mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 13:01:56 +00:00
fix(inspector2): add more efficient way to check if any active findings (#4505)
This commit is contained in:
Sergio Garcia
+2
-2
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "inspector2_active_findings_exist",
|
||||
"CheckTitle": "Check if Inspector2 findings exist",
|
||||
"CheckTitle": "Check if Inspector2 active findings exist",
|
||||
"CheckAliases": [
|
||||
"inspector2_findings_exist"
|
||||
],
|
||||
@@ -11,7 +11,7 @@
|
||||
"ResourceIdTemplate": "arn:aws:inspector2:region:account-id/detector-id",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Check if Inspector2 findings exist",
|
||||
"Description": "This check determines if there are any active findings in your AWS account that have been detected by AWS Inspector2. Inspector2 is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS.",
|
||||
"Risk": "Without using AWS Inspector, you may not be aware of all the security vulnerabilities in your AWS resources, which could lead to unauthorized access, data breaches, or other security incidents.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/inspector/latest/user/findings-understanding.html",
|
||||
"Remediation": {
|
||||
|
||||
+6
-14
@@ -13,21 +13,13 @@ class inspector2_active_findings_exist(Check):
|
||||
report.resource_id = inspector.id
|
||||
report.resource_arn = inspector.arn
|
||||
report.region = inspector.region
|
||||
active_findings = 0
|
||||
report.status = "PASS"
|
||||
report.status_extended = "Inspector2 is enabled with no findings."
|
||||
for finding in inspector.findings:
|
||||
if finding.status == "ACTIVE":
|
||||
active_findings += 1
|
||||
if len(inspector.findings) > 0:
|
||||
report.status_extended = (
|
||||
"Inspector2 is enabled with no active findings."
|
||||
)
|
||||
if active_findings > 0:
|
||||
report.status = "FAIL"
|
||||
report.status_extended = (
|
||||
f"There are {active_findings} active Inspector2 findings."
|
||||
)
|
||||
report.status_extended = (
|
||||
"Inspector2 is enabled with no active findings."
|
||||
)
|
||||
if inspector.active_findings:
|
||||
report.status = "FAIL"
|
||||
report.status_extended = "There are active Inspector2 findings."
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
from pydantic import BaseModel
|
||||
|
||||
from prowler.lib.logger import logger
|
||||
from prowler.lib.scan_filters.scan_filters import is_resource_filtered
|
||||
from prowler.providers.aws.lib.service.service import AWSService
|
||||
|
||||
|
||||
@@ -12,15 +11,15 @@ class Inspector2(AWSService):
|
||||
super().__init__(__class__.__name__, provider)
|
||||
self.inspectors = []
|
||||
self.__threading_call__(self.__batch_get_account_status__)
|
||||
self.__list_findings__()
|
||||
self.__threading_call__(self.__list_active_findings__, self.inspectors)
|
||||
|
||||
def __batch_get_account_status__(self, regional_client):
|
||||
# We use this function to check if inspector2 is enabled
|
||||
logger.info("Inspector2 - batch_get_account_status...")
|
||||
logger.info("Inspector2 - Getting account status...")
|
||||
try:
|
||||
batch_get_account_status = regional_client.batch_get_account_status()[
|
||||
"accounts"
|
||||
][0]
|
||||
batch_get_account_status = regional_client.batch_get_account_status(
|
||||
accountIds=[self.audited_account]
|
||||
)["accounts"][0]
|
||||
self.inspectors.append(
|
||||
Inspector(
|
||||
id="Inspector2",
|
||||
@@ -34,54 +33,30 @@ class Inspector2(AWSService):
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
|
||||
def __list_findings__(self):
|
||||
logger.info("Inspector2 - listing findings...")
|
||||
def __list_active_findings__(self, inspector):
|
||||
logger.info("Inspector2 - Listing active findings...")
|
||||
try:
|
||||
for inspector in self.inspectors:
|
||||
try:
|
||||
regional_client = self.regional_clients[inspector.region]
|
||||
list_findings_paginator = regional_client.get_paginator(
|
||||
"list_findings"
|
||||
)
|
||||
for page in list_findings_paginator.paginate():
|
||||
for finding in page["findings"]:
|
||||
if not self.audit_resources or (
|
||||
is_resource_filtered(
|
||||
finding["findingArn"], self.audit_resources
|
||||
)
|
||||
):
|
||||
inspector.findings.append(
|
||||
InspectorFinding(
|
||||
arn=finding["findingArn"],
|
||||
region=regional_client.region,
|
||||
severity=finding.get("severity"),
|
||||
status=finding.get("status"),
|
||||
title=finding.get("title"),
|
||||
)
|
||||
)
|
||||
regional_client = self.regional_clients[inspector.region]
|
||||
active_findings = regional_client.list_findings(
|
||||
filterCriteria={
|
||||
"awsAccountId": [
|
||||
{"comparison": "EQUALS", "value": self.audited_account},
|
||||
],
|
||||
"findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}],
|
||||
},
|
||||
maxResults=1, # Retrieve only 1 finding to check for existence
|
||||
)
|
||||
inspector.active_findings = len(active_findings.get("findings")) > 0
|
||||
|
||||
except Exception as error:
|
||||
logger.error(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
continue
|
||||
except Exception as error:
|
||||
logger.error(
|
||||
f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
|
||||
|
||||
class InspectorFinding(BaseModel):
|
||||
arn: str
|
||||
region: str
|
||||
severity: str
|
||||
status: str
|
||||
title: str
|
||||
|
||||
|
||||
class Inspector(BaseModel):
|
||||
id: str
|
||||
arn: str
|
||||
region: str
|
||||
status: str
|
||||
findings: list[InspectorFinding] = []
|
||||
active_findings: bool = False
|
||||
|
||||
+7
-93
@@ -1,9 +1,6 @@
|
||||
from unittest import mock
|
||||
|
||||
from prowler.providers.aws.services.inspector2.inspector2_service import (
|
||||
Inspector,
|
||||
InspectorFinding,
|
||||
)
|
||||
from prowler.providers.aws.services.inspector2.inspector2_service import Inspector
|
||||
from tests.providers.aws.utils import (
|
||||
AWS_ACCOUNT_NUMBER,
|
||||
AWS_REGION_EU_WEST_1,
|
||||
@@ -32,7 +29,7 @@ class Test_inspector2_active_findings_exist:
|
||||
arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
|
||||
status="ENABLED",
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
findings=[],
|
||||
active_findings=False,
|
||||
)
|
||||
]
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
@@ -58,7 +55,7 @@ class Test_inspector2_active_findings_exist:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Inspector2 is enabled with no findings."
|
||||
== "Inspector2 is enabled with no active findings."
|
||||
)
|
||||
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
|
||||
assert (
|
||||
@@ -83,15 +80,7 @@ class Test_inspector2_active_findings_exist:
|
||||
arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
status="ENABLED",
|
||||
findings=[
|
||||
InspectorFinding(
|
||||
arn=FINDING_ARN,
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
severity="MEDIUM",
|
||||
status="NOT_ACTIVE",
|
||||
title="CVE-2022-40897 - setuptools",
|
||||
)
|
||||
],
|
||||
active_findings=False,
|
||||
)
|
||||
]
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
@@ -142,15 +131,7 @@ class Test_inspector2_active_findings_exist:
|
||||
arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
status="ENABLED",
|
||||
findings=[
|
||||
InspectorFinding(
|
||||
arn=FINDING_ARN,
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
severity="MEDIUM",
|
||||
status="ACTIVE",
|
||||
title="CVE-2022-40897 - setuptools",
|
||||
)
|
||||
],
|
||||
active_findings=True,
|
||||
)
|
||||
]
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
@@ -175,74 +156,7 @@ class Test_inspector2_active_findings_exist:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "There are 1 active Inspector2 findings."
|
||||
)
|
||||
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
|
||||
assert (
|
||||
result[0].resource_arn
|
||||
== f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2"
|
||||
)
|
||||
assert result[0].region == AWS_REGION_EU_WEST_1
|
||||
|
||||
def test_enabled_with_active_and_closed_findings(self):
|
||||
# Mock the inspector2 client
|
||||
inspector2_client = mock.MagicMock
|
||||
|
||||
inspector2_client.provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
inspector2_client.audited_account = AWS_ACCOUNT_NUMBER
|
||||
inspector2_client.audited_account_arn = (
|
||||
f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
|
||||
)
|
||||
inspector2_client.region = AWS_REGION_EU_WEST_1
|
||||
inspector2_client.inspectors = [
|
||||
Inspector(
|
||||
id=AWS_ACCOUNT_NUMBER,
|
||||
arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
status="ENABLED",
|
||||
findings=[
|
||||
InspectorFinding(
|
||||
arn=FINDING_ARN,
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
severity="MEDIUM",
|
||||
status="ACTIVE",
|
||||
title="CVE-2022-40897 - setuptools",
|
||||
),
|
||||
InspectorFinding(
|
||||
arn=FINDING_ARN,
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
severity="MEDIUM",
|
||||
status="CLOSED",
|
||||
title="CVE-2022-27404 - freetype",
|
||||
),
|
||||
],
|
||||
)
|
||||
]
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
return_value=aws_provider,
|
||||
):
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.services.inspector2.inspector2_active_findings_exist.inspector2_active_findings_exist.inspector2_client",
|
||||
new=inspector2_client,
|
||||
):
|
||||
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.inspector2.inspector2_active_findings_exist.inspector2_active_findings_exist import (
|
||||
inspector2_active_findings_exist,
|
||||
)
|
||||
|
||||
check = inspector2_active_findings_exist()
|
||||
result = check.execute()
|
||||
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "There are 1 active Inspector2 findings."
|
||||
result[0].status_extended == "There are active Inspector2 findings."
|
||||
)
|
||||
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
|
||||
assert (
|
||||
@@ -278,7 +192,7 @@ class Test_inspector2_active_findings_exist:
|
||||
arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
|
||||
status="DISABLED",
|
||||
region=AWS_REGION_EU_WEST_1,
|
||||
findings=[],
|
||||
active_findings=False,
|
||||
)
|
||||
]
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
|
||||
@@ -105,14 +105,7 @@ class Test_Inspector2_Service:
|
||||
assert inspector2.inspectors[0].region == AWS_REGION_EU_WEST_1
|
||||
assert inspector2.inspectors[0].status == "ENABLED"
|
||||
|
||||
def test__list_findings__(self):
|
||||
def test__list_active_findings__(self):
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
inspector2 = Inspector2(aws_provider)
|
||||
assert len(inspector2.inspectors[0].findings) == 1
|
||||
assert inspector2.inspectors[0].findings[0].arn == FINDING_ARN
|
||||
assert inspector2.inspectors[0].findings[0].region == AWS_REGION_EU_WEST_1
|
||||
assert inspector2.inspectors[0].findings[0].severity == "MEDIUM"
|
||||
assert inspector2.inspectors[0].findings[0].status == "ACTIVE"
|
||||
assert (
|
||||
inspector2.inspectors[0].findings[0].title == "CVE-2022-40897 - setuptools"
|
||||
)
|
||||
assert inspector2.inspectors[0].active_findings
|
||||
|
||||
Reference in New Issue
Block a user