ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-09 21:14:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(aws): disallow child-accounts to overwrite policy for ai_services_opt_out (#6229)

Browse Source 
Co-authored-by: MrCloudSec <hello@mistercloudsec.com>
This commit is contained in:
Kay Agahd
2024-12-20 11:04:42 -05:00
committed by GitHub
co-authored by MrCloudSec
parent dbd2f8becb
commit 231829d8cd
3 changed files with 184 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy_test.py
+147 -11
View File
@@ -87,7 +87,7 @@ class Test_organizations_tags_policies_enabled_and_attached:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "AWS Organization o-1234567890 has not opted out of all AI services, granting consent for AWS to access its data."
== "AWS Organization o-1234567890 has no opt-out policy for AI services."
)
assert result[0].resource_id == "o-1234567890"
assert (
@@ -96,7 +96,7 @@ class Test_organizations_tags_policies_enabled_and_attached:
)
assert result[0].region == AWS_REGION_EU_WEST_1
def test_organization_with_AI_optout_policy(self):
def test_organization_with_AI_optout_policy_complete(self):
organizations_client = mock.MagicMock
organizations_client.region = AWS_REGION_EU_WEST_1
organizations_client.audited_partition = "aws"
@@ -118,7 +118,14 @@ class Test_organizations_tags_policies_enabled_and_attached:
aws_managed=False,
content={
"services": {
"default": {"opt_out_policy": {"@@assign": "optOut"}}
"default": {
"opt_out_policy": {
"@@operators_allowed_for_child_policies": [
"@@none"
],
"@@assign": "optOut",
}
}
}
},
targets=[],
@@ -134,12 +141,15 @@ class Test_organizations_tags_policies_enabled_and_attached:
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
):
with mock.patch(
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
new=organizations_client,
), mock.patch(
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client.get_unknown_arn",
return_value="arn:aws:organizations:eu-west-1:0123456789012:unknown",
with (
mock.patch(
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
new=organizations_client,
),
mock.patch(
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client.get_unknown_arn",
return_value="arn:aws:organizations:eu-west-1:0123456789012:unknown",
),
):
# Test Check
from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
@@ -153,7 +163,7 @@ class Test_organizations_tags_policies_enabled_and_attached:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "AWS Organization o-1234567890 has opted out of all AI services, not granting consent for AWS to access its data."
== "AWS Organization o-1234567890 has opted out of all AI services and also disallows child-accounts to overwrite this policy."
)
assert result[0].resource_id == "o-1234567890"
assert (
@@ -209,7 +219,133 @@ class Test_organizations_tags_policies_enabled_and_attached:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "AWS Organization o-1234567890 has not opted out of all AI services, granting consent for AWS to access its data."
== "AWS Organization o-1234567890 has not opted out of all AI services and it does not disallow child-accounts to overwrite the policy."
)
assert result[0].resource_id == "o-1234567890"
assert (
result[0].resource_arn
== "arn:aws:organizations::1234567890:organization/o-1234567890"
)
assert result[0].region == AWS_REGION_EU_WEST_1
def test_organization_with_AI_optout_policy_no_disallow(self):
organizations_client = mock.MagicMock
organizations_client.region = AWS_REGION_EU_WEST_1
organizations_client.audited_partition = "aws"
organizations_client.audited_account = "0123456789012"
organizations_client.organization = Organization(
id="o-1234567890",
arn="arn:aws:organizations::1234567890:organization/o-1234567890",
status="ACTIVE",
master_id="1234567890",
policies={
"AISERVICES_OPT_OUT_POLICY": [
Policy(
id="p-1234567890",
arn="arn:aws:organizations::1234567890:policy/o-1234567890/p-1234567890",
type="AISERVICES_OPT_OUT_POLICY",
aws_managed=False,
content={
"services": {
"default": {"opt_out_policy": {"@@assign": "optOut"}}
}
},
targets=[],
)
]
},
delegated_administrators=None,
)
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
):
with mock.patch(
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
new=organizations_client,
):
# Test Check
from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
organizations_opt_out_ai_services_policy,
)
check = organizations_opt_out_ai_services_policy()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "AWS Organization o-1234567890 has opted out of all AI services but it does not disallow child-accounts to overwrite the policy."
)
assert result[0].resource_id == "o-1234567890"
assert (
result[0].resource_arn
== "arn:aws:organizations::1234567890:organization/o-1234567890"
)
assert result[0].region == AWS_REGION_EU_WEST_1
def test_organization_with_AI_optout_policy_no_opt_out(self):
organizations_client = mock.MagicMock
organizations_client.region = AWS_REGION_EU_WEST_1
organizations_client.audited_partition = "aws"
organizations_client.audited_account = "0123456789012"
organizations_client.organization = Organization(
id="o-1234567890",
arn="arn:aws:organizations::1234567890:organization/o-1234567890",
status="ACTIVE",
master_id="1234567890",
policies={
"AISERVICES_OPT_OUT_POLICY": [
Policy(
id="p-1234567890",
arn="arn:aws:organizations::1234567890:policy/o-1234567890/p-1234567890",
type="AISERVICES_OPT_OUT_POLICY",
aws_managed=False,
content={
"services": {
"default": {
"opt_out_policy": {
"@@operators_allowed_for_child_policies": [
"@@none"
]
}
}
}
},
targets=[],
)
]
},
delegated_administrators=None,
)
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
):
with mock.patch(
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
new=organizations_client,
):
# Test Check
from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
organizations_opt_out_ai_services_policy,
)
check = organizations_opt_out_ai_services_policy()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "AWS Organization o-1234567890 has not opted out of all AI services."
)
assert result[0].resource_id == "o-1234567890"
assert (