From 3f41c75a452f3290cc7bc567bc0de6215bafda4d Mon Sep 17 00:00:00 2001
From: Prowler Bot <bot@prowler.com>
Date: Wed, 19 Mar 2025 08:54:56 +0100
Subject: [PATCH] fix(route53): solve false positive in
 `route53_public_hosted_zones_cloudwatch_logging_enabled` (#7293)

Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
---
 .../aws/services/route53/route53_service.py   | 13 ++--
 ...d_zones_cloudwatch_logging_enabled_test.py | 59 +++++++++++++++++++
 2 files changed, 66 insertions(+), 6 deletions(-)

diff --git a/prowler/providers/aws/services/route53/route53_service.py b/prowler/providers/aws/services/route53/route53_service.py
index 2c6a2cd786..4cc744c985 100644
--- a/prowler/providers/aws/services/route53/route53_service.py
+++ b/prowler/providers/aws/services/route53/route53_service.py
@@ -86,13 +86,14 @@ class Route53(AWSService):
                 )
                 for page in list_query_logging_configs_paginator.paginate():
                     for logging_config in page["QueryLoggingConfigs"]:
-                        self.hosted_zones[hosted_zone.id].logging_config = (
-                            LoggingConfig(
-                                cloudwatch_log_group_arn=logging_config[
-                                    "CloudWatchLogsLogGroupArn"
-                                ]
+                        if logging_config["HostedZoneId"] == hosted_zone.id:
+                            self.hosted_zones[hosted_zone.id].logging_config = (
+                                LoggingConfig(
+                                    cloudwatch_log_group_arn=logging_config[
+                                        "CloudWatchLogsLogGroupArn"
+                                    ]
+                                )
                             )
-                        )
 
         except Exception as error:
             logger.error(
diff --git a/tests/providers/aws/services/route53/route53_public_hosted_zones_cloudwatch_logging_enabled/route53_public_hosted_zones_cloudwatch_logging_enabled_test.py b/tests/providers/aws/services/route53/route53_public_hosted_zones_cloudwatch_logging_enabled/route53_public_hosted_zones_cloudwatch_logging_enabled_test.py
index 315fa73385..610d023ffa 100644
--- a/tests/providers/aws/services/route53/route53_public_hosted_zones_cloudwatch_logging_enabled/route53_public_hosted_zones_cloudwatch_logging_enabled_test.py
+++ b/tests/providers/aws/services/route53/route53_public_hosted_zones_cloudwatch_logging_enabled/route53_public_hosted_zones_cloudwatch_logging_enabled_test.py
@@ -108,6 +108,65 @@ class Test_route53_public_hosted_zones_cloudwatch_logging_enabled:
                 == f"Route53 Public Hosted Zone {hosted_zone_id} has query logging disabled."
             )
 
+    def test_two_hosted_zone_public_one_logging_enabled_other_disabled(self):
+        route53 = mock.MagicMock
+        hosted_zone_name = "test-domain.com"
+        hosted_zone_id = "ABCDEF12345678"
+        log_group_name = "test-log-group"
+        log_group_arn = f"rn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:{log_group_name}"
+
+        hosted_zone_name_disabled = "test-domain-disabled.com"
+        hosted_zone_id_disabled = "ABCDEF123456789"
+
+        route53.hosted_zones = {
+            hosted_zone_name: HostedZone(
+                name=hosted_zone_name,
+                arn=f"arn:aws:route53:::{hosted_zone_id}",
+                id=hosted_zone_id,
+                private_zone=False,
+                region=AWS_REGION_US_EAST_1,
+                logging_config=LoggingConfig(cloudwatch_log_group_arn=log_group_arn),
+            ),
+            hosted_zone_name_disabled: HostedZone(
+                name=hosted_zone_name_disabled,
+                arn=f"arn:aws:route53:::{hosted_zone_id_disabled}",
+                id=hosted_zone_id_disabled,
+                private_zone=False,
+                region=AWS_REGION_US_EAST_1,
+            ),
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.route53.route53_service.Route53",
+            new=route53,
+        ), mock.patch(
+            "prowler.providers.aws.services.route53.route53_public_hosted_zones_cloudwatch_logging_enabled.route53_public_hosted_zones_cloudwatch_logging_enabled.route53_client",
+            new=route53,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.route53.route53_public_hosted_zones_cloudwatch_logging_enabled.route53_public_hosted_zones_cloudwatch_logging_enabled import (
+                route53_public_hosted_zones_cloudwatch_logging_enabled,
+            )
+
+            check = route53_public_hosted_zones_cloudwatch_logging_enabled()
+            result = check.execute()
+
+            assert len(result) == 2
+            assert result[0].resource_id == hosted_zone_id
+            assert result[0].region == AWS_REGION_US_EAST_1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Route53 Public Hosted Zone {hosted_zone_id} has query logging enabled in Log Group {log_group_arn}."
+            )
+            assert result[1].resource_id == hosted_zone_id_disabled
+            assert result[1].region == AWS_REGION_US_EAST_1
+            assert result[1].status == "FAIL"
+            assert (
+                result[1].status_extended
+                == f"Route53 Public Hosted Zone {hosted_zone_id_disabled} has query logging disabled."
+            )
+
     def test_hosted_zone__private(self):
         route53 = mock.MagicMock
         hosted_zone_name = "test-domain.com"