ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 21:11:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(wafv2): migrated testing from magicmock to moto (#5464)

Browse Source
This commit is contained in:
Hugo Pereira Brito
2024-10-18 20:55:49 +02:00
committed by GitHub
parent 23a20a582e
commit 413b86e7cf
2 changed files with 564 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/providers/aws/services/wafv2/wafv2_webacl_logging_enabled/wafv2_webacl_logging_enabled_test.py
+429 -65
View File
@@ -1,108 +1,472 @@
from unittest import mock from unittest import mock
from uuid import uuid4
from prowler.providers.aws.services.wafv2.wafv2_service import WebAclv2 from boto3 import client
from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1 from moto import mock_aws
waf_id = str(uuid4()) from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider
waf_name = "waf-example"
waf_arn = f"arn:aws:wafv2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:regional/webacl/{waf_name}/{waf_id}"
class Test_wafv2_webacl_logging_enabled: class Test_wafv2_webacl_rule_logging_enabled:
@mock_aws
def test_no_web_acls(self): def test_no_web_acls(self):
wafv2_client = mock.MagicMock from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
wafv2_client.web_acls = {}
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch( with mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_service.WAFv2", "prowler.providers.common.provider.Provider.get_global_provider",
new=wafv2_client, return_value=aws_provider,
), mock.patch( ), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_client.wafv2_client", "prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled.wafv2_client",
new=wafv2_client, new=WAFv2(aws_provider),
): ):
from prowler.providers.aws.services.wafv2.wafv2_webacl_logging_enabled.wafv2_webacl_logging_enabled import ( from prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled import (
wafv2_webacl_logging_enabled, wafv2_webacl_rule_logging_enabled,
) )
check = wafv2_webacl_logging_enabled() check = wafv2_webacl_rule_logging_enabled()
result = check.execute() result = check.execute()
assert len(result) == 0 assert len(result) == 0
def test_wafv2_wb_acl_with_logging(self): @mock_aws
wafv2_client = mock.MagicMock def test_wafv2_web_acl_with_logging_in_rules(self):
wafv2_client.enabled = True wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
wafv2_client.web_acls = { waf = wafv2_client.create_web_acl(
waf_arn: WebAclv2( Name="test-rules",
arn=waf_arn, Scope="REGIONAL",
name=waf_name, DefaultAction={"Allow": {}},
id=waf_id, Rules=[
albs=[], {
user_pools=[], "Name": "rule-on",
region=AWS_REGION_EU_WEST_1, "Priority": 1,
logging_enabled=True, "Statement": {
tags=[{"Key": "Name", "Value": waf_name}], "ByteMatchStatement": {
) "SearchString": "test",
} "FieldToMatch": {"UriPath": {}},
"TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
}
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": True,
"MetricName": "web-acl-test-metric",
},
}
],
VisibilityConfig={
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
Tags=[{"Key": "Name", "Value": "test-rules"}],
)["Summary"]
waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch( with mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_service.WAFv2", "prowler.providers.common.provider.Provider.get_global_provider",
new=wafv2_client, return_value=aws_provider,
), mock.patch( ), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_client.wafv2_client", "prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled.wafv2_client",
new=wafv2_client, new=WAFv2(aws_provider),
): ):
from prowler.providers.aws.services.wafv2.wafv2_webacl_logging_enabled.wafv2_webacl_logging_enabled import ( from prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled import (
wafv2_webacl_logging_enabled, wafv2_webacl_rule_logging_enabled,
) )
check = wafv2_webacl_logging_enabled() check = wafv2_webacl_rule_logging_enabled()
result = check.execute() result = check.execute()
assert len(result) == 1 assert len(result) == 1
assert result[0].status == "PASS" assert result[0].status == "PASS"
assert ( assert (
result[0].status_extended result[0].status_extended
== f"AWS WAFv2 Web ACL {waf_name} has logging enabled." == f"AWS WAFv2 Web ACL {waf_name} does have CloudWatch Metrics enabled in all its rules."
) )
assert result[0].resource_id == waf_id assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}] assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]
def test_wafv2_wb_acl_without_logging(self): @mock_aws
wafv2_client = mock.MagicMock def test_wafv2_web_acl_without_logging_in_rules(self):
wafv2_client.web_acls = {} wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
wafv2_client.enabled = True waf = wafv2_client.create_web_acl(
wafv2_client.web_acls = { Name="test-rules",
waf_arn: WebAclv2( Scope="REGIONAL",
arn=waf_arn, DefaultAction={"Allow": {}},
name=waf_name, Rules=[
id=waf_id, {
albs=[], "Name": "rule-off",
user_pools=[], "Priority": 1,
region=AWS_REGION_EU_WEST_1, "Statement": {
logging_enabled=False, "ByteMatchStatement": {
tags=[{"Key": "Name", "Value": waf_name}], "SearchString": "test",
) "FieldToMatch": {"UriPath": {}},
} "TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
}
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
}
],
VisibilityConfig={
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
Tags=[{"Key": "Name", "Value": "test-rules"}],
)["Summary"]
waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch( with mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_service.WAFv2", "prowler.providers.common.provider.Provider.get_global_provider",
new=wafv2_client, return_value=aws_provider,
), mock.patch( ), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_client.wafv2_client", "prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled.wafv2_client",
new=wafv2_client, new=WAFv2(aws_provider),
): ):
from prowler.providers.aws.services.wafv2.wafv2_webacl_logging_enabled.wafv2_webacl_logging_enabled import ( from prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled import (
wafv2_webacl_logging_enabled, wafv2_webacl_rule_logging_enabled,
) )
check = wafv2_webacl_logging_enabled() check = wafv2_webacl_rule_logging_enabled()
result = check.execute() result = check.execute()
assert len(result) == 1 assert len(result) == 1
assert result[0].status == "FAIL" assert result[0].status == "FAIL"
assert ( assert (
result[0].status_extended result[0].status_extended
== f"AWS WAFv2 Web ACL {waf_name} does not have logging enabled." == f"AWS WAFv2 Web ACL {waf_name} does not have CloudWatch Metrics enabled in rules: rule-off."
) )
assert result[0].resource_id == waf_id assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]
@mock_aws
def test_wafv2_web_acl_with_logging_in_rule_groups(self):
wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
waf = wafv2_client.create_web_acl(
Name="test-rules",
Scope="REGIONAL",
DefaultAction={"Allow": {}},
Rules=[
{
"Name": "rg-on",
"Priority": 1,
"Statement": {
"ByteMatchStatement": {
"SearchString": "test",
"FieldToMatch": {"UriPath": {}},
"TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
},
"RuleGroupReferenceStatement": {
"ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/rulegroup/ManagedRuleGroup/af9d9b6b-1d1b-4e0d-8f3e-1d1d0e1d0e1d",
},
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": True,
"MetricName": "web-acl-test-metric",
},
}
],
VisibilityConfig={
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
Tags=[{"Key": "Name", "Value": "test-rules"}],
)["Summary"]
waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled.wafv2_client",
new=WAFv2(aws_provider),
):
from prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled import (
wafv2_webacl_rule_logging_enabled,
)
check = wafv2_webacl_rule_logging_enabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"AWS WAFv2 Web ACL {waf_name} does have CloudWatch Metrics enabled in all its rules."
)
assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]
@mock_aws
def test_wafv2_web_acl_without_logging_in_rule_groups(self):
wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
waf = wafv2_client.create_web_acl(
Name="test-rules",
Scope="REGIONAL",
DefaultAction={"Allow": {}},
Rules=[
{
"Name": "rg-off",
"Priority": 1,
"Statement": {
"ByteMatchStatement": {
"SearchString": "test",
"FieldToMatch": {"UriPath": {}},
"TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
},
"RuleGroupReferenceStatement": {
"ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/rulegroup/ManagedRuleGroup/af9d9b6b-1d1b-4e0d-8f3e-1d1d0e1d0e1d",
},
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
}
],
VisibilityConfig={
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
Tags=[{"Key": "Name", "Value": "test-rules"}],
)["Summary"]
waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled.wafv2_client",
new=WAFv2(aws_provider),
):
from prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled import (
wafv2_webacl_rule_logging_enabled,
)
check = wafv2_webacl_rule_logging_enabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"AWS WAFv2 Web ACL {waf_name} does not have CloudWatch Metrics enabled in rule groups: rg-off."
)
assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]
@mock_aws
def test_wafv2_web_acl_with_logging_in_both(self):
wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
waf = wafv2_client.create_web_acl(
Name="test-rules",
Scope="REGIONAL",
DefaultAction={"Allow": {}},
Rules=[
{
"Name": "rule-on",
"Priority": 1,
"Statement": {
"ByteMatchStatement": {
"SearchString": "test",
"FieldToMatch": {"UriPath": {}},
"TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
}
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": True,
"MetricName": "web-acl-test-metric",
},
},
{
"Name": "rg-on",
"Priority": 1,
"Statement": {
"ByteMatchStatement": {
"SearchString": "test",
"FieldToMatch": {"UriPath": {}},
"TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
},
"RuleGroupReferenceStatement": {
"ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/rulegroup/ManagedRuleGroup/af9d9b6b-1d1b-4e0d-8f3e-1d1d0e1d0e1d",
},
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": True,
"MetricName": "web-acl-test-metric",
},
},
],
VisibilityConfig={
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
Tags=[{"Key": "Name", "Value": "test-rules"}],
)["Summary"]
waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled.wafv2_client",
new=WAFv2(aws_provider),
):
from prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled import (
wafv2_webacl_rule_logging_enabled,
)
check = wafv2_webacl_rule_logging_enabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"AWS WAFv2 Web ACL {waf_name} does have CloudWatch Metrics enabled in all its rules."
)
assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]
@mock_aws
def test_wafv2_web_acl_without_logging_in_both(self):
wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
waf = wafv2_client.create_web_acl(
Name="test-rules",
Scope="REGIONAL",
DefaultAction={"Allow": {}},
Rules=[
{
"Name": "rule-off",
"Priority": 1,
"Statement": {
"ByteMatchStatement": {
"SearchString": "test",
"FieldToMatch": {"UriPath": {}},
"TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
}
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
},
{
"Name": "rg-off",
"Priority": 1,
"Statement": {
"ByteMatchStatement": {
"SearchString": "test",
"FieldToMatch": {"UriPath": {}},
"TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
},
"RuleGroupReferenceStatement": {
"ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/rulegroup/ManagedRuleGroup/af9d9b6b-1d1b-4e0d-8f3e-1d1d0e1d0e1d",
},
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
},
],
VisibilityConfig={
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
Tags=[{"Key": "Name", "Value": "test-rules"}],
)["Summary"]
waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled.wafv2_client",
new=WAFv2(aws_provider),
):
from prowler.providers.aws.services.wafv2.wafv2_webacl_rule_logging_enabled.wafv2_webacl_rule_logging_enabled import (
wafv2_webacl_rule_logging_enabled,
)
check = wafv2_webacl_rule_logging_enabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"AWS WAFv2 Web ACL {waf_name} does not have CloudWatch Metrics enabled in rules: rule-off nor in rule groups: rg-off."
)
assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}] assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]
tests/providers/aws/services/wafv2/wafv2_webacl_with_rules/wafv2_webacl_with_rules_test.py
+135 -75
View File
@@ -1,24 +1,24 @@
from unittest import mock from unittest import mock
from uuid import uuid4
from prowler.providers.aws.services.wafv2.wafv2_service import Rule, WebAclv2 from boto3 import client
from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1 from moto import mock_aws
waf_id = str(uuid4()) from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider
waf_name = "waf-example"
waf_arn = f"arn:aws:wafv2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:regional/webacl/{waf_name}/{waf_id}"
class Test_wafv2_webacl_with_rules: class Test_wafv2_webacl_with_rules:
@mock_aws
def test_no_web_acls(self): def test_no_web_acls(self):
wafv2_client = mock.MagicMock from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
wafv2_client.web_acls = {}
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch( with mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_service.WAFv2", "prowler.providers.common.provider.Provider.get_global_provider",
new=wafv2_client, return_value=aws_provider,
), mock.patch( ), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_client.wafv2_client", "prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules.wafv2_client",
new=wafv2_client, new=WAFv2(aws_provider),
): ):
from prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules import ( from prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules import (
wafv2_webacl_with_rules, wafv2_webacl_with_rules,
@@ -28,28 +28,53 @@ class Test_wafv2_webacl_with_rules:
result = check.execute() result = check.execute()
assert len(result) == 0 assert len(result) == 0
def test_wafv2_wb_acl_with_rule(self): @mock_aws
wafv2_client = mock.MagicMock def test_wafv2_web_acl_with_rule(self):
wafv2_client.enabled = True wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
wafv2_client.web_acls = { waf = wafv2_client.create_web_acl(
waf_arn: WebAclv2( Name="test-rules",
arn=waf_arn, Scope="REGIONAL",
name=waf_name, DefaultAction={"Allow": {}},
id=waf_id, Rules=[
albs=[], {
user_pools=[], "Name": "rule-on",
region=AWS_REGION_EU_WEST_1, "Priority": 1,
logging_enabled=True, "Statement": {
tags=[{"Key": "Name", "Value": waf_name}], "ByteMatchStatement": {
rules=[Rule(name="rule1", cloudwatch_metrics_enabled=True)], "SearchString": "test",
) "FieldToMatch": {"UriPath": {}},
} "TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
}
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": True,
"MetricName": "web-acl-test-metric",
},
}
],
VisibilityConfig={
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
Tags=[{"Key": "Name", "Value": "test-rules"}],
)["Summary"]
waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch( with mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_service.WAFv2", "prowler.providers.common.provider.Provider.get_global_provider",
new=wafv2_client, return_value=aws_provider,
), mock.patch( ), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_client.wafv2_client", "prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules.wafv2_client",
new=wafv2_client, new=WAFv2(aws_provider),
): ):
from prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules import ( from prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules import (
wafv2_webacl_with_rules, wafv2_webacl_with_rules,
@@ -65,31 +90,59 @@ class Test_wafv2_webacl_with_rules:
) )
assert result[0].resource_id == waf_id assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}] assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]
def test_wafv2_wb_acl_with_rule_group(self): @mock_aws
wafv2_client = mock.MagicMock def test_wafv2_web_acl_with_rule_group(self):
wafv2_client.enabled = True wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
wafv2_client.web_acls = { waf = wafv2_client.create_web_acl(
waf_arn: WebAclv2( Name="test-rule-groups",
arn=waf_arn, Scope="REGIONAL",
name=waf_name, DefaultAction={"Allow": {}},
id=waf_id, Rules=[
albs=[], {
user_pools=[], "Name": "rg-on",
region=AWS_REGION_EU_WEST_1, "Priority": 1,
logging_enabled=True, "Statement": {
tags=[{"Key": "Name", "Value": waf_name}], "ByteMatchStatement": {
rule_groups=[Rule(name="rule_group1", cloudwatch_metrics_enabled=True)], "SearchString": "test",
) "FieldToMatch": {"UriPath": {}},
} "TextTransformations": [{"Type": "NONE", "Priority": 0}],
"PositionalConstraint": "CONTAINS",
},
"RuleGroupReferenceStatement": {
"ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/rulegroup/ManagedRuleGroup/af9d9b6b-1d1b-4e0d-8f3e-1d1d0e1d0e1d",
},
},
"VisibilityConfig": {
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": True,
"MetricName": "web-acl-test-metric",
},
}
],
VisibilityConfig={
"SampledRequestsEnabled": True,
"CloudWatchMetricsEnabled": False,
"MetricName": "web-acl-test-metric",
},
Tags=[{"Key": "Name", "Value": "test-rule-groups"}],
)["Summary"]
waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch( with mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_service.WAFv2", "prowler.providers.common.provider.Provider.get_global_provider",
new=wafv2_client, return_value=aws_provider,
), mock.patch( ), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_client.wafv2_client", "prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules.wafv2_client",
new=wafv2_client, new=WAFv2(aws_provider),
): ):
from prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules import ( from prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules import (
wafv2_webacl_with_rules, wafv2_webacl_with_rules,
@@ -105,31 +158,38 @@ class Test_wafv2_webacl_with_rules:
) )
assert result[0].resource_id == waf_id assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}] assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]
def test_wafv2_wb_acl_without_rule_or_rule_group(self): @mock_aws
wafv2_client = mock.MagicMock def test_wafv2_web_acl_without_rule_or_rule_group(self):
wafv2_client.web_acls = {} wafv2_client = client("wafv2", region_name=AWS_REGION_US_EAST_1)
wafv2_client.enabled = True waf = wafv2_client.create_web_acl(
wafv2_client.web_acls = { Name="test-none",
waf_arn: WebAclv2( Scope="REGIONAL",
arn=waf_arn, DefaultAction={"Allow": {}},
name=waf_name, Rules=[],
id=waf_id, VisibilityConfig={
albs=[], "SampledRequestsEnabled": True,
user_pools=[], "CloudWatchMetricsEnabled": False,
region=AWS_REGION_EU_WEST_1, "MetricName": "web-acl-test-metric",
logging_enabled=False, },
tags=[{"Key": "Name", "Value": waf_name}], Tags=[{"Key": "Name", "Value": "test-none"}],
) )["Summary"]
} waf_id = waf["Id"]
waf_name = waf["Name"]
waf_arn = waf["ARN"]
from prowler.providers.aws.services.wafv2.wafv2_service import WAFv2
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch( with mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_service.WAFv2", "prowler.providers.common.provider.Provider.get_global_provider",
new=wafv2_client, return_value=aws_provider,
), mock.patch( ), mock.patch(
"prowler.providers.aws.services.wafv2.wafv2_client.wafv2_client", "prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules.wafv2_client",
new=wafv2_client, new=WAFv2(aws_provider),
): ):
from prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules import ( from prowler.providers.aws.services.wafv2.wafv2_webacl_with_rules.wafv2_webacl_with_rules import (
wafv2_webacl_with_rules, wafv2_webacl_with_rules,
@@ -145,5 +205,5 @@ class Test_wafv2_webacl_with_rules:
) )
assert result[0].resource_id == waf_id assert result[0].resource_id == waf_id
assert result[0].resource_arn == waf_arn assert result[0].resource_arn == waf_arn
assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}] assert result[0].resource_tags == [{"Key": "Name", "Value": waf_name}]