From 332b98a1ab34f53a55c9bd13834ebf18be6af7e5 Mon Sep 17 00:00:00 2001
From: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
Date: Tue, 25 Mar 2025 09:22:35 +0100
Subject: [PATCH] fix(iam): handle `UnboundLocalError` cannot access local
 variable 'report' (#7361)

---
 ...ermissions_to_administer_resource_locks.py |  2 +-
 ...sions_to_administer_resource_locks_test.py | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/prowler/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks.py b/prowler/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks.py
index d3df749b20..2abbf40510 100644
--- a/prowler/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks.py
+++ b/prowler/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks.py
@@ -29,5 +29,5 @@ class iam_custom_role_has_permissions_to_administer_resource_locks(Check):
                             report.status_extended = f"Role {custom_role.name} from subscription {subscription} has permission to administer resource locks."
                             exits_role_with_permission_over_locks = True
                             break
-            findings.append(report)
+                findings.append(report)
         return findings
diff --git a/tests/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks_test.py b/tests/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks_test.py
index 90c838317d..760015e6a1 100644
--- a/tests/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks_test.py
+++ b/tests/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks_test.py
@@ -198,3 +198,25 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
                 result[0].resource_id
                 == defender_client.custom_roles[AZURE_SUBSCRIPTION_ID][0].id
             )
+
+    def test_iam_custom_roles_empty_list_but_with_key(self):
+        defender_client = mock.MagicMock
+        defender_client.custom_roles = {AZURE_SUBSCRIPTION_ID: []}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.iam.iam_custom_role_has_permissions_to_administer_resource_locks.iam_custom_role_has_permissions_to_administer_resource_locks.iam_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.azure.services.iam.iam_custom_role_has_permissions_to_administer_resource_locks.iam_custom_role_has_permissions_to_administer_resource_locks import (
+                iam_custom_role_has_permissions_to_administer_resource_locks,
+            )
+
+            check = iam_custom_role_has_permissions_to_administer_resource_locks()
+            result = check.execute()
+            assert len(result) == 0