From 2183f31ff5d0f58a3f64ae700104c781fa6ecef9 Mon Sep 17 00:00:00 2001 From: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com> Date: Tue, 17 Dec 2024 16:04:00 +0100 Subject: [PATCH] feat(ec2): add new fixers for internet exposed ports (#6223) --- ...ort_cassandra_exposed_to_internet_fixer.py | 51 +++ ...search_kibana_exposed_to_internet_fixer.py | 51 +++ ...ance_port_ftp_exposed_to_internet_fixer.py | 51 +++ ...ce_port_kafka_exposed_to_internet_fixer.py | 51 +++ ...port_kerberos_exposed_to_internet_fixer.py | 51 +++ ...nce_port_ldap_exposed_to_internet_fixer.py | 51 +++ ...ort_memcached_exposed_to_internet_fixer.py | 51 +++ ..._port_mongodb_exposed_to_internet_fixer.py | 51 +++ ...ce_port_mysql_exposed_to_internet_fixer.py | 51 +++ ...e_port_oracle_exposed_to_internet_fixer.py | 51 +++ ...rt_postgresql_exposed_to_internet_fixer.py | 51 +++ ...ance_port_rdp_exposed_to_internet_fixer.py | 51 +++ ...ce_port_redis_exposed_to_internet_fixer.py | 51 +++ ...ort_sqlserver_exposed_to_internet_fixer.py | 51 +++ ...ance_port_ssh_exposed_to_internet_fixer.py | 51 +++ ...e_port_telnet_exposed_to_internet_fixer.py | 51 +++ ...m_internet_to_high_risk_tcp_ports_fixer.py | 52 +++ ...assandra_exposed_to_internet_fixer_test.py | 336 ++++++++++++++ ...h_kibana_exposed_to_internet_fixer_test.py | 430 ++++++++++++++++++ ...port_ftp_exposed_to_internet_fixer_test.py | 348 ++++++++++++++ ...rt_kafka_exposed_to_internet_fixer_test.py | 323 +++++++++++++ ...kerberos_exposed_to_internet_fixer_test.py | 348 ++++++++++++++ ...ort_ldap_exposed_to_internet_fixer_test.py | 348 ++++++++++++++ ...emcached_exposed_to_internet_fixer_test.py | 336 ++++++++++++++ ..._mongodb_exposed_to_internet_fixer_test.py | 430 ++++++++++++++++++ ...rt_mysql_exposed_to_internet_fixer_test.py | 336 ++++++++++++++ ...t_oracle_exposed_to_internet_fixer_test.py | 348 ++++++++++++++ ...stgresql_exposed_to_internet_fixer_test.py | 336 ++++++++++++++ ...port_rdp_exposed_to_internet_fixer_test.py | 336 ++++++++++++++ ...rt_redis_exposed_to_internet_fixer_test.py | 336 ++++++++++++++ ...qlserver_exposed_to_internet_fixer_test.py | 348 ++++++++++++++ ...port_ssh_exposed_to_internet_fixer_test.py | 336 ++++++++++++++ ...t_telnet_exposed_to_internet_fixer_test.py | 336 ++++++++++++++ ...ernet_to_high_risk_tcp_ports_fixer_test.py | 307 +++++++++++++ 34 files changed, 6786 insertions(+) create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet_fixer.py create mode 100644 prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet_fixer_test.py create mode 100644 tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer_test.py diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..4dc51f17c9 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing Cassandra ports (7000, 7001, 7199, 9042, 9160) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies Cassandra ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [7000, 7001, 7199, 9042, 9160] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..14586482f9 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing Elasticsearch and Kibana ports (9200, 9300, 5601) + from any address (0.0.0.0/0) for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies those ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [9200, 9300, 5601] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..d12c1b3567 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing FTP ports (20, 21) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies FTP ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [20, 21] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..0b2f4f07c5 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing Kafka ports (9092) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies Kafka ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [9092] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..eb94835849 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing Kerberos ports (88, 464, 749, 750) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies Kerberos ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [88, 464, 749, 750] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..4e5cdda1f2 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing LDAP ports (389, 636) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies LDAP ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [389, 636] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..f32fc94a00 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing Memcached ports (11211) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies Memcached ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [11211] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..5ad16d9bcd --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing MongoDB ports (27017, 27018) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies MongoDB ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [27017, 27018] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..b459dd77b5 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing MySQL ports (3306) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies MySQL ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [3306] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..e8152007ca --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing Oracle ports (1521, 2483, 2484) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies Oracle ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [1521, 2483, 2484] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..afaa2d7dd9 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing PostgreSQL ports (5432) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies PostgreSQL ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [5432] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..99c69974c4 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing RDP ports (3389) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies RDP ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [3389] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..096e14d410 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing Redis ports (6379) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies Redis ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [6379] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..b57fe13c04 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing SQLServer ports (1433, 1434) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies SQLServer ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [1433, 1434] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..1d12ffb407 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing SSH ports (22) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies SSH ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [22] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet_fixer.py b/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet_fixer.py new file mode 100644 index 0000000000..0c8279699b --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet_fixer.py @@ -0,0 +1,51 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing Telnet ports (23) from any address (0.0.0.0/0) + for the EC2 instance's security groups. + This fixer will only be triggered if the check identifies Telnet ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The EC2 instance ID. + region (str): The AWS region where the EC2 instance exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = [23] + for instance in ec2_client.instances: + if instance.id == resource_id: + for sg in ec2_client.security_groups.values(): + if sg.id in instance.security_groups: + for ingress_rule in sg.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=sg.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.py new file mode 100644 index 0000000000..5cbf1ec2d9 --- /dev/null +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.py @@ -0,0 +1,52 @@ +from prowler.lib.logger import logger +from prowler.providers.aws.services.ec2.ec2_client import ec2_client +from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group + + +def fixer(resource_id: str, region: str) -> bool: + """ + Revokes any ingress rule allowing high risk ports (25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088) + from any address (0.0.0.0/0) for the security groups. + This fixer will only be triggered if the check identifies high risk ports open to the Internet. + Requires the ec2:RevokeSecurityGroupIngress permission. + Permissions: + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:RevokeSecurityGroupIngress", + "Resource": "*" + } + ] + } + Args: + resource_id (str): The Security Group ID. + region (str): The AWS region where the Security Group exists. + Returns: + bool: True if the operation is successful (ingress rule revoked), False otherwise. + """ + try: + regional_client = ec2_client.regional_clients[region] + check_ports = ec2_client.audit_config.get( + "ec2_high_risk_ports", + [25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088], + ) + for security_group in ec2_client.security_groups.values(): + if security_group.id == resource_id: + for ingress_rule in security_group.ingress_rules: + if check_security_group( + ingress_rule, "tcp", check_ports, any_address=True + ): + regional_client.revoke_security_group_ingress( + GroupId=security_group.id, + IpPermissions=[ingress_rule], + ) + + except Exception as error: + logger.error( + f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + else: + return True diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..2e0c54e06d --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet_fixer_test.py @@ -0,0 +1,336 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_cassandra_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 10000, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 7000, + "ToPort": 9160, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 10000, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 7000, + "ToPort": 9160, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 7000, + "ToPort": 9160, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 7000, + "ToPort": 9160, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_all_ports(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 7000, + "ToPort": 9160, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_cassandra_exposed_to_internet.ec2_instance_port_cassandra_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..044f2def25 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer_test.py @@ -0,0 +1,430 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 9500, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 5700, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 9500, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 5601, + "ToPort": 5601, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 9200, + "ToPort": 9200, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 5601, + "ToPort": 5601, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 9200, + "ToPort": 9200, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 5601, + "ToPort": 5601, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_9200_9300_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 9200, + "ToPort": 9300, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_with_public_ip_in_public_subnet_only_5601_port( + self, + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 5601, + "ToPort": 5601, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + # add default route of subnet to an internet gateway to make it public + igw_id = ec2_client.create_internet_gateway()["InternetGateway"][ + "InternetGatewayId" + ] + # attach internet gateway to subnet + ec2_client.attach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id) + # create route table + route_table_id = ec2_client.create_route_table(VpcId=vpc_id)["RouteTable"][ + "RouteTableId" + ] + # associate route table with subnet + ec2_client.associate_route_table( + RouteTableId=route_table_id, SubnetId=subnet_id + ) + # add route to route table + ec2_client.create_route( + RouteTableId=route_table_id, + DestinationCidrBlock="0.0.0.0/0", + GatewayId=igw_id, + ) + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_elasticsearch_kibana_exposed_to_internet.ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..b3bf476cc5 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet_fixer_test.py @@ -0,0 +1,348 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_ftp_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 1000, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 20, + "ToPort": 22, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 1000, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 20, + "ToPort": 20, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 20, + "ToPort": 20, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 21, + "ToPort": 21, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 20, + "ToPort": 20, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 21, + "ToPort": 21, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_both_ports(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 20, + "ToPort": 22, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ftp_exposed_to_internet.ec2_instance_port_ftp_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..dfa739ea37 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet_fixer_test.py @@ -0,0 +1,323 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_kafka_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 9100, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 9092, + "ToPort": 9092, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 9092, + "ToPort": 9092, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + }, + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 9092, + "ToPort": 9092, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 9092, + "ToPort": 9092, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_one_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 9092, + "ToPort": 9092, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kafka_exposed_to_internet.ec2_instance_port_kafka_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..4b1a14997c --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet_fixer_test.py @@ -0,0 +1,348 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_kerberos_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 1000, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 88, + "ToPort": 750, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 1000, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 88, + "ToPort": 464, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 88, + "ToPort": 88, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 464, + "ToPort": 464, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 749, + "ToPort": 749, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 750, + "ToPort": 750, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_both_ports(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 88, + "ToPort": 750, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_kerberos_exposed_to_internet.ec2_instance_port_kerberos_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..9a25c8be2b --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet_fixer_test.py @@ -0,0 +1,348 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_ldap_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 1000, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 445, + "ToPort": 445, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 1000, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 389, + "ToPort": 389, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 389, + "ToPort": 389, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 636, + "ToPort": 636, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 389, + "ToPort": 389, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 636, + "ToPort": 636, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_bot_ports(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 389, + "ToPort": 636, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ldap_exposed_to_internet.ec2_instance_port_ldap_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..f150df762f --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet_fixer_test.py @@ -0,0 +1,336 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_memcached_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 12000, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 11211, + "ToPort": 11211, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 11211, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 11211, + "ToPort": 11211, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 11211, + "ToPort": 11211, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 11211, + "ToPort": 11211, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_11211_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 11211, + "ToPort": 11211, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_memcached_exposed_to_internet.ec2_instance_port_memcached_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..8c305100c8 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet_fixer_test.py @@ -0,0 +1,430 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_mongodb_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 27100, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 27017, + "ToPort": 27018, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 27018, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 27017, + "ToPort": 27017, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 27017, + "ToPort": 27017, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 27018, + "ToPort": 27018, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 27017, + "ToPort": 27017, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 27018, + "ToPort": 27018, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_27017_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 27017, + "ToPort": 27017, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_with_public_ip_in_public_subnet_only_27018_port( + self, + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 27018, + "ToPort": 27018, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + # add default route of subnet to an internet gateway to make it public + igw_id = ec2_client.create_internet_gateway()["InternetGateway"][ + "InternetGatewayId" + ] + # attach internet gateway to subnet + ec2_client.attach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id) + # create route table + route_table_id = ec2_client.create_route_table(VpcId=vpc_id)["RouteTable"][ + "RouteTableId" + ] + # associate route table with subnet + ec2_client.associate_route_table( + RouteTableId=route_table_id, SubnetId=subnet_id + ) + # add route to route table + ec2_client.create_route( + RouteTableId=route_table_id, + DestinationCidrBlock="0.0.0.0/0", + GatewayId=igw_id, + ) + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mongodb_exposed_to_internet.ec2_instance_port_mongodb_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..195f56737f --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet_fixer_test.py @@ -0,0 +1,336 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_mysql_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 4000, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 3306, + "ToPort": 3306, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 4000, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 3306, + "ToPort": 3306, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 3306, + "ToPort": 3306, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 3306, + "ToPort": 3306, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_3306_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 3306, + "ToPort": 3306, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_mysql_exposed_to_internet.ec2_instance_port_mysql_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..98de63431e --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet_fixer_test.py @@ -0,0 +1,348 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_oracle_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 2500, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 1521, + "ToPort": 1521, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 2483, + "ToPort": 2484, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 1521, + "ToPort": 1521, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1521, + "ToPort": 1521, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 2483, + "ToPort": 2484, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1521, + "ToPort": 1521, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 2483, + "ToPort": 2484, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_bots_ports(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1521, + "ToPort": 2484, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_oracle_exposed_to_internet.ec2_instance_port_oracle_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..38b64208f7 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet_fixer_test.py @@ -0,0 +1,336 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_postgresql_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 5500, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 5432, + "ToPort": 5432, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 5500, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 5432, + "ToPort": 5432, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 5432, + "ToPort": 5432, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 5432, + "ToPort": 5432, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_5432_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 5432, + "ToPort": 5432, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_postgresql_exposed_to_internet.ec2_instance_port_postgresql_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..67581a5723 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet_fixer_test.py @@ -0,0 +1,336 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_rdp_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 3400, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 3389, + "ToPort": 3389, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 3400, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 3389, + "ToPort": 3389, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 3389, + "ToPort": 3389, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 3389, + "ToPort": 3389, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_3389_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 3389, + "ToPort": 3389, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_rdp_exposed_to_internet.ec2_instance_port_rdp_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..8affd0e7b1 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet_fixer_test.py @@ -0,0 +1,336 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_redis_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 6400, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 6379, + "ToPort": 6379, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 6400, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 6379, + "ToPort": 6379, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 6379, + "ToPort": 6379, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 6379, + "ToPort": 6379, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_6379_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 6379, + "ToPort": 6379, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_redis_exposed_to_internet.ec2_instance_port_redis_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..a24190c9b1 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet_fixer_test.py @@ -0,0 +1,348 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_sqlserver_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 1500, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 1433, + "ToPort": 1434, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 1500, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 1433, + "ToPort": 1434, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1433, + "ToPort": 1433, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 1434, + "ToPort": 1434, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1433, + "ToPort": 1433, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 1434, + "ToPort": 1434, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_both_ports(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1433, + "ToPort": 1434, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_sqlserver_exposed_to_internet.ec2_instance_port_sqlserver_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..89e3bb552c --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet_fixer_test.py @@ -0,0 +1,336 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_ssh_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 25, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 22, + "ToPort": 22, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 25, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 22, + "ToPort": 22, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 22, + "ToPort": 22, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 22, + "ToPort": 22, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_22_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 22, + "ToPort": 22, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_ssh_exposed_to_internet.ec2_instance_port_ssh_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet_fixer_test.py b/tests/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet_fixer_test.py new file mode 100644 index 0000000000..3e13565fbe --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet_fixer_test.py @@ -0,0 +1,336 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client, resource +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_instance_port_telnet_exposed_to_internet_fixer: + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 25, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + { + "IpProtocol": "tcp", + "FromPort": 23, + "ToPort": 23, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 1, + "ToPort": 25, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + { + "IpProtocol": "tcp", + "FromPort": 23, + "ToPort": 23, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + { + "ResourceType": "instance", + "Tags": [{"Key": "Name", "Value": "test"}], + } + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer import ( + fixer, + ) + + assert not fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 23, + "ToPort": 23, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 23, + "ToPort": 23, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance_id = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + SubnetId=subnet_id, + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0].id + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_instance_exposed_port_in_public_subnet_only_23_port(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 23, + "ToPort": 23, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + subnet_id = ec2_client.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/16")[ + "Subnet" + ]["SubnetId"] + instance = ec2_resource.create_instances( + ImageId="ami-12345678", + MinCount=1, + MaxCount=1, + InstanceType="t2.micro", + SecurityGroupIds=[default_sg_id], + NetworkInterfaces=[ + { + "DeviceIndex": 0, + "SubnetId": subnet_id, + "AssociatePublicIpAddress": True, + } + ], + TagSpecifications=[ + {"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "test"}]} + ], + )[0] + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_instance_port_telnet_exposed_to_internet.ec2_instance_port_telnet_exposed_to_internet_fixer import ( + fixer, + ) + + assert fixer(instance.id, AWS_REGION_EU_WEST_1) diff --git a/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer_test.py b/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer_test.py new file mode 100644 index 0000000000..f206a28940 --- /dev/null +++ b/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer_test.py @@ -0,0 +1,307 @@ +from unittest import mock + +import botocore +import botocore.client +from boto3 import client +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +mock_make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call_error(self, operation_name, kwarg): + if operation_name == "RevokeSecurityGroupIngress": + raise botocore.exceptions.ClientError( + { + "Error": { + "Code": "InvalidPermission.NotFound", + "Message": "The specified rule does not exist in this security group.", + } + }, + operation_name, + ) + return mock_make_api_call(self, operation_name, kwarg) + + +class Test_ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer: + @mock_aws + def test_ec2_sg_exposed_port_in_private_subnet_with_ip4_and_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 10, + "ToPort": 9100, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}, {"CidrIp": "10.0.0.0/24"}], + "Ipv6Ranges": [{"CidrIpv6": "::/0"}, {"CidrIpv6": "2001:db8::/32"}], + }, + ], + ) + ec2_client.audit_config = { + "ec2_high_risk_ports": [ + 25, + 110, + 135, + 143, + 445, + 3000, + 4333, + 5000, + 5500, + 8080, + 8088, + ] + } + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer import ( + fixer, + ) + + assert fixer(default_sg_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_sg_exposed_port_error(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_error + ): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 10, + "ToPort": 9100, + "IpRanges": [ + {"CidrIp": "0.0.0.0/0"}, + {"CidrIp": "10.0.0.0/24"}, + ], + "Ipv6Ranges": [ + {"CidrIpv6": "::/0"}, + {"CidrIpv6": "2001:db8::/32"}, + ], + }, + ], + ) + ec2_client.audit_config = { + "ec2_high_risk_ports": [ + 25, + 110, + 135, + 143, + 445, + 3000, + 4333, + 5000, + 5500, + 8080, + 8088, + ] + } + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer import ( + fixer, + ) + + assert not fixer(default_sg_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_sg_exposed_port_in_private_subnet_only_with_ip4(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 10, + "ToPort": 9100, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + }, + ], + ) + ec2_client.audit_config = { + "ec2_high_risk_ports": [ + 25, + 110, + 135, + 143, + 445, + 3000, + 4333, + 5000, + 5500, + 8080, + 8088, + ] + } + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer import ( + fixer, + ) + + assert fixer(default_sg_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_sg_exposed_port_in_private_subnet_only_with_ip6(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 10, + "ToPort": 9100, + "Ipv6Ranges": [{"CidrIpv6": "::/0"}], + }, + ], + ) + ec2_client.audit_config = { + "ec2_high_risk_ports": [ + 25, + 110, + 135, + 143, + 445, + 3000, + 4333, + 5000, + 5500, + 8080, + 8088, + ] + } + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer import ( + fixer, + ) + + assert fixer(default_sg_id, AWS_REGION_EU_WEST_1) + + @mock_aws + def test_ec2_sg_exposed_port_in_public_subnet_all_ports(self): + # Create EC2 Mocked Resources + ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) + ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] + default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[ + "SecurityGroups" + ][0] + default_sg_id = default_sg["GroupId"] + ec2_client.authorize_security_group_ingress( + GroupId=default_sg_id, + IpPermissions=[ + { + "IpProtocol": "tcp", + "FromPort": 10, + "ToPort": 9100, + "IpRanges": [{"CidrIp": "0.0.0.0/0"}], + } + ], + ) + ec2_client.audit_config = { + "ec2_high_risk_ports": [ + 25, + 110, + 135, + 143, + 445, + 3000, + 4333, + 5000, + 5500, + 8080, + 8088, + ] + } + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer.ec2_client", + new=EC2(aws_provider), + ): + # Test Fixer + from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer import ( + fixer, + ) + + assert fixer(default_sg_id, AWS_REGION_EU_WEST_1)