ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-09 21:14:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(aws): lead the partition bootstrap regions with the configured region (#12764)

Browse Source 
Co-authored-by: pedrooot <pedromarting3@gmail.com>
This commit is contained in:
César Arroba
2026-09-09 18:07:22 +02:00
committed by GitHub
co-authored by pedrooot
parent 1e8454a3cb
commit 369f852837
5 changed files with 303 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/providers/aws/aws_provider_test.py
+246 -1
View File
@@ -16,7 +16,12 @@ from moto import mock_aws
from pytest import raises
from tzlocal import get_localzone
from prowler.providers.aws.aws_provider import AwsProvider, get_aws_region_for_sts
from prowler.providers.aws.aws_provider import (
AwsProvider,
get_aws_region_for_sts,
get_env_partition_bootstrap_region,
get_env_partition_regions,
)
from prowler.providers.aws.config import (
AWS_STS_GLOBAL_ENDPOINT_REGION,
BOTO3_USER_AGENT_EXTRA,
@@ -56,6 +61,7 @@ from tests.providers.aws.utils import (
AWS_REGION_EU_WEST_1,
AWS_REGION_EUSC_DE_EAST_1,
AWS_REGION_GOV_CLOUD_US_EAST_1,
AWS_REGION_GOV_CLOUD_US_WEST_1,
AWS_REGION_ISO_GLOBAL,
AWS_REGION_US_EAST_1,
AWS_REGION_US_EAST_2,
@@ -2447,6 +2453,245 @@ aws:
== AWS_REGION_GOV_CLOUD_US_EAST_1
)
def test_get_env_partition_regions_leads_with_session_region(self):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
regions = get_env_partition_regions(AWS_REGION_GOV_CLOUD_US_WEST_1)
assert regions[0] == AWS_REGION_GOV_CLOUD_US_WEST_1
assert set(regions) == set(get_env_partition_regions())
def test_get_env_partition_regions_ignores_session_region_outside_partition(
self,
):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
regions = get_env_partition_regions(AWS_REGION_EU_WEST_1)
assert regions[0] == AWS_REGION_GOV_CLOUD_US_EAST_1
assert AWS_REGION_EU_WEST_1 not in regions
def test_get_env_partition_bootstrap_region_prefers_session_region(self):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
assert (
get_env_partition_bootstrap_region(AWS_REGION_GOV_CLOUD_US_WEST_1)
== AWS_REGION_GOV_CLOUD_US_WEST_1
)
def test_get_env_partition_bootstrap_region_without_session_region(self):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
assert (
get_env_partition_bootstrap_region() == AWS_REGION_GOV_CLOUD_US_EAST_1
)
def test_get_env_partition_bootstrap_region_without_partition(self):
with mock.patch.dict(os.environ, {"PROWLER_AWS_PARTITION": ""}, clear=False):
assert (
get_env_partition_bootstrap_region(AWS_REGION_GOV_CLOUD_US_WEST_1)
is None
)
def test_get_aws_region_for_sts_env_partition_prefers_session_region(self):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
assert (
get_aws_region_for_sts(AWS_REGION_GOV_CLOUD_US_WEST_1, None)
== AWS_REGION_GOV_CLOUD_US_WEST_1
)
def test_get_profile_region_env_partition_keeps_session_region_inside_partition(
self,
):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
aws_session = session.Session(region_name=AWS_REGION_GOV_CLOUD_US_WEST_1)
assert (
AwsProvider.get_profile_region(aws_session)
== AWS_REGION_GOV_CLOUD_US_WEST_1
)
def test_get_profile_region_env_partition_ignores_session_region_outside_partition(
self,
):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
aws_session = session.Session(region_name=AWS_REGION_US_EAST_1)
assert (
AwsProvider.get_profile_region(aws_session)
== AWS_REGION_GOV_CLOUD_US_EAST_1
)
def test_get_profile_region_env_partition_excluded_session_region_stays_in_partition(
self,
):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
aws_session = session.Session(region_name=AWS_REGION_GOV_CLOUD_US_WEST_1)
assert (
AwsProvider.get_profile_region(
aws_session, {AWS_REGION_GOV_CLOUD_US_WEST_1}
)
== AWS_REGION_GOV_CLOUD_US_EAST_1
)
def test_get_profile_region_env_partition_all_regions_excluded_stays_in_partition(
self,
):
with mock.patch.dict(
os.environ,
{"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION},
clear=False,
):
aws_session = session.Session(region_name=AWS_REGION_GOV_CLOUD_US_WEST_1)
gov_cloud_regions = set(get_env_partition_regions())
assert (
AwsProvider.get_profile_region(aws_session, gov_cloud_regions)
== AWS_REGION_GOV_CLOUD_US_WEST_1
)
@mock_aws
def test_test_connection_env_partition_prefers_session_region(self):
with (
mock.patch.dict(
os.environ,
{
"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION,
"AWS_DEFAULT_REGION": AWS_REGION_GOV_CLOUD_US_WEST_1,
},
clear=False,
),
mock.patch.object(
AwsProvider,
"validate_credentials",
return_value=AWSCallerIdentity(
user_id="test-user-id",
account=AWS_ACCOUNT_NUMBER,
arn=ARN(AWS_GOV_CLOUD_ACCOUNT_ARN),
region=AWS_REGION_GOV_CLOUD_US_WEST_1,
),
) as mock_validate_credentials,
):
connection = AwsProvider.test_connection(
aws_access_key_id="test-access-key",
aws_secret_access_key="test-secret-key",
raise_on_exception=False,
)
assert connection.is_connected
assert (
mock_validate_credentials.call_args.args[1]
== AWS_REGION_GOV_CLOUD_US_WEST_1
)
@mock_aws
def test_test_connection_role_env_partition_prefers_session_region(self):
with (
mock.patch.dict(
os.environ,
{
"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION,
"AWS_DEFAULT_REGION": AWS_REGION_GOV_CLOUD_US_WEST_1,
},
clear=False,
),
mock.patch.object(
AwsProvider,
"assume_role",
return_value=AWSCredentials(
aws_access_key_id="assumed-access-key",
aws_secret_access_key="assumed-secret-key",
aws_session_token="assumed-session-token",
expiration=datetime.now(),
),
) as mock_assume_role,
mock.patch.object(
AwsProvider,
"validate_credentials",
return_value=AWSCallerIdentity(
user_id="test-user-id",
account=AWS_ACCOUNT_NUMBER,
arn=ARN(AWS_GOV_CLOUD_ACCOUNT_ARN),
region=AWS_REGION_GOV_CLOUD_US_WEST_1,
),
),
):
connection = AwsProvider.test_connection(
role_arn=f"arn:{AWS_GOV_CLOUD_PARTITION}:iam::{AWS_ACCOUNT_NUMBER}:role/test-role",
aws_access_key_id="test-access-key",
aws_secret_access_key="test-secret-key",
raise_on_exception=False,
)
assert connection.is_connected
assumed_role_info = mock_assume_role.call_args.args[1]
assert assumed_role_info.sts_region == AWS_REGION_GOV_CLOUD_US_WEST_1
@mock_aws
def test_setup_session_mfa_env_partition_prefers_session_region(self):
with (
mock.patch.dict(
os.environ,
{
"PROWLER_AWS_PARTITION": AWS_GOV_CLOUD_PARTITION,
"AWS_DEFAULT_REGION": AWS_REGION_GOV_CLOUD_US_WEST_1,
},
clear=False,
),
mock.patch.object(
AwsProvider,
"input_role_mfa_token_and_code",
return_value=AWSMFAInfo(
arn=f"arn:{AWS_GOV_CLOUD_PARTITION}:iam::{AWS_ACCOUNT_NUMBER}:mfa/test",
totp="123456",
),
),
mock.patch.object(
AwsProvider,
"create_sts_session",
side_effect=AwsProvider.create_sts_session,
) as mock_create_sts_session,
):
AwsProvider.setup_session(
mfa=True,
aws_access_key_id="test-access-key",
aws_secret_access_key="test-secret-key",
)
assert (
mock_create_sts_session.call_args.args[1]
== AWS_REGION_GOV_CLOUD_US_WEST_1
)
@mock_aws
def test_test_connection_env_partition_mismatch(self):
with (
tests/providers/aws/utils.py
+1
View File
@@ -51,6 +51,7 @@ AWS_REGION_CN_NORTH_1 = "cn-north-1"
# Gov Cloud Regions
AWS_REGION_GOV_CLOUD_US_EAST_1 = "us-gov-east-1"
AWS_REGION_GOV_CLOUD_US_WEST_1 = "us-gov-west-1"
# Iso Regions
AWS_REGION_ISO_GLOBAL = "aws-iso-global"