ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 12:31:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(glue): add tags to Glue checks (#5213)

Browse Source
This commit is contained in:
Rubén De la Torre Vico
2024-09-26 19:11:44 +02:00
committed by GitHub
parent 0b566f9666
commit 19acb873af
16 changed files with 81 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled.py
+1
View File
@@ -10,6 +10,7 @@ class glue_database_connections_ssl_enabled(Check):
report.resource_id = conn.name
report.resource_arn = conn.arn
report.region = conn.region
report.resource_tags = conn.tags
report.status = "FAIL"
report.status_extended = (
f"Glue connection {conn.name} has SSL connection disabled."
prowler/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled.py
+1
View File
@@ -11,6 +11,7 @@ class glue_development_endpoints_cloudwatch_logs_encryption_enabled(Check):
report.resource_id = endpoint.name
report.resource_arn = endpoint.arn
report.region = endpoint.region
report.resource_tags = endpoint.tags
for sec_config in glue_client.security_configs:
if sec_config.name == endpoint.security:
no_sec_configs = False
prowler/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled.py
+1
View File
@@ -11,6 +11,7 @@ class glue_development_endpoints_job_bookmark_encryption_enabled(Check):
report.resource_id = endpoint.name
report.resource_arn = endpoint.arn
report.region = endpoint.region
report.resource_tags = endpoint.tags
for sec_config in glue_client.security_configs:
if sec_config.name == endpoint.security:
no_sec_configs = False
prowler/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled.py
+1
View File
@@ -11,6 +11,7 @@ class glue_development_endpoints_s3_encryption_enabled(Check):
report.resource_id = endpoint.name
report.resource_arn = endpoint.arn
report.region = endpoint.region
report.resource_tags = endpoint.tags
for sec_config in glue_client.security_configs:
if sec_config.name == endpoint.security:
no_sec_configs = False
prowler/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled.py
+1
View File
@@ -11,6 +11,7 @@ class glue_etl_jobs_amazon_s3_encryption_enabled(Check):
report.resource_id = job.name
report.resource_arn = job.arn
report.region = job.region
report.resource_tags = job.tags
for sec_config in glue_client.security_configs:
if sec_config.name == job.security:
no_sec_configs = False
prowler/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled.py
+1
View File
@@ -11,6 +11,7 @@ class glue_etl_jobs_cloudwatch_logs_encryption_enabled(Check):
report.resource_id = job.name
report.resource_arn = job.arn
report.region = job.region
report.resource_tags = job.tags
for sec_config in glue_client.security_configs:
if sec_config.name == job.security:
no_sec_configs = False
prowler/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled.py
+1
View File
@@ -11,6 +11,7 @@ class glue_etl_jobs_job_bookmark_encryption_enabled(Check):
report.resource_id = job.name
report.resource_arn = job.arn
report.region = job.region
report.resource_tags = job.tags
for sec_config in glue_client.security_configs:
if sec_config.name == job.security:
no_sec_configs = False
prowler/providers/aws/services/glue/glue_service.py
+18 -1
View File
@@ -8,23 +8,25 @@ from prowler.lib.scan_filters.scan_filters import is_resource_filtered
from prowler.providers.aws.lib.service.service import AWSService
################## Glue
class Glue(AWSService):
def __init__(self, provider):
# Call AWSService's __init__
super().__init__(__class__.__name__, provider)
self.connections = []
self.__threading_call__(self._get_connections)
self.__threading_call__(self._list_tags, self.connections)
self.tables = []
self.__threading_call__(self._search_tables)
self.catalog_encryption_settings = []
self.__threading_call__(self._get_data_catalog_encryption_settings)
self.dev_endpoints = []
self.__threading_call__(self._get_dev_endpoints)
self.__threading_call__(self._list_tags, self.dev_endpoints)
self.security_configs = []
self.__threading_call__(self._get_security_configurations)
self.jobs = []
self.__threading_call__(self._get_jobs)
self.__threading_call__(self._list_tags, self.jobs)
def _get_data_catalog_arn_template(self, region):
return f"arn:{self.audited_partition}:glue:{region}:{self.audited_account}:data-catalog"
@@ -205,6 +207,18 @@ class Glue(AWSService):
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
def _list_tags(self, resource: any):
try:
resource.tags = [
self.regional_clients[resource.region].get_tags(
ResourceArn=resource.arn
)["Tags"]
]
except Exception as error:
logger.error(
f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
class Connection(BaseModel):
name: str
@@ -212,6 +226,7 @@ class Connection(BaseModel):
type: str
properties: dict
region: str
tags: Optional[list]
class Table(BaseModel):
@@ -236,6 +251,7 @@ class DevEndpoint(BaseModel):
arn: str
security: Optional[str]
region: str
tags: Optional[list]
class Job(BaseModel):
@@ -244,6 +260,7 @@ class Job(BaseModel):
security: Optional[str]
arguments: Optional[dict]
region: str
tags: Optional[list]
class SecurityConfig(BaseModel):
tests/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled_test.py
+4
View File
@@ -38,6 +38,7 @@ class Test_glue_database_connections_ssl_enabled:
},
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"test": "test"}],
)
]
@@ -61,6 +62,7 @@ class Test_glue_database_connections_ssl_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"test": "test"}]
def test_glue_table_with_SSL(self):
glue_client = mock.MagicMock
@@ -77,6 +79,7 @@ class Test_glue_database_connections_ssl_enabled:
},
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"test": "test"}],
)
]
@@ -100,3 +103,4 @@ class Test_glue_database_connections_ssl_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"test": "test"}]
tests/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled_test.py
+6
View File
@@ -32,6 +32,7 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -65,6 +66,7 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_unencrypted_endpoint(self):
glue_client = mock.MagicMock
@@ -74,6 +76,7 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -106,6 +109,7 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_no_sec_configs(self):
glue_client = mock.MagicMock
@@ -115,6 +119,7 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = []
@@ -139,3 +144,4 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
tests/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled_test.py
+6
View File
@@ -32,6 +32,7 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"test": "value"}],
)
]
glue_client.security_configs = [
@@ -65,6 +66,7 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"test": "value"}]
def test_glue_unencrypted_endpoint(self):
glue_client = mock.MagicMock
@@ -74,6 +76,7 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"test": "value"}],
)
]
glue_client.security_configs = [
@@ -106,6 +109,7 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"test": "value"}]
def test_glue_no_sec_configs(self):
glue_client = mock.MagicMock
@@ -115,6 +119,7 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"test": "value"}],
)
]
glue_client.security_configs = []
@@ -139,3 +144,4 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"test": "value"}]
tests/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled_test.py
+6
View File
@@ -32,6 +32,7 @@ class Test_glue_development_endpoints_s3_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -65,6 +66,7 @@ class Test_glue_development_endpoints_s3_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_unencrypted_endpoint(self):
glue_client = mock.MagicMock
@@ -74,6 +76,7 @@ class Test_glue_development_endpoints_s3_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -106,6 +109,7 @@ class Test_glue_development_endpoints_s3_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_no_sec_configs(self):
glue_client = mock.MagicMock
@@ -115,6 +119,7 @@ class Test_glue_development_endpoints_s3_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = []
@@ -139,3 +144,4 @@ class Test_glue_development_endpoints_s3_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
tests/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled_test.py
+8
View File
@@ -33,6 +33,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled:
arguments=None,
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -66,6 +67,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_unencrypted_job(self):
glue_client = mock.MagicMock
@@ -76,6 +78,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled:
arguments=None,
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -108,6 +111,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_no_sec_configs(self):
glue_client = mock.MagicMock
@@ -117,6 +121,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = []
@@ -141,6 +146,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_encrypted_job_with_argument(self):
glue_client = mock.MagicMock
@@ -154,6 +160,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled:
},
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = []
@@ -178,3 +185,4 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
tests/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled_test.py
+6
View File
@@ -33,6 +33,7 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled:
arguments=None,
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -66,6 +67,7 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_unencrypted_job(self):
glue_client = mock.MagicMock
@@ -76,6 +78,7 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled:
arguments=None,
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -108,6 +111,7 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_no_sec_configs(self):
glue_client = mock.MagicMock
@@ -117,6 +121,7 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = []
@@ -141,3 +146,4 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
tests/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled_test.py
+6
View File
@@ -33,6 +33,7 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled:
arguments=None,
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -66,6 +67,7 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_unencrypted_job(self):
glue_client = mock.MagicMock
@@ -76,6 +78,7 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled:
arguments=None,
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = [
@@ -108,6 +111,7 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
def test_glue_no_sec_configs(self):
glue_client = mock.MagicMock
@@ -117,6 +121,7 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled:
security="sec_config",
region=AWS_REGION_US_EAST_1,
arn="arn_test",
tags=[{"key_test": "value_test"}],
)
]
glue_client.security_configs = []
@@ -141,3 +146,4 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled:
)
assert result[0].resource_id == "test"
assert result[0].resource_arn == "arn_test"
assert result[0].resource_tags == [{"key_test": "value_test"}]
tests/providers/aws/services/glue/glue_service_test.py
+14
View File
@@ -100,6 +100,12 @@ def mock_make_api_call(self, operation_name, kwarg):
},
],
}
elif operation_name == "GetTags":
return {
"Tags": {
"test_key": "test_value",
},
}
return make_api_call(self, operation_name, kwarg)
@@ -227,3 +233,11 @@ class Test_Glue_Service:
"--enable-job-insights": "false",
}
assert glue.jobs[0].region == AWS_REGION_US_EAST_1
@mock_aws
def test_get_tags(self):
aws_provider = set_mocked_aws_provider()
glue = Glue(aws_provider)
assert glue.dev_endpoints[0].tags == [{"test_key": "test_value"}]
assert glue.jobs[0].tags == [{"test_key": "test_value"}]