feat(provider): add alibabacloud provider

tests/providers/alibabacloud/alibabacloud_fixtures.py

@@ -0,0 +1,63 @@
+from mock import MagicMock
+
+from prowler.providers.alibabacloud.alibabacloud_provider import AlibabacloudProvider
+from prowler.providers.alibabacloud.models import (
+    AlibabaCloudCredentials,
+    AlibabaCloudIdentityInfo,
+    AlibabaCloudSession,
+)
+
+ALIBABACLOUD_ACCOUNT_ID = "LTAI5tGKAbeoSf7Mddg9"
+ALIBABACLOUD_ACCOUNT_ARN = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:root"
+ALIBABACLOUD_REGION = "cn-hangzhou"
+
+
+def set_mocked_alibabacloud_provider(
+    account_id: str = ALIBABACLOUD_ACCOUNT_ID,
+    account_arn: str = ALIBABACLOUD_ACCOUNT_ARN,
+    access_key_id: str = "LTAI5tGKAbeoSf7Mddg9",
+    access_key_secret: str = "mock_secret",
+    region: str = ALIBABACLOUD_REGION,
+    audit_config: dict = None,
+) -> AlibabacloudProvider:
+    """
+    Create a mocked Alibaba Cloud provider for testing
+
+    Args:
+        account_id: Alibaba Cloud account ID
+        account_arn: Alibaba Cloud account ARN
+        access_key_id: Access key ID
+        access_key_secret: Access key secret
+        region: Default region
+        audit_config: Audit configuration
+
+    Returns:
+        Mocked AlibabacloudProvider instance
+    """
+    provider = MagicMock()
+    provider.type = "alibabacloud"
+
+    # Set up credentials
+    credentials = AlibabaCloudCredentials(
+        access_key_id=access_key_id,
+        access_key_secret=access_key_secret,
+    )
+
+    # Set up session
+    session = AlibabaCloudSession(
+        credentials=credentials,
+        region_id=region,
+    )
+    provider.session = session
+
+    # Set up identity
+    identity = AlibabaCloudIdentityInfo(
+        account_id=account_id,
+        account_arn=account_arn,
+    )
+    provider.identity = identity
+
+    # Set audit config
+    provider.audit_config = audit_config if audit_config else {}
+
+    return provider

tests/providers/alibabacloud/services/ack/__init__.py

@@ -0,0 +1 @@
+"""ACK Service Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_audit_log/__init__.py

@@ -0,0 +1 @@
+"""ACK Check Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_audit_log/ack_cluster_audit_log_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ack_cluster_audit_log:
+    def test_no_clusters(self):
+        ack_client = mock.MagicMock
+        ack_client.clusters = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_audit_log.ack_cluster_audit_log.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_audit_log.ack_cluster_audit_log import (
+                ack_cluster_audit_log,
+            )
+
+            check = ack_cluster_audit_log()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_cluster_audit_log_enabled_pass(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test123"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_audit_log.ack_cluster_audit_log.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_audit_log.ack_cluster_audit_log import (
+                ack_cluster_audit_log,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    audit_log_enabled=True,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_audit_log()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == cluster_id
+            assert "has audit logging enabled" in result[0].status_extended
+
+    def test_cluster_audit_log_enabled_fail(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test456"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_audit_log.ack_cluster_audit_log.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_audit_log.ack_cluster_audit_log import (
+                ack_cluster_audit_log,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    audit_log_enabled=False,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_audit_log()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == cluster_id
+            assert "does not have audit logging enabled" in result[0].status_extended

tests/providers/alibabacloud/services/ack/ack_cluster_encryption/__init__.py

@@ -0,0 +1 @@
+"""ACK Check Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_encryption/ack_cluster_encryption_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ack_cluster_encryption:
+    def test_no_clusters(self):
+        ack_client = mock.MagicMock
+        ack_client.clusters = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_encryption.ack_cluster_encryption.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_encryption.ack_cluster_encryption import (
+                ack_cluster_encryption,
+            )
+
+            check = ack_cluster_encryption()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_cluster_encryption_enabled_pass(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test123"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_encryption.ack_cluster_encryption.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_encryption.ack_cluster_encryption import (
+                ack_cluster_encryption,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    encryption_enabled=True,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_encryption()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == cluster_id
+            assert "has encryption enabled" in result[0].status_extended
+
+    def test_cluster_encryption_enabled_fail(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test456"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_encryption.ack_cluster_encryption.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_encryption.ack_cluster_encryption import (
+                ack_cluster_encryption,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    encryption_enabled=False,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_encryption()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == cluster_id
+            assert "does not have encryption enabled" in result[0].status_extended

tests/providers/alibabacloud/services/ack/ack_cluster_network_policy/__init__.py

@@ -0,0 +1 @@
+"""ACK Check Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_network_policy/ack_cluster_network_policy_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ack_cluster_network_policy:
+    def test_no_clusters(self):
+        ack_client = mock.MagicMock
+        ack_client.clusters = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_network_policy.ack_cluster_network_policy.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_network_policy.ack_cluster_network_policy import (
+                ack_cluster_network_policy,
+            )
+
+            check = ack_cluster_network_policy()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_cluster_network_policy_enabled_pass(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test123"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_network_policy.ack_cluster_network_policy.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_network_policy.ack_cluster_network_policy import (
+                ack_cluster_network_policy,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    network_policy_enabled=True,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_network_policy()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == cluster_id
+            assert "has network policy support enabled" in result[0].status_extended
+
+    def test_cluster_network_policy_enabled_fail(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test456"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_network_policy.ack_cluster_network_policy.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_network_policy.ack_cluster_network_policy import (
+                ack_cluster_network_policy,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    network_policy_enabled=False,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_network_policy()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == cluster_id
+            assert "does not have network policy support enabled" in result[0].status_extended

tests/providers/alibabacloud/services/ack/ack_cluster_private_zone/__init__.py

@@ -0,0 +1 @@
+"""ACK Check Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_private_zone/ack_cluster_private_zone_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ack_cluster_private_zone:
+    def test_no_clusters(self):
+        ack_client = mock.MagicMock
+        ack_client.clusters = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_private_zone.ack_cluster_private_zone.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_private_zone.ack_cluster_private_zone import (
+                ack_cluster_private_zone,
+            )
+
+            check = ack_cluster_private_zone()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_cluster_private_zone_enabled_pass(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test123"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_private_zone.ack_cluster_private_zone.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_private_zone.ack_cluster_private_zone import (
+                ack_cluster_private_zone,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    private_zone_enabled=True,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_private_zone()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == cluster_id
+            assert "has PrivateZone enabled" in result[0].status_extended
+
+    def test_cluster_private_zone_enabled_fail(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test456"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_private_zone.ack_cluster_private_zone.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_private_zone.ack_cluster_private_zone import (
+                ack_cluster_private_zone,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    private_zone_enabled=False,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_private_zone()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == cluster_id
+            assert "does not have PrivateZone enabled" in result[0].status_extended

tests/providers/alibabacloud/services/ack/ack_cluster_public_access/__init__.py

@@ -0,0 +1 @@
+"""ACK Check Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_public_access/ack_cluster_public_access_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ack_cluster_public_access:
+    def test_no_clusters(self):
+        ack_client = mock.MagicMock
+        ack_client.clusters = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_public_access.ack_cluster_public_access.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_public_access.ack_cluster_public_access import (
+                ack_cluster_public_access,
+            )
+
+            check = ack_cluster_public_access()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_cluster_public_access_pass(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test123"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_public_access.ack_cluster_public_access.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_public_access.ack_cluster_public_access import (
+                ack_cluster_public_access,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    public_access=False,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_public_access()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == cluster_id
+            assert "is not publicly accessible" in result[0].status_extended
+
+    def test_cluster_public_access_fail(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test456"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_public_access.ack_cluster_public_access.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_public_access.ack_cluster_public_access import (
+                ack_cluster_public_access,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    public_access=True,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_public_access()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == cluster_id
+            assert "is publicly accessible" in result[0].status_extended

tests/providers/alibabacloud/services/ack/ack_cluster_rbac/__init__.py

@@ -0,0 +1 @@
+"""ACK Check Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_rbac/ack_cluster_rbac_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ack_cluster_rbac:
+    def test_no_clusters(self):
+        ack_client = mock.MagicMock
+        ack_client.clusters = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_rbac.ack_cluster_rbac.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_rbac.ack_cluster_rbac import (
+                ack_cluster_rbac,
+            )
+
+            check = ack_cluster_rbac()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_cluster_rbac_enabled_pass(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test123"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_rbac.ack_cluster_rbac.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_rbac.ack_cluster_rbac import (
+                ack_cluster_rbac,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    rbac_enabled=True,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_rbac()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == cluster_id
+            assert "has RBAC enabled" in result[0].status_extended
+
+    def test_cluster_rbac_enabled_fail(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test456"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_rbac.ack_cluster_rbac.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_rbac.ack_cluster_rbac import (
+                ack_cluster_rbac,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    rbac_enabled=False,
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_rbac()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == cluster_id
+            assert "does not have RBAC enabled" in result[0].status_extended

tests/providers/alibabacloud/services/ack/ack_cluster_security_group/__init__.py

@@ -0,0 +1 @@
+"""ACK Check Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_security_group/ack_cluster_security_group_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ack_cluster_security_group:
+    def test_no_clusters(self):
+        ack_client = mock.MagicMock
+        ack_client.clusters = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_security_group.ack_cluster_security_group.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_security_group.ack_cluster_security_group import (
+                ack_cluster_security_group,
+            )
+
+            check = ack_cluster_security_group()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_cluster_security_group_id_pass(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test123"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_security_group.ack_cluster_security_group.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_security_group.ack_cluster_security_group import (
+                ack_cluster_security_group,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    security_group_id='sg-test123',
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_security_group()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == cluster_id
+            assert "has security group" in result[0].status_extended
+
+    def test_cluster_security_group_id_fail(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test456"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_security_group.ack_cluster_security_group.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_security_group.ack_cluster_security_group import (
+                ack_cluster_security_group,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    security_group_id='',
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_security_group()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == cluster_id
+            assert "does not have a security group configured" in result[0].status_extended

tests/providers/alibabacloud/services/ack/ack_cluster_vpc/__init__.py

@@ -0,0 +1 @@
+"""ACK Check Tests"""

tests/providers/alibabacloud/services/ack/ack_cluster_vpc/ack_cluster_vpc_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ack_cluster_vpc:
+    def test_no_clusters(self):
+        ack_client = mock.MagicMock
+        ack_client.clusters = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_vpc.ack_cluster_vpc.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_vpc.ack_cluster_vpc import (
+                ack_cluster_vpc,
+            )
+
+            check = ack_cluster_vpc()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_cluster_vpc_id_pass(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test123"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_vpc.ack_cluster_vpc.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_vpc.ack_cluster_vpc import (
+                ack_cluster_vpc,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    vpc_id='vpc-test123',
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_vpc()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == cluster_id
+            assert "is deployed in VPC" in result[0].status_extended
+
+    def test_cluster_vpc_id_fail(self):
+        ack_client = mock.MagicMock
+        cluster_id = "c-test456"
+        cluster_arn = (
+            f"acs:ack:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:cluster/{cluster_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ack.ack_cluster_vpc.ack_cluster_vpc.ack_client",
+            new=ack_client,
+        ):
+            from prowler.providers.alibabacloud.services.ack.ack_cluster_vpc.ack_cluster_vpc import (
+                ack_cluster_vpc,
+            )
+            from prowler.providers.alibabacloud.services.ack.ack_service import (
+                Cluster,
+            )
+
+            ack_client.clusters = {
+                cluster_arn: Cluster(
+                    cluster_id=cluster_id,
+                    cluster_name="test-cluster",
+                    arn=cluster_arn,
+                    region=ALIBABACLOUD_REGION,
+                    vpc_id='',
+                )
+            }
+            ack_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ack_cluster_vpc()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == cluster_id
+            assert "is not deployed in a VPC" in result[0].status_extended

tests/providers/alibabacloud/services/actiontrail/__init__.py

@@ -0,0 +1 @@
+"""ActionTrail Service Tests"""

tests/providers/alibabacloud/services/actiontrail/actiontrail_trail_enabled/__init__.py

@@ -0,0 +1 @@
+"""ActionTrail Check Tests"""

tests/providers/alibabacloud/services/actiontrail/actiontrail_trail_enabled/actiontrail_trail_enabled_test.py

@@ -0,0 +1,102 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_actiontrail_trail_enabled:
+    def test_no_trails(self):
+        actiontrail_client = mock.MagicMock
+        actiontrail_client.trails = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_enabled.actiontrail_trail_enabled.actiontrail_client",
+            new=actiontrail_client,
+        ):
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_enabled.actiontrail_trail_enabled import (
+                actiontrail_trail_enabled,
+            )
+
+            actiontrail_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+            check = actiontrail_trail_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "No enabled ActionTrail trails" in result[0].status_extended
+
+    def test_trail_disabled(self):
+        actiontrail_client = mock.MagicMock
+        trail_arn = f"acs:actiontrail::{ALIBABACLOUD_ACCOUNT_ID}:trail/test-trail"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_enabled.actiontrail_trail_enabled.actiontrail_client",
+            new=actiontrail_client,
+        ):
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_enabled.actiontrail_trail_enabled import (
+                actiontrail_trail_enabled,
+            )
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_service import (
+                Trail,
+            )
+
+            actiontrail_client.trails = {
+                trail_arn: Trail(
+                    name="test-trail",
+                    arn=trail_arn,
+                    region="global",
+                    status="Disabled",
+                )
+            }
+            actiontrail_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = actiontrail_trail_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "No enabled ActionTrail trails" in result[0].status_extended
+
+    def test_trail_enabled(self):
+        actiontrail_client = mock.MagicMock
+        trail_arn = f"acs:actiontrail::{ALIBABACLOUD_ACCOUNT_ID}:trail/test-trail"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_enabled.actiontrail_trail_enabled.actiontrail_client",
+            new=actiontrail_client,
+        ):
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_enabled.actiontrail_trail_enabled import (
+                actiontrail_trail_enabled,
+            )
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_service import (
+                Trail,
+            )
+
+            actiontrail_client.trails = {
+                trail_arn: Trail(
+                    name="test-trail",
+                    arn=trail_arn,
+                    region="global",
+                    status="Enabled",
+                )
+            }
+            actiontrail_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = actiontrail_trail_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "enabled trail(s)" in result[0].status_extended
+            assert "test-trail" in result[0].status_extended

tests/providers/alibabacloud/services/actiontrail/actiontrail_trail_logs_all_events/__init__.py

@@ -0,0 +1 @@
+"""ActionTrail Check Tests"""

tests/providers/alibabacloud/services/actiontrail/actiontrail_trail_logs_all_events/actiontrail_trail_logs_all_events_test.py

@@ -0,0 +1,99 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_actiontrail_trail_logs_all_events:
+    def test_no_trails(self):
+        actiontrail_client = mock.MagicMock
+        actiontrail_client.trails = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_logs_all_events.actiontrail_trail_logs_all_events.actiontrail_client",
+            new=actiontrail_client,
+        ):
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_logs_all_events.actiontrail_trail_logs_all_events import (
+                actiontrail_trail_logs_all_events,
+            )
+
+            check = actiontrail_trail_logs_all_events()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_trail_logs_only_write_events(self):
+        actiontrail_client = mock.MagicMock
+        trail_arn = f"acs:actiontrail::{ALIBABACLOUD_ACCOUNT_ID}:trail/test-trail"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_logs_all_events.actiontrail_trail_logs_all_events.actiontrail_client",
+            new=actiontrail_client,
+        ):
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_logs_all_events.actiontrail_trail_logs_all_events import (
+                actiontrail_trail_logs_all_events,
+            )
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_service import (
+                Trail,
+            )
+
+            actiontrail_client.trails = {
+                trail_arn: Trail(
+                    name="test-trail",
+                    arn=trail_arn,
+                    region="global",
+                    event_rw="Write",
+                )
+            }
+            actiontrail_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = actiontrail_trail_logs_all_events()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "test-trail"
+            assert "only logs Write events" in result[0].status_extended
+
+    def test_trail_logs_all_events(self):
+        actiontrail_client = mock.MagicMock
+        trail_arn = f"acs:actiontrail::{ALIBABACLOUD_ACCOUNT_ID}:trail/test-trail"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_logs_all_events.actiontrail_trail_logs_all_events.actiontrail_client",
+            new=actiontrail_client,
+        ):
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_trail_logs_all_events.actiontrail_trail_logs_all_events import (
+                actiontrail_trail_logs_all_events,
+            )
+            from prowler.providers.alibabacloud.services.actiontrail.actiontrail_service import (
+                Trail,
+            )
+
+            actiontrail_client.trails = {
+                trail_arn: Trail(
+                    name="test-trail",
+                    arn=trail_arn,
+                    region="global",
+                    event_rw="All",
+                )
+            }
+            actiontrail_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = actiontrail_trail_logs_all_events()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "test-trail"
+            assert "logs all events" in result[0].status_extended

tests/providers/alibabacloud/services/ecs/ecs_disk_encryption_enabled/ecs_disk_encryption_enabled_test.py

@@ -0,0 +1,114 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ecs_disk_encryption_enabled:
+    def test_no_disks(self):
+        ecs_client = mock.MagicMock
+        ecs_client.disks = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_disk_encryption_enabled.ecs_disk_encryption_enabled.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_disk_encryption_enabled.ecs_disk_encryption_enabled import (
+                ecs_disk_encryption_enabled,
+            )
+
+            check = ecs_disk_encryption_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_disk_encrypted(self):
+        ecs_client = mock.MagicMock
+        disk_id = "d-test123"
+        disk_arn = f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:disk/{disk_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_disk_encryption_enabled.ecs_disk_encryption_enabled.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_disk_encryption_enabled.ecs_disk_encryption_enabled import (
+                ecs_disk_encryption_enabled,
+            )
+            from prowler.providers.alibabacloud.services.ecs.ecs_service import Disk
+
+            ecs_client.disks = {
+                disk_arn: Disk(
+                    id=disk_id,
+                    name="test-disk",
+                    arn=disk_arn,
+                    region=ALIBABACLOUD_REGION,
+                    disk_type="data",
+                    category="cloud_essd",
+                    size=100,
+                    encrypted=True,
+                    kms_key_id="kms-key-123",
+                    status="In_use",
+                )
+            }
+            ecs_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ecs_disk_encryption_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == disk_id
+            assert result[0].resource_arn == disk_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+            assert "is encrypted" in result[0].status_extended
+            assert "kms-key-123" in result[0].status_extended
+
+    def test_disk_not_encrypted(self):
+        ecs_client = mock.MagicMock
+        disk_id = "d-test456"
+        disk_arn = f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:disk/{disk_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_disk_encryption_enabled.ecs_disk_encryption_enabled.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_disk_encryption_enabled.ecs_disk_encryption_enabled import (
+                ecs_disk_encryption_enabled,
+            )
+            from prowler.providers.alibabacloud.services.ecs.ecs_service import Disk
+
+            ecs_client.disks = {
+                disk_arn: Disk(
+                    id=disk_id,
+                    name="unencrypted-disk",
+                    arn=disk_arn,
+                    region=ALIBABACLOUD_REGION,
+                    disk_type="system",
+                    category="cloud_ssd",
+                    size=50,
+                    encrypted=False,
+                    status="In_use",
+                )
+            }
+            ecs_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ecs_disk_encryption_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == disk_id
+            assert result[0].resource_arn == disk_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+            assert "is not encrypted" in result[0].status_extended

tests/providers/alibabacloud/services/ecs/ecs_instance_public_ip/ecs_instance_public_ip_test.py

@@ -0,0 +1,113 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ecs_instance_public_ip:
+    def test_no_instances(self):
+        ecs_client = mock.MagicMock
+        ecs_client.instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_instance_public_ip.ecs_instance_public_ip.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_instance_public_ip.ecs_instance_public_ip import (
+                ecs_instance_public_ip,
+            )
+
+            check = ecs_instance_public_ip()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_instance_no_public_ip(self):
+        ecs_client = mock.MagicMock
+        instance_id = "i-test123"
+        instance_arn = (
+            f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:instance/{instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_instance_public_ip.ecs_instance_public_ip.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_instance_public_ip.ecs_instance_public_ip import (
+                ecs_instance_public_ip,
+            )
+            from prowler.providers.alibabacloud.services.ecs.ecs_service import (
+                Instance,
+            )
+
+            ecs_client.instances = {
+                instance_arn: Instance(
+                    id=instance_id,
+                    name="private-instance",
+                    arn=instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    status="Running",
+                    public_ip=None,
+                    private_ip="10.0.1.10",
+                )
+            }
+            ecs_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ecs_instance_public_ip()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == instance_id
+            assert "does not have a public IP" in result[0].status_extended
+
+    def test_instance_with_public_ip(self):
+        ecs_client = mock.MagicMock
+        instance_id = "i-test456"
+        instance_arn = (
+            f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:instance/{instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_instance_public_ip.ecs_instance_public_ip.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_instance_public_ip.ecs_instance_public_ip import (
+                ecs_instance_public_ip,
+            )
+            from prowler.providers.alibabacloud.services.ecs.ecs_service import (
+                Instance,
+            )
+
+            ecs_client.instances = {
+                instance_arn: Instance(
+                    id=instance_id,
+                    name="public-instance",
+                    arn=instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    status="Running",
+                    public_ip="203.0.113.1",
+                    private_ip="10.0.1.10",
+                )
+            }
+            ecs_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ecs_instance_public_ip()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == instance_id
+            assert "has a public IP address" in result[0].status_extended
+            assert "203.0.113.1" in result[0].status_extended

tests/providers/alibabacloud/services/ecs/ecs_instance_ssh_access_restricted/ecs_instance_ssh_access_restricted_test.py

@@ -0,0 +1,126 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ecs_instance_ssh_access_restricted:
+    def test_no_security_groups(self):
+        ecs_client = mock.MagicMock
+        ecs_client.security_groups = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_instance_ssh_access_restricted.ecs_instance_ssh_access_restricted.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_instance_ssh_access_restricted.ecs_instance_ssh_access_restricted import (
+                ecs_instance_ssh_access_restricted,
+            )
+
+            check = ecs_instance_ssh_access_restricted()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_ssh_access_restricted(self):
+        ecs_client = mock.MagicMock
+        sg_id = "sg-test123"
+        sg_arn = f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:security-group/{sg_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_instance_ssh_access_restricted.ecs_instance_ssh_access_restricted.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_instance_ssh_access_restricted.ecs_instance_ssh_access_restricted import (
+                ecs_instance_ssh_access_restricted,
+            )
+            from prowler.providers.alibabacloud.services.ecs.ecs_service import (
+                SecurityGroup,
+            )
+
+            ecs_client.security_groups = {
+                sg_arn: SecurityGroup(
+                    id=sg_id,
+                    name="restricted-sg",
+                    arn=sg_arn,
+                    region=ALIBABACLOUD_REGION,
+                    vpc_id="vpc-test123",
+                    description="Restricted security group",
+                    rules=[
+                        {
+                            "direction": "ingress",
+                            "protocol": "tcp",
+                            "port_range": "22/22",
+                            "source": "10.0.0.0/8",
+                        }
+                    ],
+                )
+            }
+            ecs_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ecs_instance_ssh_access_restricted()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == sg_id
+            assert result[0].resource_arn == sg_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+            assert "does not allow unrestricted SSH access" in result[0].status_extended
+
+    def test_ssh_access_unrestricted(self):
+        ecs_client = mock.MagicMock
+        sg_id = "sg-test456"
+        sg_arn = f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:security-group/{sg_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ecs.ecs_instance_ssh_access_restricted.ecs_instance_ssh_access_restricted.ecs_client",
+            new=ecs_client,
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_instance_ssh_access_restricted.ecs_instance_ssh_access_restricted import (
+                ecs_instance_ssh_access_restricted,
+            )
+            from prowler.providers.alibabacloud.services.ecs.ecs_service import (
+                SecurityGroup,
+            )
+
+            ecs_client.security_groups = {
+                sg_arn: SecurityGroup(
+                    id=sg_id,
+                    name="unrestricted-sg",
+                    arn=sg_arn,
+                    region=ALIBABACLOUD_REGION,
+                    vpc_id="vpc-test123",
+                    description="Unrestricted security group",
+                    rules=[
+                        {
+                            "direction": "ingress",
+                            "protocol": "tcp",
+                            "port_range": "22/22",
+                            "source": "0.0.0.0/0",
+                        }
+                    ],
+                )
+            }
+            ecs_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ecs_instance_ssh_access_restricted()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == sg_id
+            assert result[0].resource_arn == sg_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+            assert "allows unrestricted SSH access" in result[0].status_extended

tests/providers/alibabacloud/services/ecs/ecs_service_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+from unittest.mock import MagicMock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ECS_Service:
+    def test_ecs_service(self):
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ):
+            from prowler.providers.alibabacloud.services.ecs.ecs_service import (
+                Disk,
+                Instance,
+                SecurityGroup,
+            )
+
+            ecs_client = MagicMock()
+
+            # Mock instances
+            instance_id = "i-test123"
+            instance_arn = f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:instance/{instance_id}"
+
+            ecs_client.instances = {
+                instance_arn: Instance(
+                    id=instance_id,
+                    name="test-instance",
+                    arn=instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    status="Running",
+                    instance_type="ecs.t6-c1m1.large",
+                    public_ip="192.0.2.1",
+                    private_ip="10.0.1.10",
+                    security_groups=["sg-test123"],
+                    vpc_id="vpc-test123",
+                    zone_id=f"{ALIBABACLOUD_REGION}-a",
+                )
+            }
+
+            # Mock disks
+            disk_id = "d-test456"
+            disk_arn = f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:disk/{disk_id}"
+
+            ecs_client.disks = {
+                disk_arn: Disk(
+                    id=disk_id,
+                    name="test-disk",
+                    arn=disk_arn,
+                    region=ALIBABACLOUD_REGION,
+                    disk_type="data",
+                    category="cloud_essd",
+                    size=100,
+                    encrypted=True,
+                    kms_key_id="kms-key-123",
+                    status="In_use",
+                    instance_id=instance_id,
+                    zone_id=f"{ALIBABACLOUD_REGION}-a",
+                )
+            }
+
+            # Mock security groups
+            sg_id = "sg-test789"
+            sg_arn = f"acs:ecs:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:security-group/{sg_id}"
+
+            ecs_client.security_groups = {
+                sg_arn: SecurityGroup(
+                    id=sg_id,
+                    name="test-sg",
+                    arn=sg_arn,
+                    region=ALIBABACLOUD_REGION,
+                    vpc_id="vpc-test123",
+                    description="Test security group",
+                    rules=[
+                        {
+                            "direction": "ingress",
+                            "protocol": "tcp",
+                            "port_range": "22/22",
+                            "source": "10.0.0.0/8",
+                        }
+                    ],
+                )
+            }
+
+            # Assertions
+            assert len(ecs_client.instances) == 1
+            assert ecs_client.instances[instance_arn].id == instance_id
+            assert ecs_client.instances[instance_arn].name == "test-instance"
+            assert ecs_client.instances[instance_arn].region == ALIBABACLOUD_REGION
+            assert ecs_client.instances[instance_arn].status == "Running"
+            assert ecs_client.instances[instance_arn].public_ip == "192.0.2.1"
+
+            assert len(ecs_client.disks) == 1
+            assert ecs_client.disks[disk_arn].id == disk_id
+            assert ecs_client.disks[disk_arn].encrypted is True
+            assert ecs_client.disks[disk_arn].kms_key_id == "kms-key-123"
+
+            assert len(ecs_client.security_groups) == 1
+            assert ecs_client.security_groups[sg_arn].id == sg_id
+            assert ecs_client.security_groups[sg_arn].vpc_id == "vpc-test123"
+            assert len(ecs_client.security_groups[sg_arn].rules) == 1

tests/providers/alibabacloud/services/oss/oss_bucket_cors_not_overly_permissive/oss_bucket_cors_not_overly_permissive_test.py

@@ -0,0 +1,112 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_cors_not_overly_permissive:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_cors_not_overly_permissive.oss_bucket_cors_not_overly_permissive.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_cors_not_overly_permissive.oss_bucket_cors_not_overly_permissive import (
+                oss_bucket_cors_not_overly_permissive,
+            )
+
+            check = oss_bucket_cors_not_overly_permissive()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_cors_not_permissive(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-cors-safe"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_cors_not_overly_permissive.oss_bucket_cors_not_overly_permissive.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_cors_not_overly_permissive.oss_bucket_cors_not_overly_permissive import (
+                oss_bucket_cors_not_overly_permissive,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    cors_rules=[
+                        {
+                            "AllowedOrigin": ["https://example.com"],
+                            "AllowedMethod": ["GET"],
+                        }
+                    ],
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_cors_not_overly_permissive()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_cors_overly_permissive(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-cors-permissive"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_cors_not_overly_permissive.oss_bucket_cors_not_overly_permissive.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_cors_not_overly_permissive.oss_bucket_cors_not_overly_permissive import (
+                oss_bucket_cors_not_overly_permissive,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    cors_rules=[
+                        {
+                            "AllowedOrigin": ["*"],
+                            "AllowedMethod": ["GET", "POST", "PUT", "DELETE"],
+                        }
+                    ],
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_cors_not_overly_permissive()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/oss/oss_bucket_default_encryption_kms/oss_bucket_default_encryption_kms_test.py

@@ -0,0 +1,104 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_default_encryption_kms:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_default_encryption_kms.oss_bucket_default_encryption_kms.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_default_encryption_kms.oss_bucket_default_encryption_kms import (
+                oss_bucket_default_encryption_kms,
+            )
+
+            check = oss_bucket_default_encryption_kms()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_kms_encryption(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-kms"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_default_encryption_kms.oss_bucket_default_encryption_kms.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_default_encryption_kms.oss_bucket_default_encryption_kms import (
+                oss_bucket_default_encryption_kms,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    encryption_enabled=True,
+                    encryption_algorithm="KMS",
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_default_encryption_kms()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_aes256_encryption(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-aes256"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_default_encryption_kms.oss_bucket_default_encryption_kms.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_default_encryption_kms.oss_bucket_default_encryption_kms import (
+                oss_bucket_default_encryption_kms,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    encryption_enabled=True,
+                    encryption_algorithm="AES256",
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_default_encryption_kms()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/oss/oss_bucket_encryption_enabled/oss_bucket_encryption_enabled_test.py

@@ -0,0 +1,104 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_encryption_enabled:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_encryption_enabled.oss_bucket_encryption_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_encryption_enabled.oss_bucket_encryption_enabled import (
+                oss_bucket_encryption_enabled,
+            )
+
+            check = oss_bucket_encryption_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_encryption_enabled(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-encrypted"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_encryption_enabled.oss_bucket_encryption_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_encryption_enabled.oss_bucket_encryption_enabled import (
+                oss_bucket_encryption_enabled,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    encryption_enabled=True,
+                    encryption_algorithm="AES256",
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_encryption_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_encryption_disabled(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-unencrypted"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_encryption_enabled.oss_bucket_encryption_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_encryption_enabled.oss_bucket_encryption_enabled import (
+                oss_bucket_encryption_enabled,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    encryption_enabled=False,
+                    encryption_algorithm="",
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_encryption_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/oss/oss_bucket_lifecycle_rules/oss_bucket_lifecycle_rules_test.py

@@ -0,0 +1,109 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_lifecycle_rules:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_lifecycle_rules.oss_bucket_lifecycle_rules.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_lifecycle_rules.oss_bucket_lifecycle_rules import (
+                oss_bucket_lifecycle_rules,
+            )
+
+            check = oss_bucket_lifecycle_rules()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_has_lifecycle_rules(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-lifecycle"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_lifecycle_rules.oss_bucket_lifecycle_rules.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_lifecycle_rules.oss_bucket_lifecycle_rules import (
+                oss_bucket_lifecycle_rules,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    lifecycle_rules=[
+                        {
+                            "id": "rule1",
+                            "prefix": "logs/",
+                            "status": "Enabled",
+                            "expiration": {"days": 90}
+                        }
+                    ],
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_lifecycle_rules()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_no_lifecycle_rules(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-no-lifecycle"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_lifecycle_rules.oss_bucket_lifecycle_rules.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_lifecycle_rules.oss_bucket_lifecycle_rules import (
+                oss_bucket_lifecycle_rules,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    lifecycle_rules=[],
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_lifecycle_rules()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/oss/oss_bucket_logging_enabled/oss_bucket_logging_enabled_test.py

@@ -0,0 +1,104 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_logging_enabled:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_logging_enabled.oss_bucket_logging_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_logging_enabled.oss_bucket_logging_enabled import (
+                oss_bucket_logging_enabled,
+            )
+
+            check = oss_bucket_logging_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_logging_enabled(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-with-logging"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_logging_enabled.oss_bucket_logging_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_logging_enabled.oss_bucket_logging_enabled import (
+                oss_bucket_logging_enabled,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    logging_enabled=True,
+                    access_logging_target="logging-bucket",
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_logging_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_logging_disabled(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-no-logging"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_logging_enabled.oss_bucket_logging_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_logging_enabled.oss_bucket_logging_enabled import (
+                oss_bucket_logging_enabled,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    logging_enabled=False,
+                    access_logging_target="",
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_logging_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/oss/oss_bucket_public_access_blocked/oss_bucket_public_access_blocked_test.py

@@ -0,0 +1,102 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_public_access_blocked:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_public_access_blocked.oss_bucket_public_access_blocked.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_public_access_blocked.oss_bucket_public_access_blocked import (
+                oss_bucket_public_access_blocked,
+            )
+
+            check = oss_bucket_public_access_blocked()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_private_access(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-private"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_public_access_blocked.oss_bucket_public_access_blocked.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_public_access_blocked.oss_bucket_public_access_blocked import (
+                oss_bucket_public_access_blocked,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    public_access=False,
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_public_access_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_public_access(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-public"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_public_access_blocked.oss_bucket_public_access_blocked.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_public_access_blocked.oss_bucket_public_access_blocked import (
+                oss_bucket_public_access_blocked,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    public_access=True,
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_public_access_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/oss/oss_bucket_referer_whitelist/oss_bucket_referer_whitelist_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_referer_whitelist:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_referer_whitelist.oss_bucket_referer_whitelist.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_referer_whitelist.oss_bucket_referer_whitelist import (
+                oss_bucket_referer_whitelist,
+            )
+
+            check = oss_bucket_referer_whitelist()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_referer_whitelist_configured(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-referer"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_referer_whitelist.oss_bucket_referer_whitelist.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_referer_whitelist.oss_bucket_referer_whitelist import (
+                oss_bucket_referer_whitelist,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    referer_config={
+                        "AllowEmpty": False,
+                        "RefererList": ["https://example.com"]
+                    },
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_referer_whitelist()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_referer_whitelist_not_configured(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-no-referer"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_referer_whitelist.oss_bucket_referer_whitelist.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_referer_whitelist.oss_bucket_referer_whitelist import (
+                oss_bucket_referer_whitelist,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    referer_config={
+                        "AllowEmpty": True,
+                        "RefererList": []
+                    },
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_referer_whitelist()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/oss/oss_bucket_transfer_acceleration/oss_bucket_transfer_acceleration_test.py

@@ -0,0 +1,102 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_transfer_acceleration:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_transfer_acceleration.oss_bucket_transfer_acceleration.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_transfer_acceleration.oss_bucket_transfer_acceleration import (
+                oss_bucket_transfer_acceleration,
+            )
+
+            check = oss_bucket_transfer_acceleration()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_transfer_acceleration_enabled(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-acceleration"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_transfer_acceleration.oss_bucket_transfer_acceleration.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_transfer_acceleration.oss_bucket_transfer_acceleration import (
+                oss_bucket_transfer_acceleration,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    transfer_acceleration=True,
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_transfer_acceleration()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_transfer_acceleration_disabled(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-no-acceleration"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_transfer_acceleration.oss_bucket_transfer_acceleration.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_transfer_acceleration.oss_bucket_transfer_acceleration import (
+                oss_bucket_transfer_acceleration,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    transfer_acceleration=False,
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_transfer_acceleration()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/oss/oss_bucket_versioning_enabled/oss_bucket_versioning_enabled_test.py

@@ -0,0 +1,102 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_oss_bucket_versioning_enabled:
+    def test_no_buckets(self):
+        oss_client = mock.MagicMock
+        oss_client.buckets = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_versioning_enabled.oss_bucket_versioning_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_versioning_enabled.oss_bucket_versioning_enabled import (
+                oss_bucket_versioning_enabled,
+            )
+
+            check = oss_bucket_versioning_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_versioning_enabled(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-versioned"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_versioning_enabled.oss_bucket_versioning_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_versioning_enabled.oss_bucket_versioning_enabled import (
+                oss_bucket_versioning_enabled,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    versioning_enabled=True,
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_versioning_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION
+
+    def test_bucket_versioning_disabled(self):
+        oss_client = mock.MagicMock
+        bucket_name = "test-bucket-no-versioning"
+        bucket_arn = f"acs:oss:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:bucket/{bucket_name}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.oss.oss_bucket_versioning_enabled.oss_bucket_versioning_enabled.oss_client",
+            new=oss_client,
+        ):
+            from prowler.providers.alibabacloud.services.oss.oss_bucket_versioning_enabled.oss_bucket_versioning_enabled import (
+                oss_bucket_versioning_enabled,
+            )
+            from prowler.providers.alibabacloud.services.oss.oss_service import Bucket
+
+            oss_client.buckets = {
+                bucket_arn: Bucket(
+                    name=bucket_name,
+                    arn=bucket_arn,
+                    region=ALIBABACLOUD_REGION,
+                    creation_date="2023-01-01",
+                    versioning_enabled=False,
+                )
+            }
+            oss_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = oss_bucket_versioning_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == bucket_name
+            assert result[0].resource_arn == bucket_arn
+            assert result[0].region == ALIBABACLOUD_REGION

tests/providers/alibabacloud/services/ram/ram_access_key_rotation/ram_access_key_rotation_test.py

@@ -0,0 +1,110 @@
+from unittest import mock
+from datetime import datetime, timedelta
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_access_key_rotation:
+    def test_no_users(self):
+        ram_client = mock.MagicMock
+        ram_client.users = {{}}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_access_key_rotation.ram_access_key_rotation.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_access_key_rotation.ram_access_key_rotation import (
+                ram_access_key_rotation,
+            )
+
+            check = ram_access_key_rotation()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_access_key_rotated_recently(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-123"
+        user_arn = f"acs:ram::{{ALIBABACLOUD_ACCOUNT_ID}}:user/{{user_id}}"
+        recent_date = (datetime.now() - timedelta(days=30)).strftime("%Y-%m-%d")
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_access_key_rotation.ram_access_key_rotation.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_access_key_rotation.ram_access_key_rotation import (
+                ram_access_key_rotation,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User, AccessKey
+
+            ram_client.users = {{
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    access_keys=[
+                        AccessKey(
+                            access_key_id="LTAI_test",
+                            user_name="test-user",
+                            status="Active",
+                            create_date=recent_date,
+                        )
+                    ],
+                )
+            }}
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_access_key_rotation()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "PASS" for r in result)
+
+    def test_access_key_not_rotated(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-456"
+        user_arn = f"acs:ram::{{ALIBABACLOUD_ACCOUNT_ID}}:user/{{user_id}}"
+        old_date = (datetime.now() - timedelta(days=120)).strftime("%Y-%m-%d")
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_access_key_rotation.ram_access_key_rotation.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_access_key_rotation.ram_access_key_rotation import (
+                ram_access_key_rotation,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User, AccessKey
+
+            ram_client.users = {{
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    access_keys=[
+                        AccessKey(
+                            access_key_id="LTAI_old",
+                            user_name="test-user",
+                            status="Active",
+                            create_date=old_date,
+                        )
+                    ],
+                )
+            }}
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_access_key_rotation()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "FAIL" for r in result)

tests/providers/alibabacloud/services/ram/ram_inactive_users_disabled/ram_inactive_users_disabled_test.py

@@ -0,0 +1,96 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_inactive_users_disabled:
+    def test_no_users(self):
+        ram_client = mock.MagicMock
+        ram_client.users = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_inactive_users_disabled.ram_inactive_users_disabled.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_inactive_users_disabled.ram_inactive_users_disabled import (
+                ram_inactive_users_disabled,
+            )
+
+            check = ram_inactive_users_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_ram_inactive_users_disabled_pass(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-123"
+        user_arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_inactive_users_disabled.ram_inactive_users_disabled.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_inactive_users_disabled.ram_inactive_users_disabled import (
+                ram_inactive_users_disabled,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User
+
+            ram_client.users = {
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    console_login_enabled=True,
+                    last_login_date="2024-12-01",
+                )
+            }
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_inactive_users_disabled()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "PASS" for r in result)
+
+    def test_ram_inactive_users_disabled_fail(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-456"
+        user_arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_inactive_users_disabled.ram_inactive_users_disabled.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_inactive_users_disabled.ram_inactive_users_disabled import (
+                ram_inactive_users_disabled,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User
+
+            ram_client.users = {
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    console_login_enabled=True,
+                    last_login_date="2023-01-01",
+                )
+            }
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_inactive_users_disabled()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "FAIL" for r in result)

tests/providers/alibabacloud/services/ram/ram_no_admin_privileges/ram_no_admin_privileges_test.py

@@ -0,0 +1,96 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_no_admin_privileges:
+    def test_no_users(self):
+        ram_client = mock.MagicMock
+        ram_client.users = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_no_admin_privileges.ram_no_admin_privileges.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_no_admin_privileges.ram_no_admin_privileges import (
+                ram_no_admin_privileges,
+            )
+
+            check = ram_no_admin_privileges()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_ram_no_admin_privileges_pass(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-123"
+        user_arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_no_admin_privileges.ram_no_admin_privileges.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_no_admin_privileges.ram_no_admin_privileges import (
+                ram_no_admin_privileges,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User
+
+            ram_client.users = {
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    console_login_enabled=True,
+                    attached_policies=[],
+                )
+            }
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_no_admin_privileges()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "PASS" for r in result)
+
+    def test_ram_no_admin_privileges_fail(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-456"
+        user_arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_no_admin_privileges.ram_no_admin_privileges.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_no_admin_privileges.ram_no_admin_privileges import (
+                ram_no_admin_privileges,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User
+
+            ram_client.users = {
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    console_login_enabled=True,
+                    attached_policies=[{"PolicyName": "AdministratorAccess", "PolicyType": "System"}],
+                )
+            }
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_no_admin_privileges()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "FAIL" for r in result)

tests/providers/alibabacloud/services/ram/ram_password_expiration/ram_password_expiration_test.py

@@ -0,0 +1,88 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_password_expiration:
+    def test_no_password_policy(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.password_policy = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_expiration.ram_password_expiration.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_expiration.ram_password_expiration import (
+                ram_password_expiration,
+            )
+
+            check = ram_password_expiration()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+
+    def test_password_policy_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_expiration.ram_password_expiration.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_expiration.ram_password_expiration import (
+                ram_password_expiration,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                max_password_age=90,
+            )
+
+            check = ram_password_expiration()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "password-policy"
+            assert "password expiration" in result[0].status_extended.lower()
+
+    def test_password_policy_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_expiration.ram_password_expiration.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_expiration.ram_password_expiration import (
+                ram_password_expiration,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                max_password_age=0,
+            )
+
+            check = ram_password_expiration()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"

tests/providers/alibabacloud/services/ram/ram_password_minimum_length/ram_password_minimum_length_test.py

@@ -0,0 +1,88 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_password_minimum_length:
+    def test_no_password_policy(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.password_policy = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_minimum_length.ram_password_minimum_length.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_minimum_length.ram_password_minimum_length import (
+                ram_password_minimum_length,
+            )
+
+            check = ram_password_minimum_length()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+
+    def test_password_policy_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_minimum_length.ram_password_minimum_length.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_minimum_length.ram_password_minimum_length import (
+                ram_password_minimum_length,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                minimum_length=14,
+            )
+
+            check = ram_password_minimum_length()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "password-policy"
+            assert "14+" in result[0].status_extended.lower()
+
+    def test_password_policy_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_minimum_length.ram_password_minimum_length.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_minimum_length.ram_password_minimum_length import (
+                ram_password_minimum_length,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                minimum_length=8,
+            )
+
+            check = ram_password_minimum_length()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"

tests/providers/alibabacloud/services/ram/ram_password_require_lowercase/ram_password_require_lowercase_test.py

@@ -0,0 +1,88 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_password_require_lowercase:
+    def test_no_password_policy(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.password_policy = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_lowercase.ram_password_require_lowercase.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_lowercase.ram_password_require_lowercase import (
+                ram_password_require_lowercase,
+            )
+
+            check = ram_password_require_lowercase()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+
+    def test_password_policy_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_lowercase.ram_password_require_lowercase.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_lowercase.ram_password_require_lowercase import (
+                ram_password_require_lowercase,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                require_lowercase=True,
+            )
+
+            check = ram_password_require_lowercase()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "password-policy"
+            assert "lowercase" in result[0].status_extended.lower()
+
+    def test_password_policy_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_lowercase.ram_password_require_lowercase.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_lowercase.ram_password_require_lowercase import (
+                ram_password_require_lowercase,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                require_lowercase=False,
+            )
+
+            check = ram_password_require_lowercase()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"

tests/providers/alibabacloud/services/ram/ram_password_require_numbers/ram_password_require_numbers_test.py

@@ -0,0 +1,88 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_password_require_numbers:
+    def test_no_password_policy(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.password_policy = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_numbers.ram_password_require_numbers.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_numbers.ram_password_require_numbers import (
+                ram_password_require_numbers,
+            )
+
+            check = ram_password_require_numbers()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+
+    def test_password_policy_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_numbers.ram_password_require_numbers.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_numbers.ram_password_require_numbers import (
+                ram_password_require_numbers,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                require_numbers=True,
+            )
+
+            check = ram_password_require_numbers()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "password-policy"
+            assert "numbers" in result[0].status_extended.lower()
+
+    def test_password_policy_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_numbers.ram_password_require_numbers.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_numbers.ram_password_require_numbers import (
+                ram_password_require_numbers,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                require_numbers=False,
+            )
+
+            check = ram_password_require_numbers()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"

tests/providers/alibabacloud/services/ram/ram_password_require_symbols/ram_password_require_symbols_test.py

@@ -0,0 +1,88 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_password_require_symbols:
+    def test_no_password_policy(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.password_policy = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_symbols.ram_password_require_symbols.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_symbols.ram_password_require_symbols import (
+                ram_password_require_symbols,
+            )
+
+            check = ram_password_require_symbols()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+
+    def test_password_policy_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_symbols.ram_password_require_symbols.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_symbols.ram_password_require_symbols import (
+                ram_password_require_symbols,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                require_symbols=True,
+            )
+
+            check = ram_password_require_symbols()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "password-policy"
+            assert "symbols" in result[0].status_extended.lower()
+
+    def test_password_policy_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_symbols.ram_password_require_symbols.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_symbols.ram_password_require_symbols import (
+                ram_password_require_symbols,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                require_symbols=False,
+            )
+
+            check = ram_password_require_symbols()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"

tests/providers/alibabacloud/services/ram/ram_password_require_uppercase/ram_password_require_uppercase_test.py

@@ -0,0 +1,88 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_password_require_uppercase:
+    def test_no_password_policy(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.password_policy = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_uppercase.ram_password_require_uppercase.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_uppercase.ram_password_require_uppercase import (
+                ram_password_require_uppercase,
+            )
+
+            check = ram_password_require_uppercase()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+
+    def test_password_policy_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_uppercase.ram_password_require_uppercase.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_uppercase.ram_password_require_uppercase import (
+                ram_password_require_uppercase,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                require_uppercase=True,
+            )
+
+            check = ram_password_require_uppercase()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "password-policy"
+            assert "uppercase" in result[0].status_extended.lower()
+
+    def test_password_policy_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_require_uppercase.ram_password_require_uppercase.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_require_uppercase.ram_password_require_uppercase import (
+                ram_password_require_uppercase,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                require_uppercase=False,
+            )
+
+            check = ram_password_require_uppercase()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"

tests/providers/alibabacloud/services/ram/ram_password_retry_limits/ram_password_retry_limits_test.py

@@ -0,0 +1,88 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_password_retry_limits:
+    def test_no_password_policy(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.password_policy = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_retry_limits.ram_password_retry_limits.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_retry_limits.ram_password_retry_limits import (
+                ram_password_retry_limits,
+            )
+
+            check = ram_password_retry_limits()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+
+    def test_password_policy_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_retry_limits.ram_password_retry_limits.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_retry_limits.ram_password_retry_limits import (
+                ram_password_retry_limits,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                max_login_attempts=5,
+            )
+
+            check = ram_password_retry_limits()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "password-policy"
+            assert "login attempt limits" in result[0].status_extended.lower()
+
+    def test_password_policy_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_retry_limits.ram_password_retry_limits.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_retry_limits.ram_password_retry_limits import (
+                ram_password_retry_limits,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                max_login_attempts=10,
+            )
+
+            check = ram_password_retry_limits()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"

tests/providers/alibabacloud/services/ram/ram_password_reuse_prevention/ram_password_reuse_prevention_test.py

@@ -0,0 +1,88 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_password_reuse_prevention:
+    def test_no_password_policy(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.password_policy = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_reuse_prevention.ram_password_reuse_prevention.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_reuse_prevention.ram_password_reuse_prevention import (
+                ram_password_reuse_prevention,
+            )
+
+            check = ram_password_reuse_prevention()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+
+    def test_password_policy_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_reuse_prevention.ram_password_reuse_prevention.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_reuse_prevention.ram_password_reuse_prevention import (
+                ram_password_reuse_prevention,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                password_reuse_prevention=5,
+            )
+
+            check = ram_password_reuse_prevention()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "password-policy"
+            assert "password reuse prevention" in result[0].status_extended.lower()
+
+    def test_password_policy_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_password_reuse_prevention.ram_password_reuse_prevention.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_password_reuse_prevention.ram_password_reuse_prevention import (
+                ram_password_reuse_prevention,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import PasswordPolicy
+
+            ram_client.password_policy = PasswordPolicy(
+                password_reuse_prevention=0,
+            )
+
+            check = ram_password_reuse_prevention()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "password-policy"

tests/providers/alibabacloud/services/ram/ram_root_access_keys_absent/ram_root_access_keys_absent_test.py

@@ -0,0 +1,57 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_root_access_keys_absent:
+    def test_ram_root_access_keys_absent_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.root_has_access_keys = False
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_root_access_keys_absent.ram_root_access_keys_absent.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_root_access_keys_absent.ram_root_access_keys_absent import (
+                ram_root_access_keys_absent,
+            )
+
+            check = ram_root_access_keys_absent()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "root-account"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+            assert "access keys" in result[0].status_extended.lower()
+
+    def test_ram_root_access_keys_absent_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.root_has_access_keys = True
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_root_access_keys_absent.ram_root_access_keys_absent.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_root_access_keys_absent.ram_root_access_keys_absent import (
+                ram_root_access_keys_absent,
+            )
+
+            check = ram_root_access_keys_absent()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "root-account"

tests/providers/alibabacloud/services/ram/ram_root_mfa_enabled/ram_root_mfa_enabled_test.py

@@ -0,0 +1,57 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_root_mfa_enabled:
+    def test_ram_root_mfa_enabled_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.root_mfa_enabled = True
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_root_mfa_enabled.ram_root_mfa_enabled.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_root_mfa_enabled.ram_root_mfa_enabled import (
+                ram_root_mfa_enabled,
+            )
+
+            check = ram_root_mfa_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "root-account"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+            assert "MFA" in result[0].status_extended.lower()
+
+    def test_ram_root_mfa_enabled_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.root_mfa_enabled = False
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_root_mfa_enabled.ram_root_mfa_enabled.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_root_mfa_enabled.ram_root_mfa_enabled import (
+                ram_root_mfa_enabled,
+            )
+
+            check = ram_root_mfa_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "root-account"

tests/providers/alibabacloud/services/ram/ram_root_usage_minimized/ram_root_usage_minimized_test.py

@@ -0,0 +1,57 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_root_usage_minimized:
+    def test_ram_root_usage_minimized_pass(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.root_last_activity = None
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_root_usage_minimized.ram_root_usage_minimized.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_root_usage_minimized.ram_root_usage_minimized import (
+                ram_root_usage_minimized,
+            )
+
+            check = ram_root_usage_minimized()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "root-account"
+            assert result[0].account_uid == ALIBABACLOUD_ACCOUNT_ID
+            assert result[0].region == "global"
+            assert "usage" in result[0].status_extended.lower()
+
+    def test_ram_root_usage_minimized_fail(self):
+        ram_client = mock.MagicMock
+        ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+        ram_client.root_last_activity = "2024-01-01"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_root_usage_minimized.ram_root_usage_minimized.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_root_usage_minimized.ram_root_usage_minimized import (
+                ram_root_usage_minimized,
+            )
+
+            check = ram_root_usage_minimized()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "root-account"

tests/providers/alibabacloud/services/ram/ram_service_test.py

@@ -0,0 +1,90 @@
+from unittest.mock import patch
+from prowler.providers.alibabacloud.services.ram.ram_service import (
+    RAM,
+    User,
+    PasswordPolicy,
+    AccessKey,
+)
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_RAM_Service:
+    def test_service(self):
+        with patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ):
+            ram = RAM(set_mocked_alibabacloud_provider())
+
+            assert ram.service == "ram"
+            assert ram.account_id == ALIBABACLOUD_ACCOUNT_ID
+            assert ram.region == ALIBABACLOUD_REGION
+            assert len(ram.regions) > 0
+
+    def test_user_creation(self):
+        user_id = "test-user-123"
+        arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        user = User(
+            id=user_id,
+            name="test-user",
+            arn=arn,
+            console_login_enabled=True,
+            mfa_enabled=True,
+            access_keys=[
+                AccessKey(
+                    access_key_id="LTAI_test123",
+                    user_name="test-user",
+                    status="Active",
+                    create_date="2024-01-01",
+                )
+            ],
+        )
+
+        assert user.id == user_id
+        assert user.name == "test-user"
+        assert user.arn == arn
+        assert user.console_login_enabled is True
+        assert user.mfa_enabled is True
+        assert len(user.access_keys) == 1
+        assert user.access_keys[0].access_key_id == "LTAI_test123"
+
+    def test_password_policy_creation(self):
+        policy = PasswordPolicy(
+            minimum_length=14,
+            require_lowercase=True,
+            require_uppercase=True,
+            require_numbers=True,
+            require_symbols=True,
+            max_login_attempts=5,
+            max_password_age=90,
+            password_reuse_prevention=5,
+        )
+
+        assert policy.minimum_length == 14
+        assert policy.require_lowercase is True
+        assert policy.require_uppercase is True
+        assert policy.require_numbers is True
+        assert policy.require_symbols is True
+        assert policy.max_login_attempts == 5
+        assert policy.max_password_age == 90
+        assert policy.password_reuse_prevention == 5
+
+    def test_access_key_creation(self):
+        access_key = AccessKey(
+            access_key_id="LTAI_test",
+            user_name="test-user",
+            status="Active",
+            create_date="2024-01-01",
+            last_used_date="2024-12-01",
+        )
+
+        assert access_key.access_key_id == "LTAI_test"
+        assert access_key.user_name == "test-user"
+        assert access_key.status == "Active"
+        assert access_key.create_date == "2024-01-01"
+        assert access_key.last_used_date == "2024-12-01"

tests/providers/alibabacloud/services/ram/ram_user_mfa_enabled/ram_user_mfa_enabled_test.py

@@ -0,0 +1,96 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_user_mfa_enabled:
+    def test_no_users(self):
+        ram_client = mock.MagicMock
+        ram_client.users = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_user_mfa_enabled.ram_user_mfa_enabled.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_user_mfa_enabled.ram_user_mfa_enabled import (
+                ram_user_mfa_enabled,
+            )
+
+            check = ram_user_mfa_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_ram_user_mfa_enabled_pass(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-123"
+        user_arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_user_mfa_enabled.ram_user_mfa_enabled.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_user_mfa_enabled.ram_user_mfa_enabled import (
+                ram_user_mfa_enabled,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User
+
+            ram_client.users = {
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    console_login_enabled=True,
+                    mfa_enabled=True,
+                )
+            }
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_user_mfa_enabled()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "PASS" for r in result)
+
+    def test_ram_user_mfa_enabled_fail(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-456"
+        user_arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_user_mfa_enabled.ram_user_mfa_enabled.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_user_mfa_enabled.ram_user_mfa_enabled import (
+                ram_user_mfa_enabled,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User
+
+            ram_client.users = {
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    console_login_enabled=True,
+                    mfa_enabled=False,
+                )
+            }
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_user_mfa_enabled()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "FAIL" for r in result)

tests/providers/alibabacloud/services/ram/ram_user_policy_via_groups/ram_user_policy_via_groups_test.py

@@ -0,0 +1,96 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_ram_user_policy_via_groups:
+    def test_no_users(self):
+        ram_client = mock.MagicMock
+        ram_client.users = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_user_policy_via_groups.ram_user_policy_via_groups.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_user_policy_via_groups.ram_user_policy_via_groups import (
+                ram_user_policy_via_groups,
+            )
+
+            check = ram_user_policy_via_groups()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_ram_user_policy_via_groups_pass(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-123"
+        user_arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_user_policy_via_groups.ram_user_policy_via_groups.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_user_policy_via_groups.ram_user_policy_via_groups import (
+                ram_user_policy_via_groups,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User
+
+            ram_client.users = {
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    console_login_enabled=True,
+                    attached_policies=[],
+                )
+            }
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_user_policy_via_groups()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "PASS" for r in result)
+
+    def test_ram_user_policy_via_groups_fail(self):
+        ram_client = mock.MagicMock
+        user_id = "test-user-456"
+        user_arn = f"acs:ram::{ALIBABACLOUD_ACCOUNT_ID}:user/{user_id}"
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.ram.ram_user_policy_via_groups.ram_user_policy_via_groups.ram_client",
+            new=ram_client,
+        ):
+            from prowler.providers.alibabacloud.services.ram.ram_user_policy_via_groups.ram_user_policy_via_groups import (
+                ram_user_policy_via_groups,
+            )
+            from prowler.providers.alibabacloud.services.ram.ram_service import User
+
+            ram_client.users = {
+                user_arn: User(
+                    id=user_id,
+                    name="test-user",
+                    arn=user_arn,
+                    console_login_enabled=True,
+                    attached_policies=[{"PolicyName": "AdministratorAccess", "PolicyType": "System"}],
+                )
+            }
+            ram_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = ram_user_policy_via_groups()
+            result = check.execute()
+
+            assert len(result) >= 1
+            assert any(r.status == "FAIL" for r in result)

tests/providers/alibabacloud/services/rds/__init__.py

@@ -0,0 +1 @@
+"""RDS Service Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_audit_log/__init__.py

@@ -0,0 +1 @@
+"""RDS Check Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_audit_log/rds_instance_audit_log_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_rds_instance_audit_log:
+    def test_no_db_instances(self):
+        rds_client = mock.MagicMock
+        rds_client.db_instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_audit_log.rds_instance_audit_log.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_audit_log.rds_instance_audit_log import (
+                rds_instance_audit_log,
+            )
+
+            check = rds_instance_audit_log()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_db_instance_audit_log_enabled_pass(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test123"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_audit_log.rds_instance_audit_log.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_audit_log.rds_instance_audit_log import (
+                rds_instance_audit_log,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    audit_log_enabled=True,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_audit_log()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == db_instance_id
+            assert "has SQL audit logging enabled" in result[0].status_extended
+
+    def test_db_instance_audit_log_enabled_fail(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test456"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_audit_log.rds_instance_audit_log.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_audit_log.rds_instance_audit_log import (
+                rds_instance_audit_log,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    audit_log_enabled=False,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_audit_log()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == db_instance_id
+            assert "does not have SQL audit logging enabled" in result[0].status_extended

tests/providers/alibabacloud/services/rds/rds_instance_auto_minor_version_upgrade/__init__.py

@@ -0,0 +1 @@
+"""RDS Check Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_auto_minor_version_upgrade/rds_instance_auto_minor_version_upgrade_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_rds_instance_auto_minor_version_upgrade:
+    def test_no_db_instances(self):
+        rds_client = mock.MagicMock
+        rds_client.db_instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_auto_minor_version_upgrade.rds_instance_auto_minor_version_upgrade.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_auto_minor_version_upgrade.rds_instance_auto_minor_version_upgrade import (
+                rds_instance_auto_minor_version_upgrade,
+            )
+
+            check = rds_instance_auto_minor_version_upgrade()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_db_instance_auto_minor_version_upgrade_pass(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test123"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_auto_minor_version_upgrade.rds_instance_auto_minor_version_upgrade.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_auto_minor_version_upgrade.rds_instance_auto_minor_version_upgrade import (
+                rds_instance_auto_minor_version_upgrade,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    auto_minor_version_upgrade=True,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_auto_minor_version_upgrade()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == db_instance_id
+            assert "has automatic minor version upgrades enabled" in result[0].status_extended
+
+    def test_db_instance_auto_minor_version_upgrade_fail(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test456"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_auto_minor_version_upgrade.rds_instance_auto_minor_version_upgrade.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_auto_minor_version_upgrade.rds_instance_auto_minor_version_upgrade import (
+                rds_instance_auto_minor_version_upgrade,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    auto_minor_version_upgrade=False,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_auto_minor_version_upgrade()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == db_instance_id
+            assert "does not have automatic minor version upgrades enabled" in result[0].status_extended

tests/providers/alibabacloud/services/rds/rds_instance_backup_enabled/__init__.py

@@ -0,0 +1 @@
+"""RDS Check Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_backup_enabled/rds_instance_backup_enabled_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_rds_instance_backup_enabled:
+    def test_no_db_instances(self):
+        rds_client = mock.MagicMock
+        rds_client.db_instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_backup_enabled.rds_instance_backup_enabled.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_backup_enabled.rds_instance_backup_enabled import (
+                rds_instance_backup_enabled,
+            )
+
+            check = rds_instance_backup_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_db_instance_backup_enabled_pass(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test123"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_backup_enabled.rds_instance_backup_enabled.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_backup_enabled.rds_instance_backup_enabled import (
+                rds_instance_backup_enabled,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    backup_enabled=True,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_backup_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == db_instance_id
+            assert "has automated backups enabled" in result[0].status_extended
+
+    def test_db_instance_backup_enabled_fail(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test456"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_backup_enabled.rds_instance_backup_enabled.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_backup_enabled.rds_instance_backup_enabled import (
+                rds_instance_backup_enabled,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    backup_enabled=False,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_backup_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == db_instance_id
+            assert "does not have automated backups enabled" in result[0].status_extended

tests/providers/alibabacloud/services/rds/rds_instance_deletion_protection/__init__.py

@@ -0,0 +1 @@
+"""RDS Check Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_deletion_protection/rds_instance_deletion_protection_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_rds_instance_deletion_protection:
+    def test_no_db_instances(self):
+        rds_client = mock.MagicMock
+        rds_client.db_instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_deletion_protection.rds_instance_deletion_protection.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_deletion_protection.rds_instance_deletion_protection import (
+                rds_instance_deletion_protection,
+            )
+
+            check = rds_instance_deletion_protection()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_db_instance_deletion_protection_pass(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test123"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_deletion_protection.rds_instance_deletion_protection.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_deletion_protection.rds_instance_deletion_protection import (
+                rds_instance_deletion_protection,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    deletion_protection=True,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_deletion_protection()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == db_instance_id
+            assert "has deletion protection enabled" in result[0].status_extended
+
+    def test_db_instance_deletion_protection_fail(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test456"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_deletion_protection.rds_instance_deletion_protection.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_deletion_protection.rds_instance_deletion_protection import (
+                rds_instance_deletion_protection,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    deletion_protection=False,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_deletion_protection()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == db_instance_id
+            assert "does not have deletion protection enabled" in result[0].status_extended

tests/providers/alibabacloud/services/rds/rds_instance_encryption/__init__.py

@@ -0,0 +1 @@
+"""RDS Check Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_encryption/rds_instance_encryption_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_rds_instance_encryption:
+    def test_no_db_instances(self):
+        rds_client = mock.MagicMock
+        rds_client.db_instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_encryption.rds_instance_encryption.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_encryption.rds_instance_encryption import (
+                rds_instance_encryption,
+            )
+
+            check = rds_instance_encryption()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_db_instance_encryption_enabled_pass(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test123"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_encryption.rds_instance_encryption.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_encryption.rds_instance_encryption import (
+                rds_instance_encryption,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    encryption_enabled=True,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_encryption()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == db_instance_id
+            assert "has Transparent Data Encryption (TDE) enabled" in result[0].status_extended
+
+    def test_db_instance_encryption_enabled_fail(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test456"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_encryption.rds_instance_encryption.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_encryption.rds_instance_encryption import (
+                rds_instance_encryption,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    encryption_enabled=False,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_encryption()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == db_instance_id
+            assert "does not have Transparent Data Encryption (TDE) enabled" in result[0].status_extended

tests/providers/alibabacloud/services/rds/rds_instance_in_vpc/__init__.py

@@ -0,0 +1 @@
+"""RDS Check Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_in_vpc/rds_instance_in_vpc_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_rds_instance_in_vpc:
+    def test_no_db_instances(self):
+        rds_client = mock.MagicMock
+        rds_client.db_instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_in_vpc.rds_instance_in_vpc.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_in_vpc.rds_instance_in_vpc import (
+                rds_instance_in_vpc,
+            )
+
+            check = rds_instance_in_vpc()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_db_instance_vpc_id_pass(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test123"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_in_vpc.rds_instance_in_vpc.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_in_vpc.rds_instance_in_vpc import (
+                rds_instance_in_vpc,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    vpc_id='vpc-test123',
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_in_vpc()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == db_instance_id
+            assert "is deployed in VPC" in result[0].status_extended
+
+    def test_db_instance_vpc_id_fail(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test456"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_in_vpc.rds_instance_in_vpc.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_in_vpc.rds_instance_in_vpc import (
+                rds_instance_in_vpc,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    vpc_id='',
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_in_vpc()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == db_instance_id
+            assert "is not deployed in a VPC" in result[0].status_extended

tests/providers/alibabacloud/services/rds/rds_instance_multi_az/__init__.py

@@ -0,0 +1 @@
+"""RDS Check Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_multi_az/rds_instance_multi_az_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_rds_instance_multi_az:
+    def test_no_db_instances(self):
+        rds_client = mock.MagicMock
+        rds_client.db_instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_multi_az.rds_instance_multi_az.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_multi_az.rds_instance_multi_az import (
+                rds_instance_multi_az,
+            )
+
+            check = rds_instance_multi_az()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_db_instance_multi_az_pass(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test123"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_multi_az.rds_instance_multi_az.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_multi_az.rds_instance_multi_az import (
+                rds_instance_multi_az,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    multi_az=True,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_multi_az()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == db_instance_id
+            assert "is deployed across multiple availability zones" in result[0].status_extended
+
+    def test_db_instance_multi_az_fail(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test456"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_multi_az.rds_instance_multi_az.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_multi_az.rds_instance_multi_az import (
+                rds_instance_multi_az,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    multi_az=False,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_multi_az()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == db_instance_id
+            assert "is not deployed across multiple availability zones" in result[0].status_extended

tests/providers/alibabacloud/services/rds/rds_instance_public_access/__init__.py

@@ -0,0 +1 @@
+"""RDS Check Tests"""

tests/providers/alibabacloud/services/rds/rds_instance_public_access/rds_instance_public_access_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from tests.providers.alibabacloud.alibabacloud_fixtures import (
+    ALIBABACLOUD_ACCOUNT_ID,
+    ALIBABACLOUD_REGION,
+    set_mocked_alibabacloud_provider,
+)
+
+
+class Test_rds_instance_public_access:
+    def test_no_db_instances(self):
+        rds_client = mock.MagicMock
+        rds_client.db_instances = {}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_public_access.rds_instance_public_access.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_public_access.rds_instance_public_access import (
+                rds_instance_public_access,
+            )
+
+            check = rds_instance_public_access()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_db_instance_public_access_pass(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test123"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_public_access.rds_instance_public_access.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_public_access.rds_instance_public_access import (
+                rds_instance_public_access,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    public_access=False,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_public_access()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == db_instance_id
+            assert "does not allow public access" in result[0].status_extended
+
+    def test_db_instance_public_access_fail(self):
+        rds_client = mock.MagicMock
+        db_instance_id = "rm-test456"
+        db_instance_arn = (
+            f"acs:rds:{ALIBABACLOUD_REGION}:{ALIBABACLOUD_ACCOUNT_ID}:dbinstance/{db_instance_id}"
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_alibabacloud_provider(),
+        ), mock.patch(
+            "prowler.providers.alibabacloud.services.rds.rds_instance_public_access.rds_instance_public_access.rds_client",
+            new=rds_client,
+        ):
+            from prowler.providers.alibabacloud.services.rds.rds_instance_public_access.rds_instance_public_access import (
+                rds_instance_public_access,
+            )
+            from prowler.providers.alibabacloud.services.rds.rds_service import (
+                DBInstance,
+            )
+
+            rds_client.db_instances = {
+                db_instance_arn: DBInstance(
+                    db_instance_id=db_instance_id,
+                    db_instance_name="test-db",
+                    arn=db_instance_arn,
+                    region=ALIBABACLOUD_REGION,
+                    public_access=True,
+                )
+            }
+            rds_client.account_id = ALIBABACLOUD_ACCOUNT_ID
+
+            check = rds_instance_public_access()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == db_instance_id
+            assert "allows public access" in result[0].status_extended