fix(inspector2): add more efficient way to check if any active findings (#4505)

prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.metadata.json

@@ -1,7 +1,7 @@
 {
   "Provider": "aws",
   "CheckID": "inspector2_active_findings_exist",
-  "CheckTitle": "Check if Inspector2 findings exist",
+  "CheckTitle": "Check if Inspector2 active findings exist",
   "CheckAliases": [
     "inspector2_findings_exist"
   ],
@@ -11,7 +11,7 @@
   "ResourceIdTemplate": "arn:aws:inspector2:region:account-id/detector-id",
   "Severity": "medium",
   "ResourceType": "Other",
-  "Description": "Check if Inspector2 findings exist",
+  "Description": "This check determines if there are any active findings in your AWS account that have been detected by AWS Inspector2. Inspector2 is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS.",
   "Risk": "Without using AWS Inspector, you may not be aware of all the security vulnerabilities in your AWS resources, which could lead to unauthorized access, data breaches, or other security incidents.",
   "RelatedUrl": "https://docs.aws.amazon.com/inspector/latest/user/findings-understanding.html",
   "Remediation": {

prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py

@@ -13,21 +13,13 @@ class inspector2_active_findings_exist(Check):
                 report.resource_id = inspector.id
                 report.resource_arn = inspector.arn
                 report.region = inspector.region
-                active_findings = 0
                 report.status = "PASS"
-                report.status_extended = "Inspector2 is enabled with no findings."
-                for finding in inspector.findings:
-                    if finding.status == "ACTIVE":
-                        active_findings += 1
-                if len(inspector.findings) > 0:
-                    report.status_extended = (
-                        "Inspector2 is enabled with no active findings."
-                    )
-                    if active_findings > 0:
-                        report.status = "FAIL"
-                        report.status_extended = (
-                            f"There are {active_findings} active Inspector2 findings."
-                        )
+                report.status_extended = (
+                    "Inspector2 is enabled with no active findings."
+                )
+                if inspector.active_findings:
+                    report.status = "FAIL"
+                    report.status_extended = "There are active Inspector2 findings."
                 findings.append(report)
 
         return findings

prowler/providers/aws/services/inspector2/inspector2_service.py

@@ -1,7 +1,6 @@
 from pydantic import BaseModel
 
 from prowler.lib.logger import logger
-from prowler.lib.scan_filters.scan_filters import is_resource_filtered
 from prowler.providers.aws.lib.service.service import AWSService
 
 
@@ -12,15 +11,15 @@ class Inspector2(AWSService):
         super().__init__(__class__.__name__, provider)
         self.inspectors = []
         self.__threading_call__(self.__batch_get_account_status__)
-        self.__list_findings__()
+        self.__threading_call__(self.__list_active_findings__, self.inspectors)
 
     def __batch_get_account_status__(self, regional_client):
         # We use this function to check if inspector2 is enabled
-        logger.info("Inspector2 - batch_get_account_status...")
+        logger.info("Inspector2 - Getting account status...")
         try:
-            batch_get_account_status = regional_client.batch_get_account_status()[
-                "accounts"
-            ][0]
+            batch_get_account_status = regional_client.batch_get_account_status(
+                accountIds=[self.audited_account]
+            )["accounts"][0]
             self.inspectors.append(
                 Inspector(
                     id="Inspector2",
@@ -34,54 +33,30 @@ class Inspector2(AWSService):
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
-    def __list_findings__(self):
-        logger.info("Inspector2 - listing findings...")
+    def __list_active_findings__(self, inspector):
+        logger.info("Inspector2 - Listing active findings...")
         try:
-            for inspector in self.inspectors:
-                try:
-                    regional_client = self.regional_clients[inspector.region]
-                    list_findings_paginator = regional_client.get_paginator(
-                        "list_findings"
-                    )
-                    for page in list_findings_paginator.paginate():
-                        for finding in page["findings"]:
-                            if not self.audit_resources or (
-                                is_resource_filtered(
-                                    finding["findingArn"], self.audit_resources
-                                )
-                            ):
-                                inspector.findings.append(
-                                    InspectorFinding(
-                                        arn=finding["findingArn"],
-                                        region=regional_client.region,
-                                        severity=finding.get("severity"),
-                                        status=finding.get("status"),
-                                        title=finding.get("title"),
-                                    )
-                                )
+            regional_client = self.regional_clients[inspector.region]
+            active_findings = regional_client.list_findings(
+                filterCriteria={
+                    "awsAccountId": [
+                        {"comparison": "EQUALS", "value": self.audited_account},
+                    ],
+                    "findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}],
+                },
+                maxResults=1,  # Retrieve only 1 finding to check for existence
+            )
+            inspector.active_findings = len(active_findings.get("findings")) > 0
 
-                except Exception as error:
-                    logger.error(
-                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                    )
-                    continue
         except Exception as error:
             logger.error(
-                f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
 
-class InspectorFinding(BaseModel):
-    arn: str
-    region: str
-    severity: str
-    status: str
-    title: str
-
-
 class Inspector(BaseModel):
     id: str
     arn: str
     region: str
     status: str
-    findings: list[InspectorFinding] = []
+    active_findings: bool = False

tests/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist_test.py

@@ -1,9 +1,6 @@
 from unittest import mock
 
-from prowler.providers.aws.services.inspector2.inspector2_service import (
-    Inspector,
-    InspectorFinding,
-)
+from prowler.providers.aws.services.inspector2.inspector2_service import Inspector
 from tests.providers.aws.utils import (
     AWS_ACCOUNT_NUMBER,
     AWS_REGION_EU_WEST_1,
@@ -32,7 +29,7 @@ class Test_inspector2_active_findings_exist:
                 arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
                 status="ENABLED",
                 region=AWS_REGION_EU_WEST_1,
-                findings=[],
+                active_findings=False,
             )
         ]
         aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
@@ -58,7 +55,7 @@ class Test_inspector2_active_findings_exist:
                 assert result[0].status == "PASS"
                 assert (
                     result[0].status_extended
-                    == "Inspector2 is enabled with no findings."
+                    == "Inspector2 is enabled with no active findings."
                 )
                 assert result[0].resource_id == AWS_ACCOUNT_NUMBER
                 assert (
@@ -83,15 +80,7 @@ class Test_inspector2_active_findings_exist:
                 arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
                 region=AWS_REGION_EU_WEST_1,
                 status="ENABLED",
-                findings=[
-                    InspectorFinding(
-                        arn=FINDING_ARN,
-                        region=AWS_REGION_EU_WEST_1,
-                        severity="MEDIUM",
-                        status="NOT_ACTIVE",
-                        title="CVE-2022-40897 - setuptools",
-                    )
-                ],
+                active_findings=False,
             )
         ]
         aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
@@ -142,15 +131,7 @@ class Test_inspector2_active_findings_exist:
                 arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
                 region=AWS_REGION_EU_WEST_1,
                 status="ENABLED",
-                findings=[
-                    InspectorFinding(
-                        arn=FINDING_ARN,
-                        region=AWS_REGION_EU_WEST_1,
-                        severity="MEDIUM",
-                        status="ACTIVE",
-                        title="CVE-2022-40897 - setuptools",
-                    )
-                ],
+                active_findings=True,
             )
         ]
         aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
@@ -175,74 +156,7 @@ class Test_inspector2_active_findings_exist:
                 assert len(result) == 1
                 assert result[0].status == "FAIL"
                 assert (
-                    result[0].status_extended
-                    == "There are 1 active Inspector2 findings."
-                )
-                assert result[0].resource_id == AWS_ACCOUNT_NUMBER
-                assert (
-                    result[0].resource_arn
-                    == f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2"
-                )
-                assert result[0].region == AWS_REGION_EU_WEST_1
-
-    def test_enabled_with_active_and_closed_findings(self):
-        # Mock the inspector2 client
-        inspector2_client = mock.MagicMock
-
-        inspector2_client.provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
-        inspector2_client.audited_account = AWS_ACCOUNT_NUMBER
-        inspector2_client.audited_account_arn = (
-            f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
-        )
-        inspector2_client.region = AWS_REGION_EU_WEST_1
-        inspector2_client.inspectors = [
-            Inspector(
-                id=AWS_ACCOUNT_NUMBER,
-                arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
-                region=AWS_REGION_EU_WEST_1,
-                status="ENABLED",
-                findings=[
-                    InspectorFinding(
-                        arn=FINDING_ARN,
-                        region=AWS_REGION_EU_WEST_1,
-                        severity="MEDIUM",
-                        status="ACTIVE",
-                        title="CVE-2022-40897 - setuptools",
-                    ),
-                    InspectorFinding(
-                        arn=FINDING_ARN,
-                        region=AWS_REGION_EU_WEST_1,
-                        severity="MEDIUM",
-                        status="CLOSED",
-                        title="CVE-2022-27404 - freetype",
-                    ),
-                ],
-            )
-        ]
-        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
-
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=aws_provider,
-        ):
-            with mock.patch(
-                "prowler.providers.aws.services.inspector2.inspector2_active_findings_exist.inspector2_active_findings_exist.inspector2_client",
-                new=inspector2_client,
-            ):
-
-                # Test Check
-                from prowler.providers.aws.services.inspector2.inspector2_active_findings_exist.inspector2_active_findings_exist import (
-                    inspector2_active_findings_exist,
-                )
-
-                check = inspector2_active_findings_exist()
-                result = check.execute()
-
-                assert len(result) == 1
-                assert result[0].status == "FAIL"
-                assert (
-                    result[0].status_extended
-                    == "There are 1 active Inspector2 findings."
+                    result[0].status_extended == "There are active Inspector2 findings."
                 )
                 assert result[0].resource_id == AWS_ACCOUNT_NUMBER
                 assert (
@@ -278,7 +192,7 @@ class Test_inspector2_active_findings_exist:
                 arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
                 status="DISABLED",
                 region=AWS_REGION_EU_WEST_1,
-                findings=[],
+                active_findings=False,
             )
         ]
         aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])

tests/providers/aws/services/inspector2/inspector2_service_test.py

@@ -105,14 +105,7 @@ class Test_Inspector2_Service:
         assert inspector2.inspectors[0].region == AWS_REGION_EU_WEST_1
         assert inspector2.inspectors[0].status == "ENABLED"
 
-    def test__list_findings__(self):
+    def test__list_active_findings__(self):
         aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
         inspector2 = Inspector2(aws_provider)
-        assert len(inspector2.inspectors[0].findings) == 1
-        assert inspector2.inspectors[0].findings[0].arn == FINDING_ARN
-        assert inspector2.inspectors[0].findings[0].region == AWS_REGION_EU_WEST_1
-        assert inspector2.inspectors[0].findings[0].severity == "MEDIUM"
-        assert inspector2.inspectors[0].findings[0].status == "ACTIVE"
-        assert (
-            inspector2.inspectors[0].findings[0].title == "CVE-2022-40897 - setuptools"
-        )
+        assert inspector2.inspectors[0].active_findings