From 190fd0b93c2d4a8210b088cb8b855bd4f2cd5236 Mon Sep 17 00:00:00 2001 From: Sergio Garcia Date: Wed, 23 Apr 2025 08:58:04 -0500 Subject: [PATCH] fix(scan): handle cloud provider errors and ignore expected sentry noise (#7582) --- api/src/backend/config/settings/sentry.py | 5 +++-- .../cloudtrail_multi_region_enabled.py | 5 +++++ .../providers/aws/services/iam/iam_service.py | 11 ++++++++--- .../services/defender/defender_service.py | 2 +- .../gcp/services/cloudsql/cloudsql_service.py | 18 +++++++++--------- 5 files changed, 26 insertions(+), 15 deletions(-) diff --git a/api/src/backend/config/settings/sentry.py b/api/src/backend/config/settings/sentry.py index 5aeda7a88a..bf354b90e5 100644 --- a/api/src/backend/config/settings/sentry.py +++ b/api/src/backend/config/settings/sentry.py @@ -39,6 +39,9 @@ IGNORED_EXCEPTIONS = [ "RequestExpired", "ConnectionClosedError", "MaxRetryError", + "AWSAccessKeyIDInvalidError", + "AWSSessionTokenExpiredError", + "EndpointConnectionError", # AWS Service is not available in a region "Pool is closed", # The following comes from urllib3: eu-west-1 -- HTTPClientError[126]: An HTTP Client raised an unhandled exception: AWSHTTPSConnectionPool(host='hostname.s3.eu-west-1.amazonaws.com', port=443): Pool is closed. # Authentication Errors from GCP "ClientAuthenticationError", @@ -63,8 +66,6 @@ IGNORED_EXCEPTIONS = [ "AzureClientIdAndClientSecretNotBelongingToTenantIdError", "AzureHTTPResponseError", "Error with credentials provided", - # AWS Service is not available in a region - "EndpointConnectionError", ] diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.py b/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.py index b4b7349fc4..16bb264e28 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.py +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.py @@ -29,10 +29,15 @@ class cloudtrail_multi_region_enabled(Check): break # If there are no trails logging it is needed to store the FAIL once all the trails have been checked if not trail_is_logging: + report = Check_Report_AWS( + metadata=self.metadata(), + resource={}, + ) report.status = "FAIL" report.status_extended = ( "No CloudTrail trails enabled with logging were found." ) + report.region = region report.resource_arn = cloudtrail_client._get_trail_arn_template( region ) diff --git a/prowler/providers/aws/services/iam/iam_service.py b/prowler/providers/aws/services/iam/iam_service.py index 2601377cfe..dafd86017c 100644 --- a/prowler/providers/aws/services/iam/iam_service.py +++ b/prowler/providers/aws/services/iam/iam_service.py @@ -880,9 +880,14 @@ class IAM(AWSService): SAMLProviderArn=resource.arn ).get("Tags", []) except Exception as error: - logger.error( - f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" - ) + if error.response["Error"]["Code"] == "NoSuchEntityException": + logger.warning( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + else: + logger.error( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) def _get_last_accessed_services(self): logger.info("IAM - Getting Last Accessed Services ...") diff --git a/prowler/providers/azure/services/defender/defender_service.py b/prowler/providers/azure/services/defender/defender_service.py index f308a838bd..6b66eaa1c8 100644 --- a/prowler/providers/azure/services/defender/defender_service.py +++ b/prowler/providers/azure/services/defender/defender_service.py @@ -161,7 +161,7 @@ class Defender(AzureService): { security_contact_default.name: SecurityContacts( resource_id=security_contact_default.id, - name=security_contact_default.get("name", "default"), + name=getattr(security_contact_default, "name", "default"), emails=security_contact_default.emails, phone=security_contact_default.phone, alert_notifications_minimal_severity=security_contact_default.alert_notifications.minimal_severity, diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_service.py b/prowler/providers/gcp/services/cloudsql/cloudsql_service.py index 539671173b..d0dbe5137d 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_service.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_service.py @@ -30,18 +30,18 @@ class CloudSQL(GCPService): region=instance["region"], ip_addresses=instance.get("ipAddresses", []), public_ip=public_ip, - require_ssl=instance["settings"]["ipConfiguration"].get( - "requireSsl", False - ), - ssl_mode=instance["settings"]["ipConfiguration"].get( - "sslMode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED" - ), + require_ssl=instance["settings"] + .get("ipConfiguration", {}) + .get("requireSsl", False), + ssl_mode=instance["settings"] + .get("ipConfiguration", {}) + .get("sslMode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"), automated_backups=instance["settings"][ "backupConfiguration" ]["enabled"], - authorized_networks=instance["settings"][ - "ipConfiguration" - ]["authorizedNetworks"], + authorized_networks=instance["settings"] + .get("ipConfiguration", {}) + .get("authorizedNetworks", []), flags=instance["settings"].get("databaseFlags", []), project_id=project_id, )