fix(scan): handle cloud provider errors and ignore expected sentry noise (#7582)

api/src/backend/config/settings/sentry.py

@@ -39,6 +39,9 @@ IGNORED_EXCEPTIONS = [
     "RequestExpired",
     "ConnectionClosedError",
     "MaxRetryError",
+    "AWSAccessKeyIDInvalidError",
+    "AWSSessionTokenExpiredError",
+    "EndpointConnectionError",  # AWS Service is not available in a region
     "Pool is closed",  # The following comes from urllib3: eu-west-1 -- HTTPClientError[126]: An HTTP Client raised an unhandled exception: AWSHTTPSConnectionPool(host='hostname.s3.eu-west-1.amazonaws.com', port=443): Pool is closed.
     # Authentication Errors from GCP
     "ClientAuthenticationError",
@@ -63,8 +66,6 @@ IGNORED_EXCEPTIONS = [
     "AzureClientIdAndClientSecretNotBelongingToTenantIdError",
     "AzureHTTPResponseError",
     "Error with credentials provided",
-    # AWS Service is not available in a region
-    "EndpointConnectionError",
 ]
 
 

prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.py

@@ -29,10 +29,15 @@ class cloudtrail_multi_region_enabled(Check):
                             break
                 # If there are no trails logging it is needed to store the FAIL once all the trails have been checked
                 if not trail_is_logging:
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(),
+                        resource={},
+                    )
                     report.status = "FAIL"
                     report.status_extended = (
                         "No CloudTrail trails enabled with logging were found."
                     )
+                    report.region = region
                     report.resource_arn = cloudtrail_client._get_trail_arn_template(
                         region
                     )

prowler/providers/aws/services/iam/iam_service.py

@@ -880,9 +880,14 @@ class IAM(AWSService):
                     SAMLProviderArn=resource.arn
                 ).get("Tags", [])
         except Exception as error:
-            logger.error(
-                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-            )
+            if error.response["Error"]["Code"] == "NoSuchEntityException":
+                logger.warning(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
 
     def _get_last_accessed_services(self):
         logger.info("IAM - Getting Last Accessed Services ...")

prowler/providers/azure/services/defender/defender_service.py

@@ -161,7 +161,7 @@ class Defender(AzureService):
                     {
                         security_contact_default.name: SecurityContacts(
                             resource_id=security_contact_default.id,
-                            name=security_contact_default.get("name", "default"),
+                            name=getattr(security_contact_default, "name", "default"),
                             emails=security_contact_default.emails,
                             phone=security_contact_default.phone,
                             alert_notifications_minimal_severity=security_contact_default.alert_notifications.minimal_severity,

prowler/providers/gcp/services/cloudsql/cloudsql_service.py

@@ -30,18 +30,18 @@ class CloudSQL(GCPService):
                                 region=instance["region"],
                                 ip_addresses=instance.get("ipAddresses", []),
                                 public_ip=public_ip,
-                                require_ssl=instance["settings"]["ipConfiguration"].get(
-                                    "requireSsl", False
-                                ),
-                                ssl_mode=instance["settings"]["ipConfiguration"].get(
-                                    "sslMode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"
-                                ),
+                                require_ssl=instance["settings"]
+                                .get("ipConfiguration", {})
+                                .get("requireSsl", False),
+                                ssl_mode=instance["settings"]
+                                .get("ipConfiguration", {})
+                                .get("sslMode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
                                 automated_backups=instance["settings"][
                                     "backupConfiguration"
                                 ]["enabled"],
-                                authorized_networks=instance["settings"][
-                                    "ipConfiguration"
-                                ]["authorizedNetworks"],
+                                authorized_networks=instance["settings"]
+                                .get("ipConfiguration", {})
+                                .get("authorizedNetworks", []),
                                 flags=instance["settings"].get("databaseFlags", []),
                                 project_id=project_id,
                             )