From 5a50b5d38fec1a8ae1b0d0188b18762f2c4e15ef Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Wed, 25 Jun 2025 18:26:14 +0200 Subject: [PATCH] fix(aws): fix logic in VPC and ELBv2 checks (#8092) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: crr <42739372+55002ghals@users.noreply.github.com> Co-authored-by: Sergio Garcia Co-authored-by: César Arroba <19954079+cesararroba@users.noreply.github.com> --- .../elbv2_desync_mitigation_mode.py | 2 +- .../vpc_endpoint_multi_az_enabled.py | 4 ++-- .../vpc_endpoint_multi_az_enabled_test.py | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py b/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py index e0212c133e..a80b20d524 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py +++ b/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py @@ -12,7 +12,7 @@ class elbv2_desync_mitigation_mode(Check): report.status_extended = f"ELBv2 ALB {lb.name} is configured with correct desync mitigation mode." if ( lb.desync_mitigation_mode != "strictest" - or lb.desync_mitigation_mode != "defensive" + and lb.desync_mitigation_mode != "defensive" ): if lb.drop_invalid_header_fields == "false": report.status = "FAIL" diff --git a/prowler/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled.py b/prowler/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled.py index 2a79594172..203522c274 100644 --- a/prowler/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled.py +++ b/prowler/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled.py @@ -9,10 +9,10 @@ class vpc_endpoint_multi_az_enabled(Check): if endpoint.vpc_id in vpc_client.vpcs and endpoint.type == "Interface": report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint) report.status = "FAIL" - report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} has subnets in different AZs." + report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} does not have subnets in different AZs." if len(endpoint.subnet_ids) > 1: report.status = "PASS" - report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} does not have subnets in different AZs." + report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} has subnets in different AZs." findings.append(report) diff --git a/tests/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled_test.py b/tests/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled_test.py index 9a2e0f2b1b..61e40de6c0 100644 --- a/tests/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled_test.py +++ b/tests/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled_test.py @@ -87,7 +87,7 @@ class Test_vpc_endpoint_for_multi_az: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"VPC Endpoint {vpc_endpoint['VpcEndpointId']} in VPC {vpc['VpcId']} has subnets in different AZs." + == f"VPC Endpoint {vpc_endpoint['VpcEndpointId']} in VPC {vpc['VpcId']} does not have subnets in different AZs." ) assert ( result[0].resource_arn @@ -158,7 +158,7 @@ class Test_vpc_endpoint_for_multi_az: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"VPC Endpoint {vpc_endpoint['VpcEndpointId']} in VPC {vpc['VpcId']} does not have subnets in different AZs." + == f"VPC Endpoint {vpc_endpoint['VpcEndpointId']} in VPC {vpc['VpcId']} has subnets in different AZs." ) assert ( result[0].resource_arn