a232b33be..076ea605e9 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py @@ -6,14 +6,14 @@ from prowler.providers.aws.services.ec2.ec2_client import ec2_client class ec2_securitygroup_not_used(Check): def execute(self): findings = [] - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): # Default security groups can not be deleted, so ignore them if security_group.name != "default": report = Check_Report_AWS(self.metadata()) report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) it is being used." @@ -22,7 +22,7 @@ class ec2_securitygroup_not_used(Check): for function in awslambda_client.functions.values(): if security_group.id in function.security_groups: sg_in_lambda = True - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if security_group.id in sg.associated_sgs: sg_associated = True if ( diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.py index f2fbca7ce7..a6db96a23b 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.py @@ -10,12 +10,12 @@ class ec2_securitygroup_with_many_ingress_egress_rules(Check): max_security_group_rules = ec2_client.audit_config.get( "max_security_group_rules", 50 ) - for security_group in ec2_client.security_groups: + for security_group_arn, security_group in ec2_client.security_groups.items(): report = Check_Report_AWS(self.metadata()) report.region = security_group.region report.resource_details = security_group.name report.resource_id = security_group.id - report.resource_arn = security_group.arn + report.resource_arn = security_group_arn report.resource_tags = security_group.tags report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) has {len(security_group.ingress_rules)} inbound rules and {len(security_group.egress_rules)} outbound rules." diff --git a/prowler/providers/aws/services/ec2/ec2_service.py b/prowler/providers/aws/services/ec2/ec2_service.py index e0ab1fb8da..8876ef1dbf 100644 --- a/prowler/providers/aws/services/ec2/ec2_service.py +++ b/prowler/providers/aws/services/ec2/ec2_service.py @@ -18,7 +18,7 @@ class EC2(AWSService): self.instances = [] self.__threading_call__(self.__describe_instances__) self.__threading_call__(self.__get_instance_user_data__, self.instances) - self.security_groups = [] + self.security_groups = {} self.regions_with_sgs = [] self.__threading_call__(self.__describe_security_groups__) self.network_acls = [] @@ -120,18 +120,15 @@ class EC2(AWSService): for sg_group in ingress_rule.get("UserIdGroupPairs", []): if sg_group.get("GroupId"): associated_sgs.append(sg_group["GroupId"]) - self.security_groups.append( - SecurityGroup( - name=sg["GroupName"], - arn=arn, - region=regional_client.region, - id=sg["GroupId"], - ingress_rules=sg["IpPermissions"], - egress_rules=sg["IpPermissionsEgress"], - associated_sgs=associated_sgs, - vpc_id=sg["VpcId"], - tags=sg.get("Tags"), - ) + self.security_groups[arn] = SecurityGroup( + name=sg["GroupName"], + region=regional_client.region, + id=sg["GroupId"], + ingress_rules=sg["IpPermissions"], + egress_rules=sg["IpPermissionsEgress"], + associated_sgs=associated_sgs, + vpc_id=sg["VpcId"], + tags=sg.get("Tags"), ) if sg["GroupName"] != "default": self.regions_with_sgs.append(regional_client.region) @@ -267,7 +264,7 @@ class EC2(AWSService): ): try: for sg in interface_security_groups: - for security_group in self.security_groups: + for security_group in self.security_groups.values(): if security_group.id == sg["GroupId"]: security_group.network_interfaces.append(interface) except Exception as error: @@ -563,7 +560,6 @@ class NetworkInterface(BaseModel): class SecurityGroup(BaseModel): name: str - arn: str region: str id: str vpc_id: str diff --git a/prowler/providers/aws/services/emr/emr_cluster_publicly_accesible/emr_cluster_publicly_accesible.py b/prowler/providers/aws/services/emr/emr_cluster_publicly_accesible/emr_cluster_publicly_accesible.py index 18d6330c05..61ee169396 100644 --- a/prowler/providers/aws/services/emr/emr_cluster_publicly_accesible/emr_cluster_publicly_accesible.py +++ b/prowler/providers/aws/services/emr/emr_cluster_publicly_accesible/emr_cluster_publicly_accesible.py @@ -40,7 +40,7 @@ class emr_cluster_publicly_accesible(Check): master_public_security_groups = [] for master_sg in master_node_sg_groups: master_sg_public = False - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id == master_sg: for ingress_rule in sg.ingress_rules: if check_security_group(ingress_rule, -1): @@ -62,7 +62,7 @@ class emr_cluster_publicly_accesible(Check): slave_public_security_groups = [] for slave_sg in slave_node_sg_groups: slave_sg_public = False - for sg in ec2_client.security_groups: + for sg in ec2_client.security_groups.values(): if sg.id == slave_sg: for ingress_rule in sg.ingress_rules: if check_security_group(ingress_rule, -1): diff --git a/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.py b/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.py index 85d25cead3..b99610ac7d 100644 --- a/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.py +++ b/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.py @@ -25,7 +25,7 @@ class rds_instance_no_public_access(Check): report.status_extended = f"RDS Instance {db_instance.id} is set as publicly accessible but filtered with security groups." db_instance_port = db_instance.endpoint.get("Port") if db_instance_port: - for security_group in ec2_client.security_groups: + for security_group in ec2_client.security_groups.values(): if security_group.id in db_instance.security_groups: for ingress_rule in security_group.ingress_rules: if check_security_group( diff --git a/tests/providers/aws/services/ec2/ec2_service_test.py b/tests/providers/aws/services/ec2/ec2_service_test.py index 3824e4221a..b9fa8bcccd 100644 --- a/tests/providers/aws/services/ec2/ec2_service_test.py +++ b/tests/providers/aws/services/ec2/ec2_service_test.py @@ -150,11 +150,11 @@ class Test_EC2_Service: ec2 = EC2(aws_provider) assert sg_id in str(ec2.security_groups) - for security_group in ec2.security_groups: + for sg_arn, security_group in ec2.security_groups.items(): if security_group.id == sg_id: assert security_group.name == "test-security-group" assert ( - security_group.arn + sg_arn == f"arn:{aws_provider.identity.partition}:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:security-group/{security_group.id}" ) assert re.match(r"sg-[0-9a-z]{17}", security_group.id) @@ -524,7 +524,7 @@ class Test_EC2_Service: {"Key": "string", "Value": "string"}, ] # Check if ENI was added to security group - for sg in ec2.security_groups: + for sg in ec2.security_groups.values(): if sg.id == eni.groups[0]["GroupId"]: assert sg.network_interfaces == ec2.network_interfaces