ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 21:11:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): support alibabacloud provider (#9485)

Browse Source
This commit is contained in:
Pedro Martín
2025-12-22 12:46:50 +01:00
committed by GitHub
parent d776356d16
commit 3eb2595f6d
43 changed files with 1747 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/src/backend/api/migrations/0065_alibabacloud_provider.py
+37
View File
@@ -0,0 +1,37 @@
# Generated by Django migration for Alibaba Cloud provider support
from django.db import migrations
import api.db_utils
class Migration(migrations.Migration):
dependencies = [
("api", "0064_finding_categories"),
]
operations = [
migrations.AlterField(
model_name="provider",
name="provider",
field=api.db_utils.ProviderEnumField(
choices=[
("aws", "AWS"),
("azure", "Azure"),
("gcp", "GCP"),
("kubernetes", "Kubernetes"),
("m365", "M365"),
("github", "GitHub"),
("mongodbatlas", "MongoDB Atlas"),
("iac", "IaC"),
("oraclecloud", "Oracle Cloud Infrastructure"),
("alibabacloud", "Alibaba Cloud"),
],
default="aws",
),
),
migrations.RunSQL(
"ALTER TYPE provider ADD VALUE IF NOT EXISTS 'alibabacloud';",
reverse_sql=migrations.RunSQL.noop,
),
]
api/src/backend/api/models.py
+10
View File
@@ -287,6 +287,7 @@ class Provider(RowLevelSecurityProtectedModel):
MONGODBATLAS = "mongodbatlas", _("MongoDB Atlas")
IAC = "iac", _("IaC")
ORACLECLOUD = "oraclecloud", _("Oracle Cloud Infrastructure")
ALIBABACLOUD = "alibabacloud", _("Alibaba Cloud")
@staticmethod
def validate_aws_uid(value):
@@ -391,6 +392,15 @@ class Provider(RowLevelSecurityProtectedModel):
pointer="/data/attributes/uid",
)
@staticmethod
def validate_alibabacloud_uid(value):
if not re.match(r"^\d{16}$", value):
raise ModelValidationError(
detail="Alibaba Cloud account ID must be exactly 16 digits.",
code="alibabacloud-uid",
pointer="/data/attributes/uid",
)
id = models.UUIDField(primary_key=True, default=uuid4, editable=False)
inserted_at = models.DateTimeField(auto_now_add=True, editable=False)
updated_at = models.DateTimeField(auto_now=True, editable=False)
api/src/backend/api/specs/v1.yaml
+74
View File
@@ -894,6 +894,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -904,6 +905,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -921,6 +923,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -933,6 +936,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -1447,6 +1451,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -1457,6 +1462,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -1474,6 +1480,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -1486,6 +1493,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -1908,6 +1916,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -1918,6 +1927,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -1935,6 +1945,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -1947,6 +1958,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -2367,6 +2379,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -2377,6 +2390,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -2394,6 +2408,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -2406,6 +2421,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -2814,6 +2830,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -2824,6 +2841,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -2841,6 +2859,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -2853,6 +2872,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -4947,6 +4967,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -4957,6 +4978,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -4974,6 +4996,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -4986,6 +5009,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -5136,6 +5160,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -5146,6 +5171,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -5163,6 +5189,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -5175,6 +5202,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -5319,6 +5347,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -5329,6 +5358,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -5345,6 +5375,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -5357,6 +5388,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- name: filter[search]
@@ -5543,6 +5575,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -5553,6 +5586,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -5570,6 +5604,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -5582,6 +5617,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -5715,6 +5751,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -5725,6 +5762,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -5742,6 +5780,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -5754,6 +5793,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -6534,6 +6574,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -6544,6 +6585,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider__in]
schema:
@@ -6561,6 +6603,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -6573,6 +6616,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -6590,6 +6634,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -6600,6 +6645,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -6617,6 +6663,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -6629,6 +6676,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- name: filter[search]
@@ -7240,6 +7288,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -7250,6 +7299,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -7267,6 +7317,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -7279,6 +7330,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -7623,6 +7675,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -7633,6 +7686,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -7650,6 +7704,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -7662,6 +7717,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -7901,6 +7957,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -7911,6 +7968,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -7928,6 +7986,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -7940,6 +7999,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -8185,6 +8245,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -8195,6 +8256,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -8212,6 +8274,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -8224,6 +8287,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -9032,6 +9096,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -9042,6 +9107,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
- in: query
name: filter[provider_type__in]
schema:
@@ -9059,6 +9125,7 @@ paths:
- m365
- mongodbatlas
- oraclecloud
- alibabacloud
description: |-
Multiple values may be separated by commas.
@@ -9071,6 +9138,7 @@ paths:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
explode: false
style: form
- in: query
@@ -16566,6 +16634,7 @@ components:
- mongodbatlas
- iac
- oraclecloud
- alibabacloud
type: string
description: |-
* `aws` - AWS
@@ -16577,6 +16646,7 @@ components:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
x-spec-enum-id: eca8c51e6bd28935
uid:
type: string
@@ -16692,6 +16762,7 @@ components:
- mongodbatlas
- iac
- oraclecloud
- alibabacloud
type: string
x-spec-enum-id: eca8c51e6bd28935
description: |-
@@ -16706,6 +16777,7 @@ components:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
uid:
type: string
title: Unique identifier for the provider, set by the provider
@@ -16752,6 +16824,7 @@ components:
- mongodbatlas
- iac
- oraclecloud
- alibabacloud
type: string
x-spec-enum-id: eca8c51e6bd28935
description: |-
@@ -16766,6 +16839,7 @@ components:
* `mongodbatlas` - MongoDB Atlas
* `iac` - IaC
* `oraclecloud` - Oracle Cloud Infrastructure
* `alibabacloud` - Alibaba Cloud
uid:
type: string
minLength: 3
api/src/backend/api/tests/test_utils.py
+2
View File
@@ -16,6 +16,7 @@ from api.utils import (
return_prowler_provider,
validate_invitation,
)
from prowler.providers.alibabacloud.alibabacloud_provider import AlibabacloudProvider
from prowler.providers.aws.aws_provider import AwsProvider
from prowler.providers.aws.lib.security_hub.security_hub import SecurityHubConnection
from prowler.providers.azure.azure_provider import AzureProvider
@@ -116,6 +117,7 @@ class TestReturnProwlerProvider:
(Provider.ProviderChoices.MONGODBATLAS.value, MongodbatlasProvider),
(Provider.ProviderChoices.ORACLECLOUD.value, OraclecloudProvider),
(Provider.ProviderChoices.IAC.value, IacProvider),
(Provider.ProviderChoices.ALIBABACLOUD.value, AlibabacloudProvider),
],
)
def test_return_prowler_provider(self, provider_type, expected_provider):
api/src/backend/api/tests/test_views.py
+79 -4
View File
@@ -1165,6 +1165,11 @@ class TestProviderViewSet:
"uid": "64b1d3c0e4b03b1234567890",
"alias": "Atlas Organization",
},
{
"provider": "alibabacloud",
"uid": "1234567890123456",
"alias": "Alibaba Cloud Account",
},
]
),
)
@@ -1514,6 +1519,36 @@ class TestProviderViewSet:
"mongodbatlas-uid",
"uid",
),
# Alibaba Cloud UID validation - too short (not 16 digits)
(
{
"provider": "alibabacloud",
"uid": "123456789012345",
"alias": "test",
},
"alibabacloud-uid",
"uid",
),
# Alibaba Cloud UID validation - too long (not 16 digits)
(
{
"provider": "alibabacloud",
"uid": "12345678901234567",
"alias": "test",
},
"alibabacloud-uid",
"uid",
),
# Alibaba Cloud UID validation - contains non-digits
(
{
"provider": "alibabacloud",
"uid": "123456789012345a",
"alias": "test",
},
"alibabacloud-uid",
"uid",
),
]
),
)
@@ -1687,21 +1722,21 @@ class TestProviderViewSet:
(
"uid.icontains",
"1",
7,
8,
),
("alias", "aws_testing_1", 1),
("alias.icontains", "aws", 2),
("inserted_at", TODAY, 8),
("inserted_at", TODAY, 9),
(
"inserted_at.gte",
"2024-01-01",
8,
9,
),
("inserted_at.lte", "2024-01-01", 0),
(
"updated_at.gte",
"2024-01-01",
8,
9,
),
("updated_at.lte", "2024-01-01", 0),
]
@@ -2251,6 +2286,46 @@ class TestProviderSecretViewSet:
"atlas_private_key": "private-key",
},
),
# Alibaba Cloud credentials (with access key only)
(
Provider.ProviderChoices.ALIBABACLOUD.value,
ProviderSecret.TypeChoices.STATIC,
{
"access_key_id": "LTAI5t1234567890abcdef",
"access_key_secret": "my-secret-access-key",
},
),
# Alibaba Cloud credentials (with STS security token)
(
Provider.ProviderChoices.ALIBABACLOUD.value,
ProviderSecret.TypeChoices.STATIC,
{
"access_key_id": "LTAI5t1234567890abcdef",
"access_key_secret": "my-secret-access-key",
"security_token": "my-security-token-for-sts",
},
),
# Alibaba Cloud RAM Role Assumption (minimal required fields)
(
Provider.ProviderChoices.ALIBABACLOUD.value,
ProviderSecret.TypeChoices.ROLE,
{
"role_arn": "acs:ram::1234567890123456:role/ProwlerRole",
"access_key_id": "LTAI5t1234567890abcdef",
"access_key_secret": "my-secret-access-key",
},
),
# Alibaba Cloud RAM Role Assumption (with optional role_session_name)
(
Provider.ProviderChoices.ALIBABACLOUD.value,
ProviderSecret.TypeChoices.ROLE,
{
"role_arn": "acs:ram::1234567890123456:role/ProwlerRole",
"access_key_id": "LTAI5t1234567890abcdef",
"access_key_secret": "my-secret-access-key",
"role_session_name": "ProwlerAuditSession",
},
),
],
)
def test_provider_secrets_create_valid(
api/src/backend/api/utils.py
+12 -8
View File
@@ -11,6 +11,7 @@ from api.exceptions import InvitationTokenExpiredException
from api.models import Integration, Invitation, Processor, Provider, Resource
from api.v1.serializers import FindingMetadataSerializer
from prowler.lib.outputs.jira.jira import Jira, JiraBasicAuthError
from prowler.providers.alibabacloud.alibabacloud_provider import AlibabacloudProvider
from prowler.providers.aws.aws_provider import AwsProvider
from prowler.providers.aws.lib.s3.s3 import S3
from prowler.providers.aws.lib.security_hub.security_hub import SecurityHub
@@ -63,8 +64,9 @@ def merge_dicts(default_dict: dict, replacement_dict: dict) -> dict:
def return_prowler_provider(
provider: Provider,
) -> [
AwsProvider
) -> (
AlibabacloudProvider
| AwsProvider
| AzureProvider
| GcpProvider
| GithubProvider
@@ -73,14 +75,14 @@ def return_prowler_provider(
| M365Provider
| MongodbatlasProvider
| OraclecloudProvider
]:
):
"""Return the Prowler provider class based on the given provider type.
Args:
provider (Provider): The provider object containing the provider type and associated secrets.
Returns:
AwsProvider | AzureProvider | GcpProvider | GithubProvider | IacProvider | KubernetesProvider | M365Provider | OraclecloudProvider | MongodbatlasProvider: The corresponding provider class.
AlibabacloudProvider | AwsProvider | AzureProvider | GcpProvider | GithubProvider | IacProvider | KubernetesProvider | M365Provider | MongodbatlasProvider | OraclecloudProvider: The corresponding provider class.
Raises:
ValueError: If the provider type specified in `provider.provider` is not supported.
@@ -104,6 +106,8 @@ def return_prowler_provider(
prowler_provider = IacProvider
case Provider.ProviderChoices.ORACLECLOUD.value:
prowler_provider = OraclecloudProvider
case Provider.ProviderChoices.ALIBABACLOUD.value:
prowler_provider = AlibabacloudProvider
case _:
raise ValueError(f"Provider type {provider.provider} not supported")
return prowler_provider
@@ -169,7 +173,8 @@ def initialize_prowler_provider(
provider: Provider,
mutelist_processor: Processor | None = None,
) -> (
AwsProvider
AlibabacloudProvider
| AwsProvider
| AzureProvider
| GcpProvider
| GithubProvider
@@ -186,9 +191,8 @@ def initialize_prowler_provider(
mutelist_processor (Processor): The mutelist processor object containing the mutelist configuration.
Returns:
AwsProvider | AzureProvider | GcpProvider | GithubProvider | IacProvider | KubernetesProvider | M365Provider | OraclecloudProvider | MongodbatlasProvider: An instance of the corresponding provider class
(`AwsProvider`, `AzureProvider`, `GcpProvider`, `GithubProvider`, `IacProvider`, `KubernetesProvider`, `M365Provider`, `OraclecloudProvider` or `MongodbatlasProvider`) initialized with the
provider's secrets.
AlibabacloudProvider | AwsProvider | AzureProvider | GcpProvider | GithubProvider | IacProvider | KubernetesProvider | M365Provider | MongodbatlasProvider | OraclecloudProvider: An instance of the corresponding provider class
initialized with the provider's secrets.
"""
prowler_provider = return_prowler_provider(provider)
prowler_provider_kwargs = get_prowler_provider_kwargs(provider, mutelist_processor)
api/src/backend/api/v1/serializer_utils/providers.py
+42
View File
@@ -304,6 +304,48 @@ from rest_framework_json_api import serializers
},
"required": ["atlas_public_key", "atlas_private_key"],
},
{
"type": "object",
"title": "Alibaba Cloud Static Credentials",
"properties": {
"access_key_id": {
"type": "string",
"description": "The Alibaba Cloud access key ID for authentication.",
},
"access_key_secret": {
"type": "string",
"description": "The Alibaba Cloud access key secret for authentication.",
},
"security_token": {
"type": "string",
"description": "The STS security token for temporary credentials (optional).",
},
},
"required": ["access_key_id", "access_key_secret"],
},
{
"type": "object",
"title": "Alibaba Cloud RAM Role Assumption",
"properties": {
"role_arn": {
"type": "string",
"description": "The ARN of the RAM role to assume (e.g., acs:ram::1234567890123456:role/ProwlerRole).",
},
"access_key_id": {
"type": "string",
"description": "The Alibaba Cloud access key ID of the RAM user that will assume the role.",
},
"access_key_secret": {
"type": "string",
"description": "The Alibaba Cloud access key secret of the RAM user that will assume the role.",
},
"role_session_name": {
"type": "string",
"description": "An identifier for the role session (optional, defaults to 'ProwlerSession').",
},
},
"required": ["role_arn", "access_key_id", "access_key_secret"],
},
]
}
)
api/src/backend/api/v1/serializers.py
+40 -1
View File
@@ -1390,12 +1390,23 @@ class BaseWriteProviderSecretSerializer(BaseWriteSerializer):
serializer = OracleCloudProviderSecret(data=secret)
elif provider_type == Provider.ProviderChoices.MONGODBATLAS.value:
serializer = MongoDBAtlasProviderSecret(data=secret)
elif provider_type == Provider.ProviderChoices.ALIBABACLOUD.value:
serializer = AlibabaCloudProviderSecret(data=secret)
else:
raise serializers.ValidationError(
{"provider": f"Provider type not supported {provider_type}"}
)
elif secret_type == ProviderSecret.TypeChoices.ROLE:
serializer = AWSRoleAssumptionProviderSecret(data=secret)
if provider_type == Provider.ProviderChoices.AWS.value:
serializer = AWSRoleAssumptionProviderSecret(data=secret)
elif provider_type == Provider.ProviderChoices.ALIBABACLOUD.value:
serializer = AlibabaCloudRoleAssumptionProviderSecret(data=secret)
else:
raise serializers.ValidationError(
{
"secret_type": f"Role assumption not supported for provider type: {provider_type}"
}
)
elif secret_type == ProviderSecret.TypeChoices.SERVICE_ACCOUNT:
serializer = GCPServiceAccountProviderSecret(data=secret)
else:
@@ -1532,6 +1543,34 @@ class OracleCloudProviderSecret(serializers.Serializer):
resource_name = "provider-secrets"
class AlibabaCloudProviderSecret(serializers.Serializer):
access_key_id = serializers.CharField()
access_key_secret = serializers.CharField()
security_token = serializers.CharField(required=False)
class Meta:
resource_name = "provider-secrets"
class AlibabaCloudRoleAssumptionProviderSecret(serializers.Serializer):
role_arn = serializers.CharField(
help_text="Access Key ID of the RAM user that will assume the role"
)
access_key_id = serializers.CharField(
help_text="Access Key ID of the RAM user that will assume the role"
)
access_key_secret = serializers.CharField(
help_text="Access Key Secret of the RAM user that will assume the role"
)
role_session_name = serializers.CharField(
required=False,
help_text="Session name for the assumed role session (optional, defaults to 'ProwlerSession')",
)
class Meta:
resource_name = "provider-secrets"
class AWSRoleAssumptionProviderSecret(serializers.Serializer):
role_arn = serializers.CharField()
external_id = serializers.CharField()
api/src/backend/conftest.py
+7
View File
@@ -517,6 +517,12 @@ def providers_fixture(tenants_fixture):
alias="mongodbatlas_testing",
tenant_id=tenant.id,
)
provider9 = Provider.objects.create(
provider="alibabacloud",
uid="1234567890123456",
alias="alibabacloud_testing",
tenant_id=tenant.id,
)
return (
provider1,
@@ -527,6 +533,7 @@ def providers_fixture(tenants_fixture):
provider6,
provider7,
provider8,
provider9,
)
api/src/backend/tasks/jobs/export.py
+11
View File
@@ -27,6 +27,7 @@ from prowler.lib.outputs.compliance.c5.c5_gcp import GCPC5
from prowler.lib.outputs.compliance.ccc.ccc_aws import CCC_AWS
from prowler.lib.outputs.compliance.ccc.ccc_azure import CCC_Azure
from prowler.lib.outputs.compliance.ccc.ccc_gcp import CCC_GCP
from prowler.lib.outputs.compliance.cis.cis_alibabacloud import AlibabaCloudCIS
from prowler.lib.outputs.compliance.cis.cis_aws import AWSCIS
from prowler.lib.outputs.compliance.cis.cis_azure import AzureCIS
from prowler.lib.outputs.compliance.cis.cis_gcp import GCPCIS
@@ -50,6 +51,9 @@ from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import (
AzureMitreAttack,
)
from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_gcp import GCPMitreAttack
from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_alibaba import (
ProwlerThreatScoreAlibaba,
)
from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_aws import (
ProwlerThreatScoreAWS,
)
@@ -128,6 +132,13 @@ COMPLIANCE_CLASS_MAP = {
"oraclecloud": [
(lambda name: name.startswith("cis_"), OracleCloudCIS),
],
"alibabacloud": [
(lambda name: name.startswith("cis_"), AlibabaCloudCIS),
(
lambda name: name == "prowler_threatscore_alibabacloud",
ProwlerThreatScoreAlibaba,
),
],
}
api/src/backend/tasks/jobs/report.py
+1
View File
@@ -3531,6 +3531,7 @@ def generate_compliance_reports(
"gcp",
"m365",
"kubernetes",
"alibabacloud",
]:
logger.info(
f"Provider {provider_id} ({provider_type}) is not supported for ThreatScore report"