fix(vpc): add new principal wildcard verification (#6464)

Co-authored-by: Rubén De la Torre Vico <rubendltv22@gmail.com> Co-authored-by: MrCloudSec <hello@mistercloudsec.com>
2026-07-24 21:11:53 +00:00 · 2025-01-13 17:27:26 +01:00
parent 62bd188e30
commit 2fa1bfbee7
3 changed files with 92 additions and 35 deletions
@@ -381,3 +381,73 @@ class Test_vpc_endpoint_services_allowed_principals_trust_boundaries:
                assert result[0].resource_arn == endpoint_arn
                assert result[0].resource_tags == []
                assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_vpc_endpoint_service_with_principal_wildcard(self):
+        # Create VPC Mocked Resources
+        ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1)
+        elbv2_client = client("elbv2", region_name=AWS_REGION_US_EAST_1)
+
+        vpc = ec2_client.create_vpc(
+            CidrBlock="172.28.7.0/24", InstanceTenancy="default"
+        )
+        subnet = ec2_client.create_subnet(
+            VpcId=vpc["Vpc"]["VpcId"],
+            CidrBlock="172.28.7.192/26",
+            AvailabilityZone=f"{AWS_REGION_US_EAST_1}a",
+        )
+        lb_name = "lb_vpce-test"
+        lb_arn = elbv2_client.create_load_balancer(
+            Name=lb_name,
+            Subnets=[subnet["Subnet"]["SubnetId"]],
+            Scheme="internal",
+            Type="network",
+        )["LoadBalancers"][0]["LoadBalancerArn"]
+
+        endpoint_id = ec2_client.create_vpc_endpoint_service_configuration(
+            NetworkLoadBalancerArns=[lb_arn]
+        )["ServiceConfiguration"]["ServiceId"]
+
+        # Add allowed principals
+        ec2_client.modify_vpc_endpoint_service_permissions(
+            ServiceId=endpoint_id, AddAllowedPrincipals=["*"]
+        )
+
+        endpoint_arn = f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:vpc-endpoint-service/{endpoint_id}"
+
+        from prowler.providers.aws.services.vpc.vpc_service import VPC
+
+        current_audit_info = set_mocked_aws_audit_info(
+            audited_regions=[AWS_REGION_US_EAST_1]
+        )
+        # Set config variable
+        current_audit_info.audit_config = {
+            "trusted_account_ids": [AWS_ACCOUNT_NUMBER_2]
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
+            new=current_audit_info,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.vpc.vpc_endpoint_services_allowed_principals_trust_boundaries.vpc_endpoint_services_allowed_principals_trust_boundaries.vpc_client",
+                new=VPC(current_audit_info),
+            ):
+                # Test Check
+                from prowler.providers.aws.services.vpc.vpc_endpoint_services_allowed_principals_trust_boundaries.vpc_endpoint_services_allowed_principals_trust_boundaries import (
+                    vpc_endpoint_services_allowed_principals_trust_boundaries,
+                )
+
+                check = vpc_endpoint_services_allowed_principals_trust_boundaries()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert (
+                    result[0].status_extended
+                    == f"Wildcard principal found in VPC Endpoint Service {endpoint_id}."
+                )
+                assert result[0].resource_id == endpoint_id
+                assert result[0].resource_arn == endpoint_arn
+                assert result[0].resource_tags == []
+                assert result[0].region == AWS_REGION_US_EAST_1