diff --git a/docs/tutorials/configuration_file.md b/docs/tutorials/configuration_file.md index 976e2299bd..c891d5442f 100644 --- a/docs/tutorials/configuration_file.md +++ b/docs/tutorials/configuration_file.md @@ -29,19 +29,22 @@ The following list includes all the AWS checks with configurable variables that | `organizations_delegated_administrators` | `organizations_trusted_delegated_administrators` | List of Strings | | `ecr_repositories_scan_vulnerabilities_in_latest_image` | `ecr_repository_vulnerability_minimum_severity` | String | | `trustedadvisor_premium_support_plan_subscribed` | `verify_premium_support_plans` | Boolean | -| `config_recorder_all_regions_enabled` | `mute_non_default_regions` | Boolean | -| `drs_job_exist` | `mute_non_default_regions` | Boolean | -| `guardduty_is_enabled` | `mute_non_default_regions` | Boolean | -| `securityhub_enabled` | `mute_non_default_regions` | Boolean | -| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_entropy` | Integer | -| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_minutes` | Integer | -| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_actions` | List of Strings | -| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_entropy` | Integer | -| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_minutes` | Integer | -| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_actions` | List of Strings | -| `rds_instance_backup_enabled` | `check_rds_instance_replicas` | Boolean | -| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_interface_types` | List of Strings | -| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_instance_owners` | List of Strings | +| `config_recorder_all_regions_enabled` | `mute_non_default_regions` | Boolean | +| `drs_job_exist` | `mute_non_default_regions` | Boolean | +| `guardduty_is_enabled` | `mute_non_default_regions` | Boolean | +| `securityhub_enabled` | `mute_non_default_regions` | Boolean | +| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_entropy` | Integer | +| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_minutes` | Integer | +| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_actions` | List of Strings | +| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_entropy` | Integer | +| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_minutes` | Integer | +| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_actions` | List of Strings | +| `rds_instance_backup_enabled` | `check_rds_instance_replicas` | Boolean | +| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_interface_types` | List of Strings | +| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_instance_owners` | List of Strings | +| `acm_certificates_expiration_check` | `days_to_expire_threshold` | Integer | + + ## Azure ### Configurable Checks @@ -80,10 +83,20 @@ The following list includes all the Azure checks with configurable variables tha ```yaml title="config.yaml" # AWS Configuration aws: - # AWS Global Configuration - # aws.mute_non_default_regions --> Mute Failed Findings in non-default regions for GuardDuty, SecurityHub, DRS and Config + # aws.mute_non_default_regions --> Set to True to muted failed findings in non-default regions for AccessAnalyzer, GuardDuty, SecurityHub, DRS and Config mute_non_default_regions: False + # If you want to mute failed findings only in specific regions, create a file with the following syntax and run it with `prowler aws -w mutelist.yaml`: + # Mutelist: + # Accounts: + # "*": + # Checks: + # "*": + # Regions: + # - "ap-southeast-1" + # - "ap-southeast-2" + # Resources: + # - "*" # AWS IAM Configuration # aws.iam_user_accesskey_unused --> CIS recommends 45 days @@ -93,6 +106,7 @@ aws: # AWS EC2 Configuration # aws.ec2_elastic_ip_shodan + # TODO: create common config shodan_api_key: null # aws.ec2_securitygroup_with_many_ingress_egress_rules --> by default is 50 rules max_security_group_rules: 50 @@ -102,13 +116,13 @@ aws: # allowed network interface types for security groups open to the Internet ec2_allowed_interface_types: [ - "api_gateway_managed", - "vpc_endpoint", + "api_gateway_managed", + "vpc_endpoint", ] # allowed network interface owners for security groups open to the Internet ec2_allowed_instance_owners: [ - "amazon-elb" + "amazon-elb" ] # AWS VPC Configuration (vpc_endpoint_connections_trust_boundaries, vpc_endpoint_services_allowed_principals_trust_boundaries) @@ -133,205 +147,222 @@ aws: # aws.awslambda_function_using_supported_runtimes obsolete_lambda_runtimes: [ + "java8", + "go1.x", + "provided", "python3.6", "python2.7", + "python3.7", "nodejs4.3", "nodejs4.3-edge", "nodejs6.10", "nodejs", "nodejs8.10", "nodejs10.x", + "nodejs12.x", + "nodejs14.x", + "dotnet5.0", "dotnetcore1.0", "dotnetcore2.0", "dotnetcore2.1", + "dotnetcore3.1", "ruby2.5", + "ruby2.7", ] # AWS Organizations - # organizations_scp_check_deny_regions - # organizations_enabled_regions: [ - # 'eu-central-1', - # 'eu-west-1', + # aws.organizations_scp_check_deny_regions + # aws.organizations_enabled_regions: [ + # "eu-central-1", + # "eu-west-1", # "us-east-1" # ] organizations_enabled_regions: [] organizations_trusted_delegated_administrators: [] # AWS ECR - # ecr_repositories_scan_vulnerabilities_in_latest_image + # aws.ecr_repositories_scan_vulnerabilities_in_latest_image # CRITICAL # HIGH # MEDIUM ecr_repository_vulnerability_minimum_severity: "MEDIUM" # AWS Trusted Advisor - # trustedadvisor_premium_support_plan_subscribed + # aws.trustedadvisor_premium_support_plan_subscribed verify_premium_support_plans: True # AWS CloudTrail Configuration # aws.cloudtrail_threat_detection_privilege_escalation - threat_detection_privilege_escalation_entropy: 0.7 # Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.7 (70%) + threat_detection_privilege_escalation_threshold: 0.1 # Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.1 (10%) threat_detection_privilege_escalation_minutes: 1440 # Past minutes to search from now for privilege_escalation attacks, by default is 1440 minutes (24 hours) - threat_detection_privilege_escalation_actions: [ - "AddPermission", - "AddRoleToInstanceProfile", - "AddUserToGroup", - "AssociateAccessPolicy", - "AssumeRole", - "AttachGroupPolicy", - "AttachRolePolicy", - "AttachUserPolicy", - "ChangePassword", - "CreateAccessEntry", - "CreateAccessKey", - "CreateDevEndpoint", - "CreateEventSourceMapping", - "CreateFunction", - "CreateGroup", - "CreateJob", - "CreateKeyPair", - "CreateLoginProfile", - "CreatePipeline", - "CreatePolicyVersion", - "CreateRole", - "CreateStack", - "DeleteRolePermissionsBoundary", - "DeleteRolePolicy", - "DeleteUserPermissionsBoundary", - "DeleteUserPolicy", - "DetachRolePolicy", - "DetachUserPolicy", - "GetCredentialsForIdentity", - "GetId", - "GetPolicyVersion", - "GetUserPolicy", - "Invoke", - "ModifyInstanceAttribute", - "PassRole", - "PutGroupPolicy", - "PutPipelineDefinition", - "PutRolePermissionsBoundary", - "PutRolePolicy", - "PutUserPermissionsBoundary", - "PutUserPolicy", - "ReplaceIamInstanceProfileAssociation", - "RunInstances", - "SetDefaultPolicyVersion", - "UpdateAccessKey", - "UpdateAssumeRolePolicy", - "UpdateDevEndpoint", - "UpdateEventSourceMapping", - "UpdateFunctionCode", - "UpdateJob", - "UpdateLoginProfile", - ] + threat_detection_privilege_escalation_actions: + [ + "AddPermission", + "AddRoleToInstanceProfile", + "AddUserToGroup", + "AssociateAccessPolicy", + "AssumeRole", + "AttachGroupPolicy", + "AttachRolePolicy", + "AttachUserPolicy", + "ChangePassword", + "CreateAccessEntry", + "CreateAccessKey", + "CreateDevEndpoint", + "CreateEventSourceMapping", + "CreateFunction", + "CreateGroup", + "CreateJob", + "CreateKeyPair", + "CreateLoginProfile", + "CreatePipeline", + "CreatePolicyVersion", + "CreateRole", + "CreateStack", + "DeleteRolePermissionsBoundary", + "DeleteRolePolicy", + "DeleteUserPermissionsBoundary", + "DeleteUserPolicy", + "DetachRolePolicy", + "DetachUserPolicy", + "GetCredentialsForIdentity", + "GetId", + "GetPolicyVersion", + "GetUserPolicy", + "Invoke", + "ModifyInstanceAttribute", + "PassRole", + "PutGroupPolicy", + "PutPipelineDefinition", + "PutRolePermissionsBoundary", + "PutRolePolicy", + "PutUserPermissionsBoundary", + "PutUserPolicy", + "ReplaceIamInstanceProfileAssociation", + "RunInstances", + "SetDefaultPolicyVersion", + "UpdateAccessKey", + "UpdateAssumeRolePolicy", + "UpdateDevEndpoint", + "UpdateEventSourceMapping", + "UpdateFunctionCode", + "UpdateJob", + "UpdateLoginProfile", + ] # aws.cloudtrail_threat_detection_enumeration - threat_detection_enumeration_entropy: 0.7 # Percentage of actions found to decide if it is an enumeration attack event, by default is 0.7 (70%) + threat_detection_enumeration_threshold: 0.1 # Percentage of actions found to decide if it is an enumeration attack event, by default is 0.1 (10%) threat_detection_enumeration_minutes: 1440 # Past minutes to search from now for enumeration attacks, by default is 1440 minutes (24 hours) - threat_detection_enumeration_actions: [ - "DescribeAccessEntry", - "DescribeAccountAttributes", - "DescribeAvailabilityZones", - "DescribeBundleTasks", - "DescribeCarrierGateways", - "DescribeClientVpnRoutes", - "DescribeCluster", - "DescribeDhcpOptions", - "DescribeFlowLogs", - "DescribeImages", - "DescribeInstanceAttribute", - "DescribeInstanceInformation", - "DescribeInstanceTypes", - "DescribeInstances", - "DescribeInstances", - "DescribeKeyPairs", - "DescribeLogGroups", - "DescribeLogStreams", - "DescribeOrganization", - "DescribeRegions", - "DescribeSecurityGroups", - "DescribeSnapshotAttribute", - "DescribeSnapshotTierStatus", - "DescribeSubscriptionFilters", - "DescribeTransitGatewayMulticastDomains", - "DescribeVolumes", - "DescribeVolumesModifications", - "DescribeVpcEndpointConnectionNotifications", - "DescribeVpcs", - "GetAccount", - "GetAccountAuthorizationDetails", - "GetAccountSendingEnabled", - "GetBucketAcl", - "GetBucketLogging", - "GetBucketPolicy", - "GetBucketReplication", - "GetBucketVersioning", - "GetCallerIdentity", - "GetCertificate", - "GetConsoleScreenshot", - "GetCostAndUsage", - "GetDetector", - "GetEbsDefaultKmsKeyId", - "GetEbsEncryptionByDefault", - "GetFindings", - "GetFlowLogsIntegrationTemplate", - "GetIdentityVerificationAttributes", - "GetInstances", - "GetIntrospectionSchema", - "GetLaunchTemplateData", - "GetLaunchTemplateData", - "GetLogRecord", - "GetParameters", - "GetPolicyVersion", - "GetPublicAccessBlock", - "GetQueryResults", - "GetRegions", - "GetSMSAttributes", - "GetSMSSandboxAccountStatus", - "GetSendQuota", - "GetTransitGatewayRouteTableAssociations", - "GetUserPolicy", - "HeadObject", - "ListAccessKeys", - "ListAccounts", - "ListAllMyBuckets", - "ListAssociatedAccessPolicies", - "ListAttachedUserPolicies", - "ListClusters", - "ListDetectors", - "ListDomains", - "ListFindings", - "ListHostedZones", - "ListIPSets", - "ListIdentities", - "ListInstanceProfiles", - "ListObjects", - "ListOrganizationalUnitsForParent", - "ListOriginationNumbers", - "ListPolicyVersions", - "ListRoles", - "ListRoles", - "ListRules", - "ListServiceQuotas", - "ListSubscriptions", - "ListTargetsByRule", - "ListTopics", - "ListUsers", - "LookupEvents", - "Search", - ] + threat_detection_enumeration_actions: + [ + "DescribeAccessEntry", + "DescribeAccountAttributes", + "DescribeAvailabilityZones", + "DescribeBundleTasks", + "DescribeCarrierGateways", + "DescribeClientVpnRoutes", + "DescribeCluster", + "DescribeDhcpOptions", + "DescribeFlowLogs", + "DescribeImages", + "DescribeInstanceAttribute", + "DescribeInstanceInformation", + "DescribeInstanceTypes", + "DescribeInstances", + "DescribeInstances", + "DescribeKeyPairs", + "DescribeLogGroups", + "DescribeLogStreams", + "DescribeOrganization", + "DescribeRegions", + "DescribeSecurityGroups", + "DescribeSnapshotAttribute", + "DescribeSnapshotTierStatus", + "DescribeSubscriptionFilters", + "DescribeTransitGatewayMulticastDomains", + "DescribeVolumes", + "DescribeVolumesModifications", + "DescribeVpcEndpointConnectionNotifications", + "DescribeVpcs", + "GetAccount", + "GetAccountAuthorizationDetails", + "GetAccountSendingEnabled", + "GetBucketAcl", + "GetBucketLogging", + "GetBucketPolicy", + "GetBucketReplication", + "GetBucketVersioning", + "GetCallerIdentity", + "GetCertificate", + "GetConsoleScreenshot", + "GetCostAndUsage", + "GetDetector", + "GetEbsDefaultKmsKeyId", + "GetEbsEncryptionByDefault", + "GetFindings", + "GetFlowLogsIntegrationTemplate", + "GetIdentityVerificationAttributes", + "GetInstances", + "GetIntrospectionSchema", + "GetLaunchTemplateData", + "GetLaunchTemplateData", + "GetLogRecord", + "GetParameters", + "GetPolicyVersion", + "GetPublicAccessBlock", + "GetQueryResults", + "GetRegions", + "GetSMSAttributes", + "GetSMSSandboxAccountStatus", + "GetSendQuota", + "GetTransitGatewayRouteTableAssociations", + "GetUserPolicy", + "HeadObject", + "ListAccessKeys", + "ListAccounts", + "ListAllMyBuckets", + "ListAssociatedAccessPolicies", + "ListAttachedUserPolicies", + "ListClusters", + "ListDetectors", + "ListDomains", + "ListFindings", + "ListHostedZones", + "ListIPSets", + "ListIdentities", + "ListInstanceProfiles", + "ListObjects", + "ListOrganizationalUnitsForParent", + "ListOriginationNumbers", + "ListPolicyVersions", + "ListRoles", + "ListRoles", + "ListRules", + "ListServiceQuotas", + "ListSubscriptions", + "ListTargetsByRule", + "ListTopics", + "ListUsers", + "LookupEvents", + "Search", + ] + # AWS RDS Configuration # aws.rds_instance_backup_enabled # Whether to check RDS instance replicas or not check_rds_instance_replicas: False + # AWS ACM Configuration + # aws.acm_certificates_expiration_check + days_to_expire_threshold: 7 + # Azure Configuration azure: # Azure Network Configuration # azure.network_public_ip_shodan + # TODO: create common config shodan_api_key: null - # Azure App Configuration + # Azure App Service # azure.app_ensure_php_version_is_latest php_latest_version: "8.2" # azure.app_ensure_python_version_is_latest @@ -345,4 +376,34 @@ gcp: # gcp.compute_public_address_shodan shodan_api_key: null +# Kubernetes Configuration +kubernetes: + # Kubernetes API Server + # kubernetes.apiserver_audit_log_maxbackup_set + audit_log_maxbackup: 10 + # kubernetes.apiserver_audit_log_maxsize_set + audit_log_maxsize: 100 + # kubernetes.apiserver_audit_log_maxage_set + audit_log_maxage: 30 + # kubernetes.apiserver_strong_ciphers_only + apiserver_strong_ciphers: + [ + "TLS_AES_128_GCM_SHA256", + "TLS_AES_256_GCM_SHA384", + "TLS_CHACHA20_POLY1305_SHA256", + ] + # Kubelet + # kubernetes.kubelet_strong_ciphers_only + kubelet_strong_ciphers: + [ + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_128_GCM_SHA256", + ] + ``` diff --git a/docs/tutorials/scan-unused-services.md b/docs/tutorials/scan-unused-services.md index 1870267668..a71f6bdaa4 100644 --- a/docs/tutorials/scan-unused-services.md +++ b/docs/tutorials/scan-unused-services.md @@ -11,6 +11,12 @@ prowler --scan-unused-services ## Services that are ignored ### AWS +#### ACM +You can have certificates in ACM that is not in use by any AWS resource. +Prowler will check if every certificate is going to expire soon, if this certificate is not in use by default it is not going to be check if it is expired, is going to expire soon or it is good. + +- `acm_certificates_expiration_check` + #### Athena When you create an AWS Account, Athena will create a default primary workgroup for you. Prowler will check if that workgroup is enabled and if it is being used by checking if there were queries in the last 45 days. diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml index eff9cbef76..90dd925aaa 100644 --- a/prowler/config/config.yaml +++ b/prowler/config/config.yaml @@ -262,10 +262,16 @@ aws: "LookupEvents", "Search", ] + + # AWS RDS Configuration # aws.rds_instance_backup_enabled # Whether to check RDS instance replicas or not check_rds_instance_replicas: False + # AWS ACM Configuration + # aws.acm_certificates_expiration_check + days_to_expire_threshold: 7 + # Azure Configuration azure: # Azure Network Configuration diff --git a/prowler/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check.py b/prowler/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check.py index 0557c51317..3cb5b7e398 100644 --- a/prowler/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check.py +++ b/prowler/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check.py @@ -1,33 +1,36 @@ from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.acm.acm_client import acm_client -DAYS_TO_EXPIRE_THRESHOLD = 7 - class acm_certificates_expiration_check(Check): def execute(self): findings = [] for certificate in acm_client.certificates: - report = Check_Report_AWS(self.metadata()) - report.region = certificate.region - if certificate.expiration_days > DAYS_TO_EXPIRE_THRESHOLD: - report.status = "PASS" - report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} expires in {certificate.expiration_days} days." - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags - else: - report.status = "FAIL" - if certificate.expiration_days < 0: - report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has expired ({abs(certificate.expiration_days)} days ago)." + if certificate.in_use or acm_client.provider.scan_unused_services: + report = Check_Report_AWS(self.metadata()) + report.region = certificate.region + if certificate.expiration_days > acm_client.audit_config.get( + "days_to_expire_threshold", 7 + ): + report.status = "PASS" + report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} expires in {certificate.expiration_days} days." + report.resource_id = certificate.id + report.resource_details = certificate.name + report.resource_arn = certificate.arn + report.resource_tags = certificate.tags else: - report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} is about to expire in {certificate.expiration_days} days." + report.status = "FAIL" + if certificate.expiration_days < 0: + report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has expired ({abs(certificate.expiration_days)} days ago)." + report.check_metadata.Severity = "high" + else: + report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} is about to expire in {certificate.expiration_days} days." + report.check_metadata.Severity = "medium" - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags + report.resource_id = certificate.id + report.resource_details = certificate.name + report.resource_arn = certificate.arn + report.resource_tags = certificate.tags - findings.append(report) + findings.append(report) return findings diff --git a/prowler/providers/aws/services/acm/acm_service.py b/prowler/providers/aws/services/acm/acm_service.py index 8fd3196c75..7ded45a796 100644 --- a/prowler/providers/aws/services/acm/acm_service.py +++ b/prowler/providers/aws/services/acm/acm_service.py @@ -50,6 +50,7 @@ class ACM(AWSService): id=certificate["CertificateArn"].split("/")[-1], type=certificate["Type"], expiration_days=certificate_expiration_time, + in_use=certificate.get("InUse", False), transparency_logging=False, region=regional_client.region, ) @@ -99,5 +100,6 @@ class Certificate(BaseModel): type: str tags: Optional[list] = [] expiration_days: int + in_use: bool transparency_logging: Optional[bool] region: str diff --git a/tests/config/config_test.py b/tests/config/config_test.py index ce943c1c81..7d33bcca69 100644 --- a/tests/config/config_test.py +++ b/tests/config/config_test.py @@ -24,10 +24,12 @@ def mock_prowler_get_latest_release(_, **kwargs): return response -config_aws = { +old_config_aws = { "shodan_api_key": None, "max_security_group_rules": 50, "max_ec2_instance_age_in_days": 180, + "ec2_allowed_interface_types": ["api_gateway_managed", "vpc_endpoint"], + "ec2_allowed_instance_owners": ["amazon-elb"], "trusted_account_ids": [], "log_group_retention_days": 365, "max_idle_disconnect_timeout_in_seconds": 600, @@ -59,14 +61,231 @@ config_aws = { "organizations_enabled_regions": [], "organizations_trusted_delegated_administrators": [], "check_rds_instance_replicas": False, - "ec2_allowed_interface_types": [ - "api_gateway_managed", - "vpc_endpoint", - ], + "days_to_expire_threshold": 7, +} +config_aws = { + "mute_non_default_regions": False, + "max_unused_access_keys_days": 45, + "max_console_access_days": 45, + "shodan_api_key": None, + "max_security_group_rules": 50, + "max_ec2_instance_age_in_days": 180, + "ec2_allowed_interface_types": ["api_gateway_managed", "vpc_endpoint"], "ec2_allowed_instance_owners": ["amazon-elb"], + "trusted_account_ids": [], + "log_group_retention_days": 365, + "max_idle_disconnect_timeout_in_seconds": 600, + "max_disconnect_timeout_in_seconds": 300, + "max_session_duration_seconds": 36000, + "obsolete_lambda_runtimes": [ + "java8", + "go1.x", + "provided", + "python3.6", + "python2.7", + "python3.7", + "nodejs4.3", + "nodejs4.3-edge", + "nodejs6.10", + "nodejs", + "nodejs8.10", + "nodejs10.x", + "nodejs12.x", + "nodejs14.x", + "dotnet5.0", + "dotnetcore1.0", + "dotnetcore2.0", + "dotnetcore2.1", + "dotnetcore3.1", + "ruby2.5", + "ruby2.7", + ], + "organizations_enabled_regions": [], + "organizations_trusted_delegated_administrators": [], + "ecr_repository_vulnerability_minimum_severity": "MEDIUM", + "verify_premium_support_plans": True, + "threat_detection_privilege_escalation_threshold": 0.1, + "threat_detection_privilege_escalation_minutes": 1440, + "threat_detection_privilege_escalation_actions": [ + "AddPermission", + "AddRoleToInstanceProfile", + "AddUserToGroup", + "AssociateAccessPolicy", + "AssumeRole", + "AttachGroupPolicy", + "AttachRolePolicy", + "AttachUserPolicy", + "ChangePassword", + "CreateAccessEntry", + "CreateAccessKey", + "CreateDevEndpoint", + "CreateEventSourceMapping", + "CreateFunction", + "CreateGroup", + "CreateJob", + "CreateKeyPair", + "CreateLoginProfile", + "CreatePipeline", + "CreatePolicyVersion", + "CreateRole", + "CreateStack", + "DeleteRolePermissionsBoundary", + "DeleteRolePolicy", + "DeleteUserPermissionsBoundary", + "DeleteUserPolicy", + "DetachRolePolicy", + "DetachUserPolicy", + "GetCredentialsForIdentity", + "GetId", + "GetPolicyVersion", + "GetUserPolicy", + "Invoke", + "ModifyInstanceAttribute", + "PassRole", + "PutGroupPolicy", + "PutPipelineDefinition", + "PutRolePermissionsBoundary", + "PutRolePolicy", + "PutUserPermissionsBoundary", + "PutUserPolicy", + "ReplaceIamInstanceProfileAssociation", + "RunInstances", + "SetDefaultPolicyVersion", + "UpdateAccessKey", + "UpdateAssumeRolePolicy", + "UpdateDevEndpoint", + "UpdateEventSourceMapping", + "UpdateFunctionCode", + "UpdateJob", + "UpdateLoginProfile", + ], + "threat_detection_enumeration_threshold": 0.1, + "threat_detection_enumeration_minutes": 1440, + "threat_detection_enumeration_actions": [ + "DescribeAccessEntry", + "DescribeAccountAttributes", + "DescribeAvailabilityZones", + "DescribeBundleTasks", + "DescribeCarrierGateways", + "DescribeClientVpnRoutes", + "DescribeCluster", + "DescribeDhcpOptions", + "DescribeFlowLogs", + "DescribeImages", + "DescribeInstanceAttribute", + "DescribeInstanceInformation", + "DescribeInstanceTypes", + "DescribeInstances", + "DescribeInstances", + "DescribeKeyPairs", + "DescribeLogGroups", + "DescribeLogStreams", + "DescribeOrganization", + "DescribeRegions", + "DescribeSecurityGroups", + "DescribeSnapshotAttribute", + "DescribeSnapshotTierStatus", + "DescribeSubscriptionFilters", + "DescribeTransitGatewayMulticastDomains", + "DescribeVolumes", + "DescribeVolumesModifications", + "DescribeVpcEndpointConnectionNotifications", + "DescribeVpcs", + "GetAccount", + "GetAccountAuthorizationDetails", + "GetAccountSendingEnabled", + "GetBucketAcl", + "GetBucketLogging", + "GetBucketPolicy", + "GetBucketReplication", + "GetBucketVersioning", + "GetCallerIdentity", + "GetCertificate", + "GetConsoleScreenshot", + "GetCostAndUsage", + "GetDetector", + "GetEbsDefaultKmsKeyId", + "GetEbsEncryptionByDefault", + "GetFindings", + "GetFlowLogsIntegrationTemplate", + "GetIdentityVerificationAttributes", + "GetInstances", + "GetIntrospectionSchema", + "GetLaunchTemplateData", + "GetLaunchTemplateData", + "GetLogRecord", + "GetParameters", + "GetPolicyVersion", + "GetPublicAccessBlock", + "GetQueryResults", + "GetRegions", + "GetSMSAttributes", + "GetSMSSandboxAccountStatus", + "GetSendQuota", + "GetTransitGatewayRouteTableAssociations", + "GetUserPolicy", + "HeadObject", + "ListAccessKeys", + "ListAccounts", + "ListAllMyBuckets", + "ListAssociatedAccessPolicies", + "ListAttachedUserPolicies", + "ListClusters", + "ListDetectors", + "ListDomains", + "ListFindings", + "ListHostedZones", + "ListIPSets", + "ListIdentities", + "ListInstanceProfiles", + "ListObjects", + "ListOrganizationalUnitsForParent", + "ListOriginationNumbers", + "ListPolicyVersions", + "ListRoles", + "ListRoles", + "ListRules", + "ListServiceQuotas", + "ListSubscriptions", + "ListTargetsByRule", + "ListTopics", + "ListUsers", + "LookupEvents", + "Search", + ], + "check_rds_instance_replicas": False, + "days_to_expire_threshold": 7, } -config_azure = {"shodan_api_key": None} +config_azure = { + "shodan_api_key": None, + "php_latest_version": "8.2", + "python_latest_version": "3.12", + "java_latest_version": "17", +} + +config_gcp = {"shodan_api_key": None} + +config_kubernetes = { + "audit_log_maxbackup": 10, + "audit_log_maxsize": 100, + "audit_log_maxage": 30, + "apiserver_strong_ciphers": [ + "TLS_AES_128_GCM_SHA256", + "TLS_AES_256_GCM_SHA384", + "TLS_CHACHA20_POLY1305_SHA256", + ], + "kubelet_strong_ciphers": [ + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_128_GCM_SHA256", + ], +} class Test_Config: @@ -131,7 +350,7 @@ class Test_Config: path = pathlib.Path(os.path.dirname(os.path.realpath(__file__))) config_test_file = f"{path}/fixtures/config.yaml" provider = "aws" - + print(load_and_validate_config_file(provider, config_test_file)) assert load_and_validate_config_file(provider, config_test_file) == config_aws def test_load_and_validate_config_file_gcp(self): @@ -139,14 +358,17 @@ class Test_Config: config_test_file = f"{path}/fixtures/config.yaml" provider = "gcp" - assert load_and_validate_config_file(provider, config_test_file) is None + assert load_and_validate_config_file(provider, config_test_file) == config_gcp def test_load_and_validate_config_file_kubernetes(self): path = pathlib.Path(os.path.dirname(os.path.realpath(__file__))) config_test_file = f"{path}/fixtures/config.yaml" provider = "kubernetes" - - assert load_and_validate_config_file(provider, config_test_file) is None + print(load_and_validate_config_file(provider, config_test_file)) + assert ( + load_and_validate_config_file(provider, config_test_file) + == config_kubernetes + ) def test_load_and_validate_config_file_azure(self): path = pathlib.Path(os.path.dirname(os.path.realpath(__file__))) @@ -158,8 +380,8 @@ class Test_Config: def test_load_and_validate_config_file_old_format(self): path = pathlib.Path(os.path.dirname(os.path.realpath(__file__))) config_test_file = f"{path}/fixtures/config_old.yaml" - - assert load_and_validate_config_file("aws", config_test_file) == config_aws + print(load_and_validate_config_file("aws", config_test_file)) + assert load_and_validate_config_file("aws", config_test_file) == old_config_aws assert load_and_validate_config_file("gcp", config_test_file) == {} assert load_and_validate_config_file("azure", config_test_file) == {} assert load_and_validate_config_file("kubernetes", config_test_file) == {} diff --git a/tests/config/fixtures/config.yaml b/tests/config/fixtures/config.yaml index 74af77136a..90dd925aaa 100644 --- a/tests/config/fixtures/config.yaml +++ b/tests/config/fixtures/config.yaml @@ -1,9 +1,29 @@ -# TODO: UPDATE YAML - # AWS Configuration aws: + # AWS Global Configuration + # aws.mute_non_default_regions --> Set to True to muted failed findings in non-default regions for AccessAnalyzer, GuardDuty, SecurityHub, DRS and Config + mute_non_default_regions: False + # If you want to mute failed findings only in specific regions, create a file with the following syntax and run it with `prowler aws -w mutelist.yaml`: + # Mutelist: + # Accounts: + # "*": + # Checks: + # "*": + # Regions: + # - "ap-southeast-1" + # - "ap-southeast-2" + # Resources: + # - "*" + + # AWS IAM Configuration + # aws.iam_user_accesskey_unused --> CIS recommends 45 days + max_unused_access_keys_days: 45 + # aws.iam_user_console_access_unused --> CIS recommends 45 days + max_console_access_days: 45 + # AWS EC2 Configuration # aws.ec2_elastic_ip_shodan + # TODO: create common config shodan_api_key: null # aws.ec2_securitygroup_with_many_ingress_egress_rules --> by default is 50 rules max_security_group_rules: 50 @@ -13,16 +33,15 @@ aws: # allowed network interface types for security groups open to the Internet ec2_allowed_interface_types: [ - "api_gateway_managed", - "vpc_endpoint", + "api_gateway_managed", + "vpc_endpoint", ] # allowed network interface owners for security groups open to the Internet ec2_allowed_instance_owners: [ - "amazon-elb" + "amazon-elb" ] - # AWS VPC Configuration (vpc_endpoint_connections_trust_boundaries, vpc_endpoint_services_allowed_principals_trust_boundaries) # Single account environment: No action required. The AWS account number will be automatically added by the checks. # Multi account environment: Any additional trusted account number should be added as a space separated list, e.g. @@ -69,27 +88,237 @@ aws: ] # AWS Organizations - # organizations_scp_check_deny_regions - # organizations_enabled_regions: [ - # 'eu-central-1', - # 'eu-west-1', + # aws.organizations_scp_check_deny_regions + # aws.organizations_enabled_regions: [ + # "eu-central-1", + # "eu-west-1", # "us-east-1" # ] organizations_enabled_regions: [] organizations_trusted_delegated_administrators: [] + # AWS ECR + # aws.ecr_repositories_scan_vulnerabilities_in_latest_image + # CRITICAL + # HIGH + # MEDIUM + ecr_repository_vulnerability_minimum_severity: "MEDIUM" + + # AWS Trusted Advisor + # aws.trustedadvisor_premium_support_plan_subscribed + verify_premium_support_plans: True + + # AWS CloudTrail Configuration + # aws.cloudtrail_threat_detection_privilege_escalation + threat_detection_privilege_escalation_threshold: 0.1 # Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.1 (10%) + threat_detection_privilege_escalation_minutes: 1440 # Past minutes to search from now for privilege_escalation attacks, by default is 1440 minutes (24 hours) + threat_detection_privilege_escalation_actions: + [ + "AddPermission", + "AddRoleToInstanceProfile", + "AddUserToGroup", + "AssociateAccessPolicy", + "AssumeRole", + "AttachGroupPolicy", + "AttachRolePolicy", + "AttachUserPolicy", + "ChangePassword", + "CreateAccessEntry", + "CreateAccessKey", + "CreateDevEndpoint", + "CreateEventSourceMapping", + "CreateFunction", + "CreateGroup", + "CreateJob", + "CreateKeyPair", + "CreateLoginProfile", + "CreatePipeline", + "CreatePolicyVersion", + "CreateRole", + "CreateStack", + "DeleteRolePermissionsBoundary", + "DeleteRolePolicy", + "DeleteUserPermissionsBoundary", + "DeleteUserPolicy", + "DetachRolePolicy", + "DetachUserPolicy", + "GetCredentialsForIdentity", + "GetId", + "GetPolicyVersion", + "GetUserPolicy", + "Invoke", + "ModifyInstanceAttribute", + "PassRole", + "PutGroupPolicy", + "PutPipelineDefinition", + "PutRolePermissionsBoundary", + "PutRolePolicy", + "PutUserPermissionsBoundary", + "PutUserPolicy", + "ReplaceIamInstanceProfileAssociation", + "RunInstances", + "SetDefaultPolicyVersion", + "UpdateAccessKey", + "UpdateAssumeRolePolicy", + "UpdateDevEndpoint", + "UpdateEventSourceMapping", + "UpdateFunctionCode", + "UpdateJob", + "UpdateLoginProfile", + ] + # aws.cloudtrail_threat_detection_enumeration + threat_detection_enumeration_threshold: 0.1 # Percentage of actions found to decide if it is an enumeration attack event, by default is 0.1 (10%) + threat_detection_enumeration_minutes: 1440 # Past minutes to search from now for enumeration attacks, by default is 1440 minutes (24 hours) + threat_detection_enumeration_actions: + [ + "DescribeAccessEntry", + "DescribeAccountAttributes", + "DescribeAvailabilityZones", + "DescribeBundleTasks", + "DescribeCarrierGateways", + "DescribeClientVpnRoutes", + "DescribeCluster", + "DescribeDhcpOptions", + "DescribeFlowLogs", + "DescribeImages", + "DescribeInstanceAttribute", + "DescribeInstanceInformation", + "DescribeInstanceTypes", + "DescribeInstances", + "DescribeInstances", + "DescribeKeyPairs", + "DescribeLogGroups", + "DescribeLogStreams", + "DescribeOrganization", + "DescribeRegions", + "DescribeSecurityGroups", + "DescribeSnapshotAttribute", + "DescribeSnapshotTierStatus", + "DescribeSubscriptionFilters", + "DescribeTransitGatewayMulticastDomains", + "DescribeVolumes", + "DescribeVolumesModifications", + "DescribeVpcEndpointConnectionNotifications", + "DescribeVpcs", + "GetAccount", + "GetAccountAuthorizationDetails", + "GetAccountSendingEnabled", + "GetBucketAcl", + "GetBucketLogging", + "GetBucketPolicy", + "GetBucketReplication", + "GetBucketVersioning", + "GetCallerIdentity", + "GetCertificate", + "GetConsoleScreenshot", + "GetCostAndUsage", + "GetDetector", + "GetEbsDefaultKmsKeyId", + "GetEbsEncryptionByDefault", + "GetFindings", + "GetFlowLogsIntegrationTemplate", + "GetIdentityVerificationAttributes", + "GetInstances", + "GetIntrospectionSchema", + "GetLaunchTemplateData", + "GetLaunchTemplateData", + "GetLogRecord", + "GetParameters", + "GetPolicyVersion", + "GetPublicAccessBlock", + "GetQueryResults", + "GetRegions", + "GetSMSAttributes", + "GetSMSSandboxAccountStatus", + "GetSendQuota", + "GetTransitGatewayRouteTableAssociations", + "GetUserPolicy", + "HeadObject", + "ListAccessKeys", + "ListAccounts", + "ListAllMyBuckets", + "ListAssociatedAccessPolicies", + "ListAttachedUserPolicies", + "ListClusters", + "ListDetectors", + "ListDomains", + "ListFindings", + "ListHostedZones", + "ListIPSets", + "ListIdentities", + "ListInstanceProfiles", + "ListObjects", + "ListOrganizationalUnitsForParent", + "ListOriginationNumbers", + "ListPolicyVersions", + "ListRoles", + "ListRoles", + "ListRules", + "ListServiceQuotas", + "ListSubscriptions", + "ListTargetsByRule", + "ListTopics", + "ListUsers", + "LookupEvents", + "Search", + ] + + # AWS RDS Configuration # aws.rds_instance_backup_enabled # Whether to check RDS instance replicas or not check_rds_instance_replicas: False + # AWS ACM Configuration + # aws.acm_certificates_expiration_check + days_to_expire_threshold: 7 + # Azure Configuration azure: # Azure Network Configuration # azure.network_public_ip_shodan + # TODO: create common config shodan_api_key: null + # Azure App Service + # azure.app_ensure_php_version_is_latest + php_latest_version: "8.2" + # azure.app_ensure_python_version_is_latest + python_latest_version: "3.12" + # azure.app_ensure_java_version_is_latest + java_latest_version: "17" + # GCP Configuration gcp: + # GCP Compute Configuration + # gcp.compute_public_address_shodan + shodan_api_key: null # Kubernetes Configuration kubernetes: + # Kubernetes API Server + # kubernetes.apiserver_audit_log_maxbackup_set + audit_log_maxbackup: 10 + # kubernetes.apiserver_audit_log_maxsize_set + audit_log_maxsize: 100 + # kubernetes.apiserver_audit_log_maxage_set + audit_log_maxage: 30 + # kubernetes.apiserver_strong_ciphers_only + apiserver_strong_ciphers: + [ + "TLS_AES_128_GCM_SHA256", + "TLS_AES_256_GCM_SHA384", + "TLS_CHACHA20_POLY1305_SHA256", + ] + # Kubelet + # kubernetes.kubelet_strong_ciphers_only + kubelet_strong_ciphers: + [ + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_128_GCM_SHA256", + ] diff --git a/tests/config/fixtures/config_old.yaml b/tests/config/fixtures/config_old.yaml index 997f5ee4f3..80493b637a 100644 --- a/tests/config/fixtures/config_old.yaml +++ b/tests/config/fixtures/config_old.yaml @@ -76,3 +76,7 @@ organizations_trusted_delegated_administrators: [] # aws.rds_instance_backup_enabled # Whether to check RDS instance replicas or not check_rds_instance_replicas: False + +# AWS ACM Configuration +# aws.acm_certificates_expiration_check +days_to_expire_threshold: 7 diff --git a/tests/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check_test.py b/tests/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check_test.py index 010e84f112..a0495b5564 100644 --- a/tests/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check_test.py +++ b/tests/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check_test.py @@ -33,6 +33,7 @@ class Test_acm_certificates_expiration_check: certificate_name = "test-certificate.com" certificate_type = "AMAZON_ISSUED" expiration_days = 5 + in_use = True acm_client = mock.MagicMock acm_client.certificates = [ @@ -42,11 +43,14 @@ class Test_acm_certificates_expiration_check: name=certificate_name, type=certificate_type, expiration_days=expiration_days, + in_use=in_use, transparency_logging=True, region=AWS_REGION, ) ] + acm_client.audit_config = {"days_to_expire_threshold": 7} + with mock.patch( "prowler.providers.aws.services.acm.acm_service.ACM", new=acm_client, @@ -76,6 +80,7 @@ class Test_acm_certificates_expiration_check: certificate_name = "test-certificate.com" certificate_type = "AMAZON_ISSUED" expiration_days = -400 + in_use = True acm_client = mock.MagicMock acm_client.certificates = [ @@ -85,16 +90,18 @@ class Test_acm_certificates_expiration_check: name=certificate_name, type=certificate_type, expiration_days=expiration_days, + in_use=in_use, transparency_logging=True, region=AWS_REGION, ) ] + acm_client.audit_config = {"days_to_expire_threshold": 7} + with mock.patch( "prowler.providers.aws.services.acm.acm_service.ACM", new=acm_client, ): - # Test Check from prowler.providers.aws.services.acm.acm_certificates_expiration_check.acm_certificates_expiration_check import ( acm_certificates_expiration_check, ) @@ -119,6 +126,7 @@ class Test_acm_certificates_expiration_check: certificate_name = "test-certificate.com" certificate_type = "AMAZON_ISSUED" expiration_days = 365 + in_use = True acm_client = mock.MagicMock acm_client.certificates = [ @@ -128,16 +136,18 @@ class Test_acm_certificates_expiration_check: name=certificate_name, type=certificate_type, expiration_days=expiration_days, + in_use=in_use, transparency_logging=True, region=AWS_REGION, ) ] + acm_client.audit_config = {"days_to_expire_threshold": 7} + with mock.patch( "prowler.providers.aws.services.acm.acm_service.ACM", new=acm_client, ): - # Test Check from prowler.providers.aws.services.acm.acm_certificates_expiration_check.acm_certificates_expiration_check import ( acm_certificates_expiration_check, ) @@ -155,3 +165,90 @@ class Test_acm_certificates_expiration_check: assert result[0].resource_arn == certificate_arn assert result[0].region == AWS_REGION assert result[0].resource_tags == [] + + def test_acm_certificate_not_in_use(self): + certificate_id = str(uuid.uuid4()) + certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}" + certificate_name = "test-certificate.com" + certificate_type = "AMAZON_ISSUED" + expiration_days = 365 + in_use = False + + acm_client = mock.MagicMock + acm_client.certificates = [ + Certificate( + arn=certificate_arn, + id=certificate_id, + name=certificate_name, + type=certificate_type, + expiration_days=expiration_days, + in_use=in_use, + transparency_logging=True, + region=AWS_REGION, + ) + ] + + acm_client.audit_config = {"days_to_expire_threshold": 7} + + acm_client.provider = mock.MagicMock(scan_unused_services=False) + + with mock.patch( + "prowler.providers.aws.services.acm.acm_service.ACM", + new=acm_client, + ): + from prowler.providers.aws.services.acm.acm_certificates_expiration_check.acm_certificates_expiration_check import ( + acm_certificates_expiration_check, + ) + + check = acm_certificates_expiration_check() + result = check.execute() + + assert len(result) == 0 + + def test_acm_certificate_not_in_use_expired_scan_unused_services(self): + certificate_id = str(uuid.uuid4()) + certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}" + certificate_name = "test-certificate.com" + certificate_type = "AMAZON_ISSUED" + expiration_days = -400 + in_use = False + + acm_client = mock.MagicMock + acm_client.certificates = [ + Certificate( + arn=certificate_arn, + id=certificate_id, + name=certificate_name, + type=certificate_type, + expiration_days=expiration_days, + in_use=in_use, + transparency_logging=True, + region=AWS_REGION, + ) + ] + + acm_client.audit_config = {"days_to_expire_threshold": 7} + + acm_client.provider = mock.MagicMock(scan_unused_services=True) + + with mock.patch( + "prowler.providers.aws.services.acm.acm_service.ACM", + new=acm_client, + ): + from prowler.providers.aws.services.acm.acm_certificates_expiration_check.acm_certificates_expiration_check import ( + acm_certificates_expiration_check, + ) + + check = acm_certificates_expiration_check() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"ACM Certificate {certificate_id} for {certificate_name} has expired ({abs(expiration_days)} days ago)." + ) + assert result[0].resource_id == certificate_id + assert result[0].resource_arn == certificate_arn + assert result[0].region == AWS_REGION + assert result[0].resource_tags == [] diff --git a/tests/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled_test.py b/tests/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled_test.py index 11ff3581f8..3868b0aec2 100644 --- a/tests/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled_test.py +++ b/tests/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled_test.py @@ -41,6 +41,7 @@ class Test_acm_certificates_transparency_logs_enabled: type=certificate_type, expiration_days=365, transparency_logging=True, + in_use=True, region=AWS_REGION, ) ] @@ -83,6 +84,7 @@ class Test_acm_certificates_transparency_logs_enabled: type=certificate_type, expiration_days=365, transparency_logging=False, + in_use=True, region=AWS_REGION, ) ]