ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(route53): solve false positive in route53_public_hosted_zones_cloudwatch_logging_enabled (#7293)

Browse Source 
Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
This commit is contained in:
Prowler Bot
2025-03-19 08:54:56 +01:00
committed by GitHub
parent 04b6dbf639
commit 3f41c75a45
2 changed files with 66 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/route53/route53_service.py
+7 -6
View File
@@ -86,13 +86,14 @@ class Route53(AWSService):
)
for page in list_query_logging_configs_paginator.paginate():
for logging_config in page["QueryLoggingConfigs"]:
self.hosted_zones[hosted_zone.id].logging_config = (
LoggingConfig(
cloudwatch_log_group_arn=logging_config[
"CloudWatchLogsLogGroupArn"
]
if logging_config["HostedZoneId"] == hosted_zone.id:
self.hosted_zones[hosted_zone.id].logging_config = (
LoggingConfig(
cloudwatch_log_group_arn=logging_config[
"CloudWatchLogsLogGroupArn"
]
)
)
)
except Exception as error:
logger.error(
tests/providers/aws/services/route53/route53_public_hosted_zones_cloudwatch_logging_enabled/route53_public_hosted_zones_cloudwatch_logging_enabled_test.py
+59
View File
@@ -108,6 +108,65 @@ class Test_route53_public_hosted_zones_cloudwatch_logging_enabled:
== f"Route53 Public Hosted Zone {hosted_zone_id} has query logging disabled."
)
def test_two_hosted_zone_public_one_logging_enabled_other_disabled(self):
route53 = mock.MagicMock
hosted_zone_name = "test-domain.com"
hosted_zone_id = "ABCDEF12345678"
log_group_name = "test-log-group"
log_group_arn = f"rn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:{log_group_name}"
hosted_zone_name_disabled = "test-domain-disabled.com"
hosted_zone_id_disabled = "ABCDEF123456789"
route53.hosted_zones = {
hosted_zone_name: HostedZone(
name=hosted_zone_name,
arn=f"arn:aws:route53:::{hosted_zone_id}",
id=hosted_zone_id,
private_zone=False,
region=AWS_REGION_US_EAST_1,
logging_config=LoggingConfig(cloudwatch_log_group_arn=log_group_arn),
),
hosted_zone_name_disabled: HostedZone(
name=hosted_zone_name_disabled,
arn=f"arn:aws:route53:::{hosted_zone_id_disabled}",
id=hosted_zone_id_disabled,
private_zone=False,
region=AWS_REGION_US_EAST_1,
),
}
with mock.patch(
"prowler.providers.aws.services.route53.route53_service.Route53",
new=route53,
), mock.patch(
"prowler.providers.aws.services.route53.route53_public_hosted_zones_cloudwatch_logging_enabled.route53_public_hosted_zones_cloudwatch_logging_enabled.route53_client",
new=route53,
):
# Test Check
from prowler.providers.aws.services.route53.route53_public_hosted_zones_cloudwatch_logging_enabled.route53_public_hosted_zones_cloudwatch_logging_enabled import (
route53_public_hosted_zones_cloudwatch_logging_enabled,
)
check = route53_public_hosted_zones_cloudwatch_logging_enabled()
result = check.execute()
assert len(result) == 2
assert result[0].resource_id == hosted_zone_id
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Route53 Public Hosted Zone {hosted_zone_id} has query logging enabled in Log Group {log_group_arn}."
)
assert result[1].resource_id == hosted_zone_id_disabled
assert result[1].region == AWS_REGION_US_EAST_1
assert result[1].status == "FAIL"
assert (
result[1].status_extended
== f"Route53 Public Hosted Zone {hosted_zone_id_disabled} has query logging disabled."
)
def test_hosted_zone__private(self):
route53 = mock.MagicMock
hosted_zone_name = "test-domain.com"