From 434460b978fd9ae8cd3613d0d61c7bbd60ca1751 Mon Sep 17 00:00:00 2001
From: Sergio Garcia <38561120+sergargar@users.noreply.github.com>
Date: Mon, 14 Oct 2024 13:58:30 -0400
Subject: [PATCH] fix(organizations): no finding for access denied in listing
 policies (#5400)

---
 ...rganizations_opt_out_ai_services_policy.py | 24 ++++++++---------
 ...ions_tags_policies_enabled_and_attached.py | 26 +++++++++----------
 2 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/prowler/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py b/prowler/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py
index f42263891a..ca178aa826 100644
--- a/prowler/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py
+++ b/prowler/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py
@@ -9,17 +9,17 @@ class organizations_opt_out_ai_services_policy(Check):
         findings = []
 
         for org in organizations_client.organizations:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = org.id
-            report.resource_arn = org.arn
-            report.region = organizations_client.region
-            report.status = "FAIL"
-            report.status_extended = (
-                "AWS Organizations is not in-use for this AWS Account."
-            )
-            if org.status == "ACTIVE":
-                report.status_extended = f"AWS Organization {org.id} has not opted out of all AI services, granting consent for AWS to access its data."
-                if org.policies is not None:  # Access Denied to list_policies
+            if org.policies is not None:  # Access Denied to list_policies
+                report = Check_Report_AWS(self.metadata())
+                report.resource_id = org.id
+                report.resource_arn = org.arn
+                report.region = organizations_client.region
+                report.status = "FAIL"
+                report.status_extended = (
+                    "AWS Organizations is not in-use for this AWS Account."
+                )
+                if org.status == "ACTIVE":
+                    report.status_extended = f"AWS Organization {org.id} has not opted out of all AI services, granting consent for AWS to access its data."
                     for policy in org.policies.get("AISERVICES_OPT_OUT_POLICY", []):
                         if (
                             policy.content.get("services", {})
@@ -32,6 +32,6 @@ class organizations_opt_out_ai_services_policy(Check):
                             report.status_extended = f"AWS Organization {org.id} has opted out of all AI services, not granting consent for AWS to access its data."
                             break
 
-            findings.append(report)
+                findings.append(report)
 
         return findings
diff --git a/prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py b/prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py
index f3cb419ed3..80d6b3e052 100644
--- a/prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py
+++ b/prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py
@@ -9,26 +9,26 @@ class organizations_tags_policies_enabled_and_attached(Check):
         findings = []
 
         for org in organizations_client.organizations:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = org.id
-            report.resource_arn = org.arn
-            report.region = organizations_client.region
-            report.status = "FAIL"
-            report.status_extended = (
-                "AWS Organizations is not in-use for this AWS Account."
-            )
-
-            if org.status == "ACTIVE":
+            if org.policies is not None:  # Access Denied to list_policies
+                report = Check_Report_AWS(self.metadata())
+                report.resource_id = org.id
+                report.resource_arn = org.arn
+                report.region = organizations_client.region
+                report.status = "FAIL"
                 report.status_extended = (
-                    f"AWS Organizations {org.id} does not have tag policies."
+                    "AWS Organizations is not in-use for this AWS Account."
                 )
-                if org.policies is not None:  # Access Denied to list_policies
+
+                if org.status == "ACTIVE":
+                    report.status_extended = (
+                        f"AWS Organizations {org.id} does not have tag policies."
+                    )
                     for policy in org.policies.get("TAG_POLICY", []):
                         report.status_extended = f"AWS Organization {org.id} has tag policies enabled but not attached."
                         if policy.targets:
                             report.status = "PASS"
                             report.status_extended = f"AWS Organization {org.id} has tag policies enabled and attached to an AWS account."
 
-            findings.append(report)
+                findings.append(report)
 
         return findings