From 4c6be5e2836f51470fe6139f45dc3d5477f2cbb7 Mon Sep 17 00:00:00 2001 From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> Date: Thu, 16 Jan 2025 00:03:37 +0100 Subject: [PATCH] feat(aws): include resource metadata in services from `a*` to `b*` (#6504) Co-authored-by: Sergio Garcia --- prowler/lib/check/models.py | 2 - .../accessanalyzer_enabled.py | 8 +-- ...accessanalyzer_enabled_without_findings.py | 13 ++-- ...ccount_maintain_current_contact_details.py | 4 +- ...ails_to_security_billing_and_operations.py | 6 +- ...urity_contact_information_is_registered.py | 4 +- ...tions_are_registered_in_the_aws_account.py | 4 +- .../acm_certificates_expiration_check.py | 15 +--- ..._certificates_transparency_logs_enabled.py | 17 +---- ...certificates_with_secure_key_algorithms.py | 9 +-- .../apigateway_restapi_authorizers_enabled.py | 8 +-- .../apigateway_restapi_cache_encrypted.py | 6 +- ...eway_restapi_client_certificate_enabled.py | 6 +- .../apigateway_restapi_logging_enabled.py | 8 +-- .../apigateway_restapi_public.py | 8 +-- ...igateway_restapi_public_with_authorizer.py | 7 +- .../apigateway_restapi_tracing_enabled.py | 6 +- .../apigateway_restapi_waf_acl_attached.py | 8 +-- ...apigatewayv2_api_access_logging_enabled.py | 8 +-- .../apigatewayv2_api_authorizers_enabled.py | 5 +- ..._fleet_default_internet_access_disabled.py | 6 +- ...ppstream_fleet_maximum_session_duration.py | 6 +- ...stream_fleet_session_disconnect_timeout.py | 6 +- ...m_fleet_session_idle_disconnect_timeout.py | 6 +- .../appsync_field_level_logging_enabled.py | 6 +- ...c_graphql_api_no_api_key_authentication.py | 8 +-- .../athena_workgroup_encryption.py | 8 +-- .../athena_workgroup_enforce_configuration.py | 8 +-- .../athena_workgroup_logging_enabled.py | 8 +-- ...g_find_secrets_ec2_launch_configuration.py | 7 +- ...caling_group_capacity_rebalance_enabled.py | 9 ++- ...oscaling_group_elb_health_check_enabled.py | 9 ++- ...group_launch_configuration_no_public_ip.py | 9 ++- ...up_launch_configuration_requires_imdsv2.py | 9 ++- .../autoscaling_group_multiple_az.py | 7 +- ...toscaling_group_multiple_instance_types.py | 7 +- ...scaling_group_using_ec2_launch_template.py | 7 +- .../awslambda_function_inside_vpc.py | 9 ++- ...i_operations_cloudtrail_logging_enabled.py | 8 +-- .../awslambda_function_no_secrets_in_code.py | 8 +-- ...lambda_function_no_secrets_in_variables.py | 8 +-- ...lambda_function_not_publicly_accessible.py | 8 +-- .../awslambda_function_url_cors_policy.py | 9 ++- .../awslambda_function_url_public.py | 9 ++- ...ambda_function_using_supported_runtimes.py | 8 +-- .../awslambda_function_vpc_multi_az.py | 9 ++- .../backup_plans_exist/backup_plans_exist.py | 11 ++- .../backup_recovery_point_encrypted.py | 7 +- .../backup_reportplans_exist.py | 15 ++-- .../backup_vaults_encrypted.py | 8 +-- .../backup_vaults_exist.py | 17 ++--- .../bedrock_agent_guardrail_enabled.py | 6 +- ..._guardrail_prompt_attack_filter_enabled.py | 8 +-- ...il_sensitive_information_filter_enabled.py | 8 +-- ...edrock_model_invocation_logging_enabled.py | 4 +- ...odel_invocation_logs_encryption_enabled.py | 4 +- ...to_security_billing_and_operations_test.py | 68 +++++++++++-------- .../backup_plans_exist_test.py | 2 +- .../backup_reportplans_exist_test.py | 4 +- .../backup_vaults_exist_test.py | 6 +- 60 files changed, 224 insertions(+), 298 deletions(-) diff --git a/prowler/lib/check/models.py b/prowler/lib/check/models.py index b7a6ac4e89..0b4792f199 100644 --- a/prowler/lib/check/models.py +++ b/prowler/lib/check/models.py @@ -420,7 +420,6 @@ class Check_Report: """ self.status = "" self.check_metadata = CheckMetadata.parse_raw(metadata) - if isinstance(resource, dict): self.resource_metadata = resource elif isinstance(resource, list): @@ -436,7 +435,6 @@ class Check_Report: f"Resource metadata {type(resource)} could not be converted to dict" ) self.resource_metadata = {} - self.status_extended = "" self.resource_details = "" self.resource_tags = getattr(resource, "tags", []) if resource else [] diff --git a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py index 52bb65184e..d89a047690 100644 --- a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py +++ b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py @@ -8,11 +8,9 @@ class accessanalyzer_enabled(Check): def execute(self): findings = [] for analyzer in accessanalyzer_client.analyzers: - report = Check_Report_AWS(self.metadata()) - report.region = analyzer.region - report.resource_id = analyzer.name - report.resource_arn = analyzer.arn - report.resource_tags = analyzer.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=analyzer + ) if analyzer.status == "ACTIVE": report.status = "PASS" report.status_extended = ( diff --git a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled_without_findings/accessanalyzer_enabled_without_findings.py b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled_without_findings/accessanalyzer_enabled_without_findings.py index 07490225c0..b54116601b 100644 --- a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled_without_findings/accessanalyzer_enabled_without_findings.py +++ b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled_without_findings/accessanalyzer_enabled_without_findings.py @@ -8,14 +8,13 @@ class accessanalyzer_enabled_without_findings(Check): def execute(self): findings = [] for analyzer in accessanalyzer_client.analyzers: - report = Check_Report_AWS(self.metadata()) - report.region = analyzer.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=analyzer + ) if analyzer.status == "ACTIVE": report.status = "PASS" report.status_extended = f"IAM Access Analyzer {analyzer.name} does not have active findings." - report.resource_id = analyzer.name - report.resource_arn = analyzer.arn - report.resource_tags = analyzer.tags + if len(analyzer.findings) != 0: active_finding_counter = 0 for finding in analyzer.findings: @@ -25,9 +24,7 @@ class accessanalyzer_enabled_without_findings(Check): if active_finding_counter > 0: report.status = "FAIL" report.status_extended = f"IAM Access Analyzer {analyzer.name} has {active_finding_counter} active findings." - report.resource_id = analyzer.name - report.resource_arn = analyzer.arn - report.resource_tags = analyzer.tags + findings.append(report) return findings diff --git a/prowler/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.py b/prowler/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.py index fd9eff4db7..c47776afd2 100644 --- a/prowler/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.py +++ b/prowler/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.py @@ -6,7 +6,9 @@ from prowler.providers.aws.services.account.account_client import account_client class account_maintain_current_contact_details(Check): def execute(self): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=account_client.contact_base + ) report.region = account_client.region report.resource_id = account_client.audited_account report.resource_arn = account_client.audited_account_arn diff --git a/prowler/providers/aws/services/account/account_maintain_different_contact_details_to_security_billing_and_operations/account_maintain_different_contact_details_to_security_billing_and_operations.py b/prowler/providers/aws/services/account/account_maintain_different_contact_details_to_security_billing_and_operations/account_maintain_different_contact_details_to_security_billing_and_operations.py index 1a3f799dfb..c54cd126ae 100644 --- a/prowler/providers/aws/services/account/account_maintain_different_contact_details_to_security_billing_and_operations/account_maintain_different_contact_details_to_security_billing_and_operations.py +++ b/prowler/providers/aws/services/account/account_maintain_different_contact_details_to_security_billing_and_operations/account_maintain_different_contact_details_to_security_billing_and_operations.py @@ -8,10 +8,12 @@ class account_maintain_different_contact_details_to_security_billing_and_operati def execute(self): findings = [] if account_client.contact_base: - report = Check_Report_AWS(self.metadata()) - report.region = account_client.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=account_client.contact_base + ) report.resource_id = account_client.audited_account report.resource_arn = account_client.audited_account_arn + report.region = account_client.region if ( len(account_client.contact_phone_numbers) diff --git a/prowler/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.py b/prowler/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.py index f2ac5dd5c5..6de2d9db5d 100644 --- a/prowler/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.py +++ b/prowler/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.py @@ -6,7 +6,9 @@ from prowler.providers.aws.services.account.account_client import account_client class account_security_contact_information_is_registered(Check): def execute(self): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=account_client.contact_base + ) report.region = account_client.region report.resource_id = account_client.audited_account report.resource_arn = account_client.audited_account_arn diff --git a/prowler/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.py b/prowler/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.py index 1ec4d53723..84bc4a1a1d 100644 --- a/prowler/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.py +++ b/prowler/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.py @@ -6,7 +6,9 @@ from prowler.providers.aws.services.account.account_client import account_client class account_security_questions_are_registered_in_the_aws_account(Check): def execute(self): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=account_client.contacts_security + ) report.region = account_client.region report.resource_id = account_client.audited_account report.resource_arn = account_client.audited_account_arn diff --git a/prowler/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check.py b/prowler/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check.py index b434118078..e7ac961d83 100644 --- a/prowler/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check.py +++ b/prowler/providers/aws/services/acm/acm_certificates_expiration_check/acm_certificates_expiration_check.py @@ -7,17 +7,14 @@ class acm_certificates_expiration_check(Check): findings = [] for certificate in acm_client.certificates.values(): if certificate.in_use or acm_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) - report.region = certificate.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=certificate + ) if certificate.expiration_days > acm_client.audit_config.get( "days_to_expire_threshold", 7 ): report.status = "PASS" report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} expires in {certificate.expiration_days} days." - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags else: report.status = "FAIL" if certificate.expiration_days < 0: @@ -26,11 +23,5 @@ class acm_certificates_expiration_check(Check): else: report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} is about to expire in {certificate.expiration_days} days." report.check_metadata.Severity = Severity.medium - - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags - findings.append(report) return findings diff --git a/prowler/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled.py b/prowler/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled.py index 19c24f82b7..f4f6cf0022 100644 --- a/prowler/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled.py +++ b/prowler/providers/aws/services/acm/acm_certificates_transparency_logs_enabled/acm_certificates_transparency_logs_enabled.py @@ -7,29 +7,18 @@ class acm_certificates_transparency_logs_enabled(Check): findings = [] for certificate in acm_client.certificates.values(): if certificate.in_use or acm_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) - report.region = certificate.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=certificate + ) if certificate.type == "IMPORTED": report.status = "PASS" report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} is imported." - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags else: if not certificate.transparency_logging: report.status = "FAIL" report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has Certificate Transparency logging disabled." - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags else: report.status = "PASS" report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has Certificate Transparency logging enabled." - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags findings.append(report) return findings diff --git a/prowler/providers/aws/services/acm/acm_certificates_with_secure_key_algorithms/acm_certificates_with_secure_key_algorithms.py b/prowler/providers/aws/services/acm/acm_certificates_with_secure_key_algorithms/acm_certificates_with_secure_key_algorithms.py index 1dc788b797..7ef99c0bd9 100644 --- a/prowler/providers/aws/services/acm/acm_certificates_with_secure_key_algorithms/acm_certificates_with_secure_key_algorithms.py +++ b/prowler/providers/aws/services/acm/acm_certificates_with_secure_key_algorithms/acm_certificates_with_secure_key_algorithms.py @@ -7,12 +7,9 @@ class acm_certificates_with_secure_key_algorithms(Check): findings = [] for certificate in acm_client.certificates.values(): if certificate.in_use or acm_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) - report.region = certificate.region - report.resource_id = certificate.id - report.resource_details = certificate.name - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=certificate + ) report.status = "PASS" report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} uses a secure key algorithm ({certificate.key_algorithm})." diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_authorizers_enabled/apigateway_restapi_authorizers_enabled.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_authorizers_enabled/apigateway_restapi_authorizers_enabled.py index 70cabcd31c..b814853382 100644 --- a/prowler/providers/aws/services/apigateway/apigateway_restapi_authorizers_enabled/apigateway_restapi_authorizers_enabled.py +++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_authorizers_enabled/apigateway_restapi_authorizers_enabled.py @@ -8,11 +8,11 @@ class apigateway_restapi_authorizers_enabled(Check): def execute(self): findings = [] for rest_api in apigateway_client.rest_apis: - report = Check_Report_AWS(self.metadata()) - report.region = rest_api.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=rest_api + ) report.resource_id = rest_api.name - report.resource_arn = rest_api.arn - report.resource_tags = rest_api.tags + # it there are not authorizers at api level and resources without methods (default case) -> report.status = "FAIL" report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} does not have an authorizer configured at api level." diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_cache_encrypted/apigateway_restapi_cache_encrypted.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_cache_encrypted/apigateway_restapi_cache_encrypted.py index 86c239f725..59f622ee0b 100644 --- a/prowler/providers/aws/services/apigateway/apigateway_restapi_cache_encrypted/apigateway_restapi_cache_encrypted.py +++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_cache_encrypted/apigateway_restapi_cache_encrypted.py @@ -10,11 +10,11 @@ class apigateway_restapi_cache_encrypted(Check): for rest_api in apigateway_client.rest_apis: for stage in rest_api.stages: if stage.cache_enabled: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=stage + ) report.region = rest_api.region report.resource_id = rest_api.name - report.resource_arn = stage.arn - report.resource_tags = stage.tags report.status = "PASS" report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has cache encryption enabled." if not stage.cache_data_encrypted: diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_client_certificate_enabled/apigateway_restapi_client_certificate_enabled.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_client_certificate_enabled/apigateway_restapi_client_certificate_enabled.py index 95cbe5886e..2c66a27f15 100644 --- a/prowler/providers/aws/services/apigateway/apigateway_restapi_client_certificate_enabled/apigateway_restapi_client_certificate_enabled.py +++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_client_certificate_enabled/apigateway_restapi_client_certificate_enabled.py @@ -9,11 +9,11 @@ class apigateway_restapi_client_certificate_enabled(Check): findings = [] for rest_api in apigateway_client.rest_apis: for stage in rest_api.stages: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=stage + ) report.resource_id = rest_api.name report.region = rest_api.region - report.resource_arn = stage.arn - report.resource_tags = stage.tags if stage.client_certificate: report.status = "PASS" report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has client certificate enabled." diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_logging_enabled/apigateway_restapi_logging_enabled.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_logging_enabled/apigateway_restapi_logging_enabled.py index ef2f0496bd..a519d980ed 100644 --- a/prowler/providers/aws/services/apigateway/apigateway_restapi_logging_enabled/apigateway_restapi_logging_enabled.py +++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_logging_enabled/apigateway_restapi_logging_enabled.py @@ -9,11 +9,11 @@ class apigateway_restapi_logging_enabled(Check): findings = [] for rest_api in apigateway_client.rest_apis: for stage in rest_api.stages: - report = Check_Report_AWS(self.metadata()) - report.region = rest_api.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=stage + ) report.resource_id = rest_api.name - report.resource_arn = stage.arn - report.resource_tags = stage.tags + report.region = rest_api.region if stage.logging: report.status = "PASS" report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has logging enabled." diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_public/apigateway_restapi_public.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_public/apigateway_restapi_public.py index 22cfeca49d..8ffa5058a5 100644 --- a/prowler/providers/aws/services/apigateway/apigateway_restapi_public/apigateway_restapi_public.py +++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_public/apigateway_restapi_public.py @@ -8,11 +8,11 @@ class apigateway_restapi_public(Check): def execute(self): findings = [] for rest_api in apigateway_client.rest_apis: - report = Check_Report_AWS(self.metadata()) - report.region = rest_api.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=rest_api + ) report.resource_id = rest_api.name - report.resource_arn = rest_api.arn - report.resource_tags = rest_api.tags + if rest_api.public_endpoint: report.status = "FAIL" report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} is internet accessible." diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_public_with_authorizer/apigateway_restapi_public_with_authorizer.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_public_with_authorizer/apigateway_restapi_public_with_authorizer.py index a293b721f3..f934558f39 100644 --- a/prowler/providers/aws/services/apigateway/apigateway_restapi_public_with_authorizer/apigateway_restapi_public_with_authorizer.py +++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_public_with_authorizer/apigateway_restapi_public_with_authorizer.py @@ -9,11 +9,10 @@ class apigateway_restapi_public_with_authorizer(Check): findings = [] for rest_api in apigateway_client.rest_apis: if rest_api.public_endpoint: - report = Check_Report_AWS(self.metadata()) - report.region = rest_api.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=rest_api + ) report.resource_id = rest_api.name - report.resource_arn = rest_api.arn - report.resource_tags = rest_api.tags report.status = "PASS" report.status_extended = f"API Gateway REST API {rest_api.name} with ID {rest_api.id} has a public endpoint with an authorizer." diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_tracing_enabled/apigateway_restapi_tracing_enabled.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_tracing_enabled/apigateway_restapi_tracing_enabled.py index 8067bff98d..99e8149a69 100644 --- a/prowler/providers/aws/services/apigateway/apigateway_restapi_tracing_enabled/apigateway_restapi_tracing_enabled.py +++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_tracing_enabled/apigateway_restapi_tracing_enabled.py @@ -9,11 +9,11 @@ class apigateway_restapi_tracing_enabled(Check): findings = [] for rest_api in apigateway_client.rest_apis: for stage in rest_api.stages: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=stage + ) report.region = rest_api.region report.resource_id = rest_api.name - report.resource_arn = stage.arn - report.resource_tags = stage.tags report.status = "FAIL" report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} does not have X-Ray tracing enabled." if stage.tracing_enabled: diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_waf_acl_attached/apigateway_restapi_waf_acl_attached.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_waf_acl_attached/apigateway_restapi_waf_acl_attached.py index 9af00c3827..e719711186 100644 --- a/prowler/providers/aws/services/apigateway/apigateway_restapi_waf_acl_attached/apigateway_restapi_waf_acl_attached.py +++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_waf_acl_attached/apigateway_restapi_waf_acl_attached.py @@ -9,11 +9,11 @@ class apigateway_restapi_waf_acl_attached(Check): findings = [] for rest_api in apigateway_client.rest_apis: for stage in rest_api.stages: - report = Check_Report_AWS(self.metadata()) - report.region = rest_api.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=stage + ) report.resource_id = rest_api.name - report.resource_arn = stage.arn - report.resource_tags = stage.tags + report.region = rest_api.region if stage.waf: report.status = "PASS" report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has {stage.waf} WAF ACL attached." diff --git a/prowler/providers/aws/services/apigatewayv2/apigatewayv2_api_access_logging_enabled/apigatewayv2_api_access_logging_enabled.py b/prowler/providers/aws/services/apigatewayv2/apigatewayv2_api_access_logging_enabled/apigatewayv2_api_access_logging_enabled.py index 6ca506f07c..cc64e6191c 100644 --- a/prowler/providers/aws/services/apigatewayv2/apigatewayv2_api_access_logging_enabled/apigatewayv2_api_access_logging_enabled.py +++ b/prowler/providers/aws/services/apigatewayv2/apigatewayv2_api_access_logging_enabled/apigatewayv2_api_access_logging_enabled.py @@ -8,21 +8,17 @@ class apigatewayv2_api_access_logging_enabled(Check): def execute(self): findings = [] for api in apigatewayv2_client.apis: - report = Check_Report_AWS(self.metadata()) - report.region = api.region + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=api) for stage in api.stages: if stage.logging: report.status = "PASS" report.status_extended = f"API Gateway V2 {api.name} ID {api.id} in stage {stage.name} has access logging enabled." report.resource_id = f"{api.name}-{stage.name}" - report.resource_arn = api.arn - report.resource_tags = api.tags else: report.status = "FAIL" report.status_extended = f"API Gateway V2 {api.name} ID {api.id} in stage {stage.name} has access logging disabled." report.resource_id = f"{api.name}-{stage.name}" - report.resource_arn = api.arn - report.resource_tags = api.tags + findings.append(report) return findings diff --git a/prowler/providers/aws/services/apigatewayv2/apigatewayv2_api_authorizers_enabled/apigatewayv2_api_authorizers_enabled.py b/prowler/providers/aws/services/apigatewayv2/apigatewayv2_api_authorizers_enabled/apigatewayv2_api_authorizers_enabled.py index d081410203..be898f3c92 100644 --- a/prowler/providers/aws/services/apigatewayv2/apigatewayv2_api_authorizers_enabled/apigatewayv2_api_authorizers_enabled.py +++ b/prowler/providers/aws/services/apigatewayv2/apigatewayv2_api_authorizers_enabled/apigatewayv2_api_authorizers_enabled.py @@ -8,11 +8,8 @@ class apigatewayv2_api_authorizers_enabled(Check): def execute(self): findings = [] for api in apigatewayv2_client.apis: - report = Check_Report_AWS(self.metadata()) - report.region = api.region + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=api) report.resource_id = api.name - report.resource_arn = api.arn - report.resource_tags = api.tags report.status = "FAIL" report.status_extended = f"API Gateway V2 {api.name} ID {api.id} does not have an authorizer configured." if api.authorizer: diff --git a/prowler/providers/aws/services/appstream/appstream_fleet_default_internet_access_disabled/appstream_fleet_default_internet_access_disabled.py b/prowler/providers/aws/services/appstream/appstream_fleet_default_internet_access_disabled/appstream_fleet_default_internet_access_disabled.py index 438cbcc62f..947bc4a345 100644 --- a/prowler/providers/aws/services/appstream/appstream_fleet_default_internet_access_disabled/appstream_fleet_default_internet_access_disabled.py +++ b/prowler/providers/aws/services/appstream/appstream_fleet_default_internet_access_disabled/appstream_fleet_default_internet_access_disabled.py @@ -10,11 +10,7 @@ class appstream_fleet_default_internet_access_disabled(Check): """Execute the appstream_fleet_default_internet_access_disabled check""" findings = [] for fleet in appstream_client.fleets: - report = Check_Report_AWS(self.metadata()) - report.region = fleet.region - report.resource_id = fleet.name - report.resource_arn = fleet.arn - report.resource_tags = fleet.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fleet) if fleet.enable_default_internet_access: report.status = "FAIL" diff --git a/prowler/providers/aws/services/appstream/appstream_fleet_maximum_session_duration/appstream_fleet_maximum_session_duration.py b/prowler/providers/aws/services/appstream/appstream_fleet_maximum_session_duration/appstream_fleet_maximum_session_duration.py index 6c6a01c077..2b5360bbcc 100644 --- a/prowler/providers/aws/services/appstream/appstream_fleet_maximum_session_duration/appstream_fleet_maximum_session_duration.py +++ b/prowler/providers/aws/services/appstream/appstream_fleet_maximum_session_duration/appstream_fleet_maximum_session_duration.py @@ -15,11 +15,7 @@ class appstream_fleet_maximum_session_duration(Check): findings = [] for fleet in appstream_client.fleets: - report = Check_Report_AWS(self.metadata()) - report.region = fleet.region - report.resource_id = fleet.name - report.resource_arn = fleet.arn - report.resource_tags = fleet.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fleet) if fleet.max_user_duration_in_seconds < max_session_duration_seconds: report.status = "PASS" diff --git a/prowler/providers/aws/services/appstream/appstream_fleet_session_disconnect_timeout/appstream_fleet_session_disconnect_timeout.py b/prowler/providers/aws/services/appstream/appstream_fleet_session_disconnect_timeout/appstream_fleet_session_disconnect_timeout.py index a53c26ec63..d0845a58bc 100644 --- a/prowler/providers/aws/services/appstream/appstream_fleet_session_disconnect_timeout/appstream_fleet_session_disconnect_timeout.py +++ b/prowler/providers/aws/services/appstream/appstream_fleet_session_disconnect_timeout/appstream_fleet_session_disconnect_timeout.py @@ -15,11 +15,7 @@ class appstream_fleet_session_disconnect_timeout(Check): findings = [] for fleet in appstream_client.fleets: - report = Check_Report_AWS(self.metadata()) - report.region = fleet.region - report.resource_id = fleet.name - report.resource_arn = fleet.arn - report.resource_tags = fleet.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fleet) if fleet.disconnect_timeout_in_seconds <= max_disconnect_timeout_in_seconds: report.status = "PASS" diff --git a/prowler/providers/aws/services/appstream/appstream_fleet_session_idle_disconnect_timeout/appstream_fleet_session_idle_disconnect_timeout.py b/prowler/providers/aws/services/appstream/appstream_fleet_session_idle_disconnect_timeout/appstream_fleet_session_idle_disconnect_timeout.py index 17672ef78f..972490270c 100644 --- a/prowler/providers/aws/services/appstream/appstream_fleet_session_idle_disconnect_timeout/appstream_fleet_session_idle_disconnect_timeout.py +++ b/prowler/providers/aws/services/appstream/appstream_fleet_session_idle_disconnect_timeout/appstream_fleet_session_idle_disconnect_timeout.py @@ -15,11 +15,7 @@ class appstream_fleet_session_idle_disconnect_timeout(Check): findings = [] for fleet in appstream_client.fleets: - report = Check_Report_AWS(self.metadata()) - report.region = fleet.region - report.resource_id = fleet.name - report.resource_arn = fleet.arn - report.resource_tags = fleet.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fleet) if ( fleet.idle_disconnect_timeout_in_seconds diff --git a/prowler/providers/aws/services/appsync/appsync_field_level_logging_enabled/appsync_field_level_logging_enabled.py b/prowler/providers/aws/services/appsync/appsync_field_level_logging_enabled/appsync_field_level_logging_enabled.py index 0863ccfeb6..2980d17d53 100644 --- a/prowler/providers/aws/services/appsync/appsync_field_level_logging_enabled/appsync_field_level_logging_enabled.py +++ b/prowler/providers/aws/services/appsync/appsync_field_level_logging_enabled/appsync_field_level_logging_enabled.py @@ -7,11 +7,7 @@ class appsync_field_level_logging_enabled(Check): findings = [] # Check only GraphQL APIs because boto3 does not have a method to get other types of AppSync APIs (list_apis is not working) for api in appsync_client.graphql_apis.values(): - report = Check_Report_AWS(self.metadata()) - report.region = api.region - report.resource_id = api.id - report.resource_arn = api.arn - report.resource_tags = api.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=api) report.status = "PASS" report.status_extended = ( f"AppSync API {api.name} has field log level enabled." diff --git a/prowler/providers/aws/services/appsync/appsync_graphql_api_no_api_key_authentication/appsync_graphql_api_no_api_key_authentication.py b/prowler/providers/aws/services/appsync/appsync_graphql_api_no_api_key_authentication/appsync_graphql_api_no_api_key_authentication.py index cdb491a755..8bbdd49cac 100644 --- a/prowler/providers/aws/services/appsync/appsync_graphql_api_no_api_key_authentication/appsync_graphql_api_no_api_key_authentication.py +++ b/prowler/providers/aws/services/appsync/appsync_graphql_api_no_api_key_authentication/appsync_graphql_api_no_api_key_authentication.py @@ -7,11 +7,9 @@ class appsync_graphql_api_no_api_key_authentication(Check): findings = [] for api in appsync_client.graphql_apis.values(): if api.type == "GRAPHQL": - report = Check_Report_AWS(self.metadata()) - report.region = api.region - report.resource_id = api.id - report.resource_arn = api.arn - report.resource_tags = api.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=api + ) report.status = "PASS" report.status_extended = f"AppSync GraphQL API {api.name} is not using an API KEY for authentication." if api.authentication_type == "API_KEY": diff --git a/prowler/providers/aws/services/athena/athena_workgroup_encryption/athena_workgroup_encryption.py b/prowler/providers/aws/services/athena/athena_workgroup_encryption/athena_workgroup_encryption.py index 42bebbe448..ffa4732111 100644 --- a/prowler/providers/aws/services/athena/athena_workgroup_encryption/athena_workgroup_encryption.py +++ b/prowler/providers/aws/services/athena/athena_workgroup_encryption/athena_workgroup_encryption.py @@ -13,11 +13,9 @@ class athena_workgroup_encryption(Check): if ( workgroup.state == "ENABLED" and workgroup.queries ) or athena_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) - report.region = workgroup.region - report.resource_id = workgroup.name - report.resource_arn = workgroup.arn - report.resource_tags = workgroup.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=workgroup + ) if workgroup.encryption_configuration.encrypted: report.status = "PASS" diff --git a/prowler/providers/aws/services/athena/athena_workgroup_enforce_configuration/athena_workgroup_enforce_configuration.py b/prowler/providers/aws/services/athena/athena_workgroup_enforce_configuration/athena_workgroup_enforce_configuration.py index 1606c6cfb7..987b88f024 100644 --- a/prowler/providers/aws/services/athena/athena_workgroup_enforce_configuration/athena_workgroup_enforce_configuration.py +++ b/prowler/providers/aws/services/athena/athena_workgroup_enforce_configuration/athena_workgroup_enforce_configuration.py @@ -13,11 +13,9 @@ class athena_workgroup_enforce_configuration(Check): if ( workgroup.state == "ENABLED" and workgroup.queries ) or athena_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) - report.region = workgroup.region - report.resource_id = workgroup.name - report.resource_arn = workgroup.arn - report.resource_tags = workgroup.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=workgroup + ) if workgroup.enforce_workgroup_configuration: report.status = "PASS" diff --git a/prowler/providers/aws/services/athena/athena_workgroup_logging_enabled/athena_workgroup_logging_enabled.py b/prowler/providers/aws/services/athena/athena_workgroup_logging_enabled/athena_workgroup_logging_enabled.py index f9b5918ba2..4b408e1e9f 100644 --- a/prowler/providers/aws/services/athena/athena_workgroup_logging_enabled/athena_workgroup_logging_enabled.py +++ b/prowler/providers/aws/services/athena/athena_workgroup_logging_enabled/athena_workgroup_logging_enabled.py @@ -21,11 +21,9 @@ class athena_workgroup_logging_enabled(Check): if ( workgroup.state == "ENABLED" and workgroup.queries ) or athena_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) - report.resource_id = workgroup.name - report.resource_arn = workgroup.arn - report.region = workgroup.region - report.resource_tags = workgroup.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=workgroup + ) report.status = "PASS" report.status_extended = ( f"Athena WorkGroup {workgroup.name} has CloudWatch logging enabled." diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration.py b/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration.py index 88b4678acc..7d8d1aa5b8 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration.py @@ -20,10 +20,9 @@ class autoscaling_find_secrets_ec2_launch_configuration(Check): configuration_arn, configuration, ) in autoscaling_client.launch_configurations.items(): - report = Check_Report_AWS(self.metadata()) - report.region = configuration.region - report.resource_id = configuration.name - report.resource_arn = configuration_arn + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=configuration + ) if configuration.user_data: user_data = b64decode(configuration.user_data) diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_capacity_rebalance_enabled/autoscaling_group_capacity_rebalance_enabled.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_capacity_rebalance_enabled/autoscaling_group_capacity_rebalance_enabled.py index da0822fb76..791adcab6e 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_capacity_rebalance_enabled/autoscaling_group_capacity_rebalance_enabled.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_capacity_rebalance_enabled/autoscaling_group_capacity_rebalance_enabled.py @@ -9,11 +9,10 @@ class autoscaling_group_capacity_rebalance_enabled(Check): findings = [] for group in autoscaling_client.groups: if group.load_balancers and group.target_groups: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=group + ) + report.status = "FAIL" report.status_extended = f"Autoscaling group {group.name} does not have capacity rebalance enabled." if group.capacity_rebalance: diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_elb_health_check_enabled/autoscaling_group_elb_health_check_enabled.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_elb_health_check_enabled/autoscaling_group_elb_health_check_enabled.py index 02a18f29d6..8ea149e415 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_elb_health_check_enabled/autoscaling_group_elb_health_check_enabled.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_elb_health_check_enabled/autoscaling_group_elb_health_check_enabled.py @@ -9,11 +9,10 @@ class autoscaling_group_elb_health_check_enabled(Check): findings = [] for group in autoscaling_client.groups: if group.load_balancers and group.target_groups: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=group + ) + report.status = "FAIL" report.status_extended = f"Autoscaling group {group.name} is associated with a load balancer but does not have ELB health checks enabled, instead it has {group.health_check_type} health checks." if "ELB" in group.health_check_type: diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip.py index 178a6748a6..3e06d39a02 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip.py @@ -10,11 +10,10 @@ class autoscaling_group_launch_configuration_no_public_ip(Check): for group in autoscaling_client.groups: for lc in autoscaling_client.launch_configurations.values(): if lc.name == group.launch_configuration_name: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=group + ) + report.status = "PASS" report.status_extended = f"Autoscaling group {group.name} does not have an associated launch configuration assigning a public IP address." diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2.py index 5d79ba42d9..fea8b084e7 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2.py @@ -12,11 +12,10 @@ class autoscaling_group_launch_configuration_requires_imdsv2(Check): launch_configuration ) in autoscaling_client.launch_configurations.values(): if launch_configuration.name == group.launch_configuration_name: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=group + ) + report.status = "FAIL" report.status_extended = f"Autoscaling group {group.name} has IMDSv2 disabled or not required." if ( diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_multiple_az/autoscaling_group_multiple_az.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_multiple_az/autoscaling_group_multiple_az.py index 5e96f6087f..a294f11548 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_multiple_az/autoscaling_group_multiple_az.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_multiple_az/autoscaling_group_multiple_az.py @@ -8,11 +8,8 @@ class autoscaling_group_multiple_az(Check): def execute(self): findings = [] for group in autoscaling_client.groups: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=group) + report.status = "FAIL" report.status_extended = ( f"Autoscaling group {group.name} has only one availability zones." diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_multiple_instance_types/autoscaling_group_multiple_instance_types.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_multiple_instance_types/autoscaling_group_multiple_instance_types.py index 5dd8bae2a5..19498e87c4 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_multiple_instance_types/autoscaling_group_multiple_instance_types.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_multiple_instance_types/autoscaling_group_multiple_instance_types.py @@ -8,11 +8,8 @@ class autoscaling_group_multiple_instance_types(Check): def execute(self): findings = [] for group in autoscaling_client.groups: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=group) + report.status = "FAIL" report.status_extended = f"Autoscaling group {group.name} does not have multiple instance types in multiple Availability Zones." diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_using_ec2_launch_template/autoscaling_group_using_ec2_launch_template.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_using_ec2_launch_template/autoscaling_group_using_ec2_launch_template.py index f0eaccac39..1bd61ade66 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_using_ec2_launch_template/autoscaling_group_using_ec2_launch_template.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_using_ec2_launch_template/autoscaling_group_using_ec2_launch_template.py @@ -8,11 +8,8 @@ class autoscaling_group_using_ec2_launch_template(Check): def execute(self): findings = [] for group in autoscaling_client.groups: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=group) + report.status = "PASS" report.status_extended = ( f"Autoscaling group {group.name} is using an EC2 launch template." diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_inside_vpc/awslambda_function_inside_vpc.py b/prowler/providers/aws/services/awslambda/awslambda_function_inside_vpc/awslambda_function_inside_vpc.py index 30beadcbc5..3f6651e731 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_inside_vpc/awslambda_function_inside_vpc.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_inside_vpc/awslambda_function_inside_vpc.py @@ -8,11 +8,10 @@ class awslambda_function_inside_vpc(Check): def execute(self) -> List[Check_Report_AWS]: findings = [] for function_arn, function in awslambda_client.functions.items(): - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function_arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) + report.status = "PASS" report.status_extended = ( f"Lambda function {function.name} is inside of VPC {function.vpc_id}" diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py b/prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py index f5806a6463..ff00b1d828 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py @@ -9,11 +9,9 @@ class awslambda_function_invoke_api_operations_cloudtrail_logging_enabled(Check) def execute(self): findings = [] for function in awslambda_client.functions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function.arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py b/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py index b9dc59cebb..dea269d121 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py @@ -15,11 +15,9 @@ class awslambda_function_no_secrets_in_code(Check): ) for function, function_code in awslambda_client._get_function_code(): if function_code: - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function.arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) report.status = "PASS" report.status_extended = ( diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables.py b/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables.py index 0905c752d2..3e0ce0d4c3 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables.py @@ -13,11 +13,9 @@ class awslambda_function_no_secrets_in_variables(Check): "secrets_ignore_patterns", [] ) for function in awslambda_client.functions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function.arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) report.status = "PASS" report.status_extended = ( diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible.py b/prowler/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible.py index 778c44be93..dd8046bd46 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible.py @@ -7,11 +7,9 @@ class awslambda_function_not_publicly_accessible(Check): def execute(self): findings = [] for function in awslambda_client.functions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function.arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) report.status = "PASS" report.status_extended = f"Lambda function {function.name} has a policy resource-based policy not public." diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy.py b/prowler/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy.py index 840b2a3503..6c75656379 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy.py @@ -6,11 +6,10 @@ class awslambda_function_url_cors_policy(Check): def execute(self): findings = [] for function in awslambda_client.functions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function.arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) + if function.url_config: if "*" in function.url_config.cors_config.allow_origins: report.status = "FAIL" diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public.py b/prowler/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public.py index a6365d4f8e..6a4bd383b3 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public.py @@ -7,11 +7,10 @@ class awslambda_function_url_public(Check): def execute(self): findings = [] for function in awslambda_client.functions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function.arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) + if function.url_config: if function.url_config.auth_type == AuthType.AWS_IAM: report.status = "PASS" diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes.py b/prowler/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes.py index 2890d46718..c34f24e06f 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes.py @@ -33,11 +33,9 @@ class awslambda_function_using_supported_runtimes(Check): findings = [] for function in awslambda_client.functions.values(): if function.runtime: - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function.arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) if function.runtime in awslambda_client.audit_config.get( "obsolete_lambda_runtimes", default_obsolete_lambda_runtimes diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_vpc_multi_az/awslambda_function_vpc_multi_az.py b/prowler/providers/aws/services/awslambda/awslambda_function_vpc_multi_az/awslambda_function_vpc_multi_az.py index 26fd6e40cd..27bc24483e 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_vpc_multi_az/awslambda_function_vpc_multi_az.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_vpc_multi_az/awslambda_function_vpc_multi_az.py @@ -16,11 +16,10 @@ class awslambda_function_vpc_multi_az(Check): awslambda_function_inside_vpc.__name__, function_arn, ): - report = Check_Report_AWS(self.metadata()) - report.region = function.region - report.resource_id = function.name - report.resource_arn = function_arn - report.resource_tags = function.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=function + ) + report.status = "FAIL" report.status_extended = ( f"Lambda function {function.name} is not inside a VPC." diff --git a/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.py b/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.py index 4309985757..339f81560e 100644 --- a/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.py +++ b/prowler/providers/aws/services/backup/backup_plans_exist/backup_plans_exist.py @@ -6,21 +6,20 @@ class backup_plans_exist(Check): def execute(self): findings = [] if backup_client.backup_plans: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=backup_client.backup_plans[0], + ) report.status = "PASS" report.status_extended = f"At least one Backup Plan exists: {backup_client.backup_plans[0].name}." - report.resource_arn = backup_client.backup_plans[0].arn report.resource_id = backup_client.backup_plans[0].name - report.region = backup_client.backup_plans[0].region - report.resource_tags = backup_client.backup_plans[0].tags findings.append(report) elif backup_client.backup_vaults: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS(self.metadata(), resource_metadata=backup_client) report.status = "FAIL" report.status_extended = "No Backup Plan exist." report.resource_arn = backup_client.backup_plan_arn_template report.resource_id = backup_client.audited_account - report.region = backup_client.region report.resource_tags = [] findings.append(report) return findings diff --git a/prowler/providers/aws/services/backup/backup_recovery_point_encrypted/backup_recovery_point_encrypted.py b/prowler/providers/aws/services/backup/backup_recovery_point_encrypted/backup_recovery_point_encrypted.py index 7dadc609e5..bcd80ab82e 100644 --- a/prowler/providers/aws/services/backup/backup_recovery_point_encrypted/backup_recovery_point_encrypted.py +++ b/prowler/providers/aws/services/backup/backup_recovery_point_encrypted/backup_recovery_point_encrypted.py @@ -6,11 +6,10 @@ class backup_recovery_point_encrypted(Check): def execute(self): findings = [] for recovery_point in backup_client.recovery_points: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=recovery_point + ) report.region = recovery_point.backup_vault_region - report.resource_id = recovery_point.id - report.resource_arn = recovery_point.arn - report.resource_tags = recovery_point.tags report.status = "FAIL" report.status_extended = f"Backup Recovery Point {recovery_point.id} for Backup Vault {recovery_point.backup_vault_name} is not encrypted at rest." if recovery_point.encrypted: diff --git a/prowler/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist.py b/prowler/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist.py index fac8ee4fe3..2998054f6c 100644 --- a/prowler/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist.py +++ b/prowler/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist.py @@ -7,13 +7,20 @@ class backup_reportplans_exist(Check): findings = [] # We only check report plans if backup plans exist if backup_client.backup_plans: - report = Check_Report_AWS(self.metadata()) - report.status = "FAIL" - report.status_extended = "No Backup Report Plan exist." + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=backup_client.backup_plans[0], + ) report.resource_arn = backup_client.report_plan_arn_template report.resource_id = backup_client.audited_account - report.region = backup_client.region + report.status = "FAIL" + report.status_extended = "No Backup Report Plan exist." + if backup_client.backup_report_plans: + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=backup_client.backup_report_plans[0], + ) report.status = "PASS" report.status_extended = f"At least one backup report plan exists: {backup_client.backup_report_plans[0].name}." report.resource_arn = backup_client.backup_report_plans[0].arn diff --git a/prowler/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted.py b/prowler/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted.py index 053ebbb2e9..8dd09ec73b 100644 --- a/prowler/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted.py +++ b/prowler/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted.py @@ -7,11 +7,9 @@ class backup_vaults_encrypted(Check): findings = [] if backup_client.backup_vaults: for backup_vault in backup_client.backup_vaults: - report = Check_Report_AWS(self.metadata()) - report.resource_arn = backup_vault.arn - report.resource_id = backup_vault.name - report.region = backup_vault.region - report.resource_tags = backup_vault.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=backup_vault + ) report.status = "FAIL" report.status_extended = ( f"Backup Vault {backup_vault.name} is not encrypted at rest." diff --git a/prowler/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist.py b/prowler/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist.py index 8a59c70dbc..e7da76c2f9 100644 --- a/prowler/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist.py +++ b/prowler/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist.py @@ -6,20 +6,21 @@ class backup_vaults_exist(Check): def execute(self): findings = [] if backup_client.backup_vaults is not None: - report = Check_Report_AWS(self.metadata()) - report.status = "FAIL" - report.status_extended = "No Backup Vault exist." + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=backup_client.backup_vaults + ) report.resource_arn = backup_client.backup_vault_arn_template report.resource_id = backup_client.audited_account report.region = backup_client.region report.resource_tags = [] + report.status = "FAIL" + report.status_extended = "No Backup Vault exist." if backup_client.backup_vaults: + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=backup_client.backup_vaults[0], + ) report.status = "PASS" report.status_extended = f"At least one backup vault exists: {backup_client.backup_vaults[0].name}." - report.resource_arn = backup_client.backup_vaults[0].arn - report.resource_id = backup_client.backup_vaults[0].name - report.region = backup_client.backup_vaults[0].region - report.resource_tags = backup_client.backup_vaults[0].tags - findings.append(report) return findings diff --git a/prowler/providers/aws/services/bedrock/bedrock_agent_guardrail_enabled/bedrock_agent_guardrail_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_agent_guardrail_enabled/bedrock_agent_guardrail_enabled.py index ad5426635d..c7ffd6baf2 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_agent_guardrail_enabled/bedrock_agent_guardrail_enabled.py +++ b/prowler/providers/aws/services/bedrock/bedrock_agent_guardrail_enabled/bedrock_agent_guardrail_enabled.py @@ -8,11 +8,7 @@ class bedrock_agent_guardrail_enabled(Check): def execute(self): findings = [] for agent in bedrock_agent_client.agents.values(): - report = Check_Report_AWS(self.metadata()) - report.region = agent.region - report.resource_id = agent.id - report.resource_arn = agent.arn - report.resource_tags = agent.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=agent) report.status = "FAIL" report.status_extended = f"Bedrock Agent {agent.name} is not using any guardrail to protect agent sessions." if agent.guardrail_id: diff --git a/prowler/providers/aws/services/bedrock/bedrock_guardrail_prompt_attack_filter_enabled/bedrock_guardrail_prompt_attack_filter_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_guardrail_prompt_attack_filter_enabled/bedrock_guardrail_prompt_attack_filter_enabled.py index 6f2ba89507..ff17338510 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_guardrail_prompt_attack_filter_enabled/bedrock_guardrail_prompt_attack_filter_enabled.py +++ b/prowler/providers/aws/services/bedrock/bedrock_guardrail_prompt_attack_filter_enabled/bedrock_guardrail_prompt_attack_filter_enabled.py @@ -6,11 +6,9 @@ class bedrock_guardrail_prompt_attack_filter_enabled(Check): def execute(self): findings = [] for guardrail in bedrock_client.guardrails.values(): - report = Check_Report_AWS(self.metadata()) - report.region = guardrail.region - report.resource_id = guardrail.id - report.resource_arn = guardrail.arn - report.resource_tags = guardrail.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=guardrail + ) report.status = "PASS" report.status_extended = f"Bedrock Guardrail {guardrail.name} is configured to detect and block prompt attacks with a HIGH strength." if not guardrail.prompt_attack_filter_strength: diff --git a/prowler/providers/aws/services/bedrock/bedrock_guardrail_sensitive_information_filter_enabled/bedrock_guardrail_sensitive_information_filter_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_guardrail_sensitive_information_filter_enabled/bedrock_guardrail_sensitive_information_filter_enabled.py index a758358c60..4789f2fe9f 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_guardrail_sensitive_information_filter_enabled/bedrock_guardrail_sensitive_information_filter_enabled.py +++ b/prowler/providers/aws/services/bedrock/bedrock_guardrail_sensitive_information_filter_enabled/bedrock_guardrail_sensitive_information_filter_enabled.py @@ -6,11 +6,9 @@ class bedrock_guardrail_sensitive_information_filter_enabled(Check): def execute(self): findings = [] for guardrail in bedrock_client.guardrails.values(): - report = Check_Report_AWS(self.metadata()) - report.region = guardrail.region - report.resource_id = guardrail.id - report.resource_arn = guardrail.arn - report.resource_tags = guardrail.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=guardrail + ) report.status = "PASS" report.status_extended = f"Bedrock Guardrail {guardrail.name} is blocking or masking sensitive information." if not guardrail.sensitive_information_filter: diff --git a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.py index d28c392209..94106128ea 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.py +++ b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.py @@ -6,7 +6,9 @@ class bedrock_model_invocation_logging_enabled(Check): def execute(self): findings = [] for region, logging in bedrock_client.logging_configurations.items(): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=logging + ) report.region = region report.resource_id = "model-invocation-logging" report.resource_arn = ( diff --git a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py index e3cbb28644..3a9fe73ec8 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py +++ b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py @@ -11,7 +11,9 @@ class bedrock_model_invocation_logs_encryption_enabled(Check): if logging.enabled: s3_encryption = True cloudwatch_encryption = True - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=logging + ) report.region = region report.resource_id = "model-invocation-logging" report.resource_arn = ( diff --git a/tests/providers/aws/services/account/account_maintain_different_contact_details_to_security_billing_and_operations/account_maintain_different_contact_details_to_security_billing_and_operations_test.py b/tests/providers/aws/services/account/account_maintain_different_contact_details_to_security_billing_and_operations/account_maintain_different_contact_details_to_security_billing_and_operations_test.py index d2aac9c79a..cbb8d9015b 100644 --- a/tests/providers/aws/services/account/account_maintain_different_contact_details_to_security_billing_and_operations/account_maintain_different_contact_details_to_security_billing_and_operations_test.py +++ b/tests/providers/aws/services/account/account_maintain_different_contact_details_to_security_billing_and_operations/account_maintain_different_contact_details_to_security_billing_and_operations_test.py @@ -1,16 +1,17 @@ from unittest import mock from prowler.providers.aws.services.account.account_service import Contact +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider AWS_ACCOUNT_NUMBER = "123456789012" AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" -AWS_REGION = "us-east-1" class Test_account_maintain_different_contact_details_to_security_billing_and_operations: def test_contacts_not_configured_or_equal(self): - account_client = mock.MagicMock - account_client.region = AWS_REGION + aws_mocked_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + account_client = mock.MagicMock() + account_client.region = AWS_REGION_EU_WEST_1 account_client.audited_account = AWS_ACCOUNT_NUMBER account_client.audited_account_arn = AWS_ACCOUNT_ARN @@ -26,12 +27,15 @@ class Test_account_maintain_different_contact_details_to_security_billing_and_op account_client.contact_names = {} account_client.contact_emails = {} - with mock.patch( - "prowler.providers.aws.services.account.account_service.Account", - new=account_client, - ), mock.patch( - "prowler.providers.aws.services.account.account_client.account_client", - new=account_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_mocked_provider, + ), + mock.patch( + "prowler.providers.aws.services.account.account_maintain_different_contact_details_to_security_billing_and_operations.account_maintain_different_contact_details_to_security_billing_and_operations.account_client", + new=account_client, + ), ): # Test Check from prowler.providers.aws.services.account.account_maintain_different_contact_details_to_security_billing_and_operations.account_maintain_different_contact_details_to_security_billing_and_operations import ( @@ -49,13 +53,14 @@ class Test_account_maintain_different_contact_details_to_security_billing_and_op result[0].status_extended == "SECURITY, BILLING and OPERATIONS contacts not found or they are not different between each other and between ROOT contact." ) - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert result[0].resource_arn == AWS_ACCOUNT_ARN - def test_contacts_diffent(self): - account_client = mock.MagicMock - account_client.region = AWS_REGION + def test_contacts_different(self): + aws_mocked_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + account_client = mock.MagicMock() + account_client.region = AWS_REGION_EU_WEST_1 account_client.audited_account = AWS_ACCOUNT_NUMBER account_client.audited_account_arn = AWS_ACCOUNT_ARN @@ -75,12 +80,15 @@ class Test_account_maintain_different_contact_details_to_security_billing_and_op "test3@test.com", } - with mock.patch( - "prowler.providers.aws.services.account.account_service.Account", - new=account_client, - ), mock.patch( - "prowler.providers.aws.services.account.account_client.account_client", - new=account_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_mocked_provider, + ), + mock.patch( + "prowler.providers.aws.services.account.account_maintain_different_contact_details_to_security_billing_and_operations.account_maintain_different_contact_details_to_security_billing_and_operations.account_client", + new=account_client, + ), ): # Test Check from prowler.providers.aws.services.account.account_maintain_different_contact_details_to_security_billing_and_operations.account_maintain_different_contact_details_to_security_billing_and_operations import ( @@ -98,23 +106,27 @@ class Test_account_maintain_different_contact_details_to_security_billing_and_op result[0].status_extended == "SECURITY, BILLING and OPERATIONS contacts found and they are different between each other and between ROOT contact." ) - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert result[0].resource_arn == AWS_ACCOUNT_ARN def test_access_denied(self): - account_client = mock.MagicMock - account_client.region = AWS_REGION + aws_mocked_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + account_client = mock.MagicMock() + account_client.region = AWS_REGION_EU_WEST_1 account_client.audited_account = AWS_ACCOUNT_NUMBER account_client.audited_account_arn = AWS_ACCOUNT_ARN account_client.contact_base = None - with mock.patch( - "prowler.providers.aws.services.account.account_service.Account", - new=account_client, - ), mock.patch( - "prowler.providers.aws.services.account.account_client.account_client", - new=account_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_mocked_provider, + ), + mock.patch( + "prowler.providers.aws.services.account.account_maintain_different_contact_details_to_security_billing_and_operations.account_maintain_different_contact_details_to_security_billing_and_operations.account_client", + new=account_client, + ), ): # Test Check from prowler.providers.aws.services.account.account_maintain_different_contact_details_to_security_billing_and_operations.account_maintain_different_contact_details_to_security_billing_and_operations import ( diff --git a/tests/providers/aws/services/backup/backup_plans_exist/backup_plans_exist_test.py b/tests/providers/aws/services/backup/backup_plans_exist/backup_plans_exist_test.py index d1fb5afd1c..f4fb055a94 100644 --- a/tests/providers/aws/services/backup/backup_plans_exist/backup_plans_exist_test.py +++ b/tests/providers/aws/services/backup/backup_plans_exist/backup_plans_exist_test.py @@ -10,7 +10,7 @@ AWS_ACCOUNT_NUMBER = "123456789012" class Test_backup_plans_exist: def test_no_backup_plans(self): - backup_client = mock.MagicMock + backup_client = mock.MagicMock() backup_client.audited_account = AWS_ACCOUNT_NUMBER backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" backup_client.audited_partition = "aws" diff --git a/tests/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist_test.py b/tests/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist_test.py index a039eb1a1c..3787ac3874 100644 --- a/tests/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist_test.py +++ b/tests/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist_test.py @@ -34,7 +34,7 @@ class Test_backup_reportplans_exist: assert len(result) == 0 def test_no_backup_report_plans(self): - backup_client = mock.MagicMock + backup_client = mock.MagicMock() backup_client.audited_account = AWS_ACCOUNT_NUMBER backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" backup_client.region = AWS_REGION @@ -85,7 +85,7 @@ class Test_backup_reportplans_exist: assert result[0].region == AWS_REGION def test_one_backup_report_plan(self): - backup_client = mock.MagicMock + backup_client = mock.MagicMock() backup_client.audited_account = AWS_ACCOUNT_NUMBER backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" backup_client.region = AWS_REGION diff --git a/tests/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist_test.py b/tests/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist_test.py index 8c1c229359..5267ecb33a 100644 --- a/tests/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist_test.py +++ b/tests/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist_test.py @@ -8,7 +8,7 @@ AWS_ACCOUNT_NUMBER = "123456789012" class Test_backup_vaults_exist: def test_no_backup_vaults(self): - backup_client = mock.MagicMock + backup_client = mock.MagicMock() backup_client.audited_account = AWS_ACCOUNT_NUMBER backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" backup_client.region = AWS_REGION @@ -45,7 +45,7 @@ class Test_backup_vaults_exist: assert result[0].resource_tags == [] def test_one_backup_vault(self): - backup_client = mock.MagicMock + backup_client = mock.MagicMock() backup_client.audited_account = AWS_ACCOUNT_NUMBER backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" backup_client.region = AWS_REGION @@ -96,7 +96,7 @@ class Test_backup_vaults_exist: assert result[0].resource_tags == [] def test_access_denied(self): - backup_client = mock.MagicMock + backup_client = mock.MagicMock() backup_client.audited_account = AWS_ACCOUNT_NUMBER backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" backup_client.region = AWS_REGION