From 5afc54e27a3d27b13881abe79b305fe1a2866879 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Mon, 30 Mar 2026 08:50:05 +0200 Subject: [PATCH] fix(oci): Add multi region filtering argument support (#10505) Co-authored-by: rchotacode <32524742+rchotacode@users.noreply.github.com> Co-authored-by: Ronan Chota Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + prowler/providers/common/provider.py | 2 +- .../oraclecloud/lib/arguments/arguments.py | 5 +- .../oraclecloud/oraclecloud_provider.py | 94 +++++++++---------- 4 files changed, 51 insertions(+), 51 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 6ba9b64168..d1058d8b95 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -11,6 +11,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Oracle Cloud password policy checks now exclude immutable system-managed policies (`SimplePasswordPolicy`, `StandardPasswordPolicy`) to avoid false positives [(#10453)](https://github.com/prowler-cloud/prowler/pull/10453) - Oracle Cloud `kms_key_rotation_enabled` now checks current key version age to avoid false positives on vaults without auto-rotation support [(#10450)](https://github.com/prowler-cloud/prowler/pull/10450) - Oracle Cloud patch for filestorage, blockstorage, kms, and compute services in OCI to allow for region scanning outside home [(#10455)](https://github.com/prowler-cloud/prowler/pull/10472) +- Oracle cloud provider now supports multi-region filtering [(#10435)](https://github.com/prowler-cloud/prowler/pull/10473) --- diff --git a/prowler/providers/common/provider.py b/prowler/providers/common/provider.py index c47c268566..a348a70b07 100644 --- a/prowler/providers/common/provider.py +++ b/prowler/providers/common/provider.py @@ -321,7 +321,7 @@ class Provider(ABC): provider_class( oci_config_file=arguments.oci_config_file, profile=arguments.profile, - region=arguments.region, + region=set(arguments.region) if arguments.region else None, compartment_ids=arguments.compartment_id, config_path=arguments.config_file, mutelist_path=arguments.mutelist_file, diff --git a/prowler/providers/oraclecloud/lib/arguments/arguments.py b/prowler/providers/oraclecloud/lib/arguments/arguments.py index 66971d0a58..a736b7a1af 100644 --- a/prowler/providers/oraclecloud/lib/arguments/arguments.py +++ b/prowler/providers/oraclecloud/lib/arguments/arguments.py @@ -44,8 +44,9 @@ def init_parser(self): oci_regions_subparser = oci_parser.add_argument_group("OCI Regions") oci_regions_subparser.add_argument( "--region", - "-r", - nargs="?", + "--filter-region", + "-f", + nargs="+", help="OCI region to run Prowler against. If not specified, all subscribed regions will be audited", choices=list(OCI_REGIONS.keys()), ) diff --git a/prowler/providers/oraclecloud/oraclecloud_provider.py b/prowler/providers/oraclecloud/oraclecloud_provider.py index 3ff83e7c22..1fbb10483a 100644 --- a/prowler/providers/oraclecloud/oraclecloud_provider.py +++ b/prowler/providers/oraclecloud/oraclecloud_provider.py @@ -62,7 +62,7 @@ class OraclecloudProvider(Provider): _identity: OCIIdentityInfo _session: OCISession _audit_config: dict - _regions: list = [] + _regions: set = set() _compartments: list = [] _mutelist: OCIMutelist audit_metadata: Audit_Metadata @@ -71,7 +71,7 @@ class OraclecloudProvider(Provider): self, oci_config_file: str = None, profile: str = None, - region: str = None, + region: set = set(), compartment_ids: list = None, config_path: str = None, config_content: dict = None, @@ -92,7 +92,7 @@ class OraclecloudProvider(Provider): Args: - oci_config_file: The path to the OCI config file. - profile: The name of the OCI CLI profile to use. - - region: The OCI region to audit. + - region: The OCI region(s) to audit. - compartment_ids: A list of compartment OCIDs to audit. - config_path: The path to the Prowler configuration file. - config_content: The content of the configuration file. @@ -127,6 +127,11 @@ class OraclecloudProvider(Provider): logger.info("Initializing OCI provider ...") + # Check if the configuration is scanning a single region + single_region = None + if region: + single_region = list(region)[0] if len(region) == 1 else None + # Setup OCI Session logger.info("Setting up OCI session ...") self._session = self.setup_session( @@ -138,7 +143,7 @@ class OraclecloudProvider(Provider): key_file=key_file, key_content=key_content, tenancy=tenancy, - region=region, + region=single_region, pass_phrase=pass_phrase, ) @@ -148,7 +153,7 @@ class OraclecloudProvider(Provider): logger.info("Validating OCI credentials ...") self._identity = self.set_identity( session=self._session, - region=region, + region=single_region, compartment_ids=compartment_ids, ) logger.info("OCI credentials validated") @@ -531,47 +536,42 @@ class OraclecloudProvider(Provider): return True - def get_regions_to_audit(self, region: str = None) -> list: + def get_regions_to_audit(self, region_set: set = None) -> list: """ get_regions_to_audit returns the list of regions to audit. Args: - - region: The OCI region to audit. + - region: The OCI region(s) to audit. Returns: - list: The list of OCIRegion objects to audit. """ regions = [] - if region: - # Audit specific region - if region in OCI_REGIONS: - regions.append( - OCIRegion( - key=region, - name=OCI_REGIONS[region], - is_home_region=True, - ) + # Audit all subscribed regions + try: + # Create identity client with proper authentication handling + if self._session.signer: + identity_client = oci.identity.IdentityClient( + config=self._session.config, signer=self._session.signer ) else: - logger.warning(f"Invalid region: {region}. Using default region.") - else: - # Audit all subscribed regions - try: - # Create identity client with proper authentication handling - if self._session.signer: - identity_client = oci.identity.IdentityClient( - config=self._session.config, signer=self._session.signer - ) - else: - identity_client = oci.identity.IdentityClient( - config=self._session.config - ) - region_subscriptions = identity_client.list_region_subscriptions( - self._identity.tenancy_id - ).data + identity_client = oci.identity.IdentityClient( + config=self._session.config + ) + region_subscriptions = identity_client.list_region_subscriptions( + self._identity.tenancy_id + ).data - for region_sub in region_subscriptions: + # Check if auditing specific region or all + regions_check = ( + region_set + if region_set + else [sub.region_name for sub in region_subscriptions] + ) + + for region_sub in region_subscriptions: + if region_sub.region_name in regions_check: regions.append( OCIRegion( key=region_sub.region_name, @@ -581,22 +581,20 @@ class OraclecloudProvider(Provider): is_home_region=region_sub.is_home_region, ) ) - - logger.info(f"Found {len(regions)} subscribed regions") - - except Exception as error: - logger.warning( - f"Could not retrieve region subscriptions: {error}. Using configured region." - ) - # Fallback to configured region - config_region = self._session.config.get("region", "us-ashburn-1") - regions.append( - OCIRegion( - key=config_region, - name=OCI_REGIONS.get(config_region, config_region), - is_home_region=True, - ) + logger.info(f"Found {len(regions)} subscribed regions") + except Exception as error: + logger.warning( + f"Could not retrieve region subscriptions: {error}. Using configured region." + ) + # Fallback to configured region + config_region = self._session.config.get("region", "us-ashburn-1") + regions.append( + OCIRegion( + key=config_region, + name=OCI_REGIONS.get(config_region, config_region), + is_home_region=True, ) + ) return regions