diff --git a/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.metadata.json b/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.metadata.json index cc50df3f93..d6805dba8d 100644 --- a/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.metadata.json +++ b/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.metadata.json @@ -1,7 +1,7 @@ { "Provider": "aws", "CheckID": "inspector2_active_findings_exist", - "CheckTitle": "Check if Inspector2 findings exist", + "CheckTitle": "Check if Inspector2 active findings exist", "CheckAliases": [ "inspector2_findings_exist" ], @@ -11,7 +11,7 @@ "ResourceIdTemplate": "arn:aws:inspector2:region:account-id/detector-id", "Severity": "medium", "ResourceType": "Other", - "Description": "Check if Inspector2 findings exist", + "Description": "This check determines if there are any active findings in your AWS account that have been detected by AWS Inspector2. Inspector2 is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS.", "Risk": "Without using AWS Inspector, you may not be aware of all the security vulnerabilities in your AWS resources, which could lead to unauthorized access, data breaches, or other security incidents.", "RelatedUrl": "https://docs.aws.amazon.com/inspector/latest/user/findings-understanding.html", "Remediation": { diff --git a/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py b/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py index b398ab208a..5a4b524188 100644 --- a/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py +++ b/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py @@ -13,21 +13,13 @@ class inspector2_active_findings_exist(Check): report.resource_id = inspector.id report.resource_arn = inspector.arn report.region = inspector.region - active_findings = 0 report.status = "PASS" - report.status_extended = "Inspector2 is enabled with no findings." - for finding in inspector.findings: - if finding.status == "ACTIVE": - active_findings += 1 - if len(inspector.findings) > 0: - report.status_extended = ( - "Inspector2 is enabled with no active findings." - ) - if active_findings > 0: - report.status = "FAIL" - report.status_extended = ( - f"There are {active_findings} active Inspector2 findings." - ) + report.status_extended = ( + "Inspector2 is enabled with no active findings." + ) + if inspector.active_findings: + report.status = "FAIL" + report.status_extended = "There are active Inspector2 findings." findings.append(report) return findings diff --git a/prowler/providers/aws/services/inspector2/inspector2_service.py b/prowler/providers/aws/services/inspector2/inspector2_service.py index d8d3485ac1..cd44dd6b1f 100644 --- a/prowler/providers/aws/services/inspector2/inspector2_service.py +++ b/prowler/providers/aws/services/inspector2/inspector2_service.py @@ -1,7 +1,6 @@ from pydantic import BaseModel from prowler.lib.logger import logger -from prowler.lib.scan_filters.scan_filters import is_resource_filtered from prowler.providers.aws.lib.service.service import AWSService @@ -12,15 +11,15 @@ class Inspector2(AWSService): super().__init__(__class__.__name__, provider) self.inspectors = [] self.__threading_call__(self.__batch_get_account_status__) - self.__list_findings__() + self.__threading_call__(self.__list_active_findings__, self.inspectors) def __batch_get_account_status__(self, regional_client): # We use this function to check if inspector2 is enabled - logger.info("Inspector2 - batch_get_account_status...") + logger.info("Inspector2 - Getting account status...") try: - batch_get_account_status = regional_client.batch_get_account_status()[ - "accounts" - ][0] + batch_get_account_status = regional_client.batch_get_account_status( + accountIds=[self.audited_account] + )["accounts"][0] self.inspectors.append( Inspector( id="Inspector2", @@ -34,54 +33,30 @@ class Inspector2(AWSService): f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) - def __list_findings__(self): - logger.info("Inspector2 - listing findings...") + def __list_active_findings__(self, inspector): + logger.info("Inspector2 - Listing active findings...") try: - for inspector in self.inspectors: - try: - regional_client = self.regional_clients[inspector.region] - list_findings_paginator = regional_client.get_paginator( - "list_findings" - ) - for page in list_findings_paginator.paginate(): - for finding in page["findings"]: - if not self.audit_resources or ( - is_resource_filtered( - finding["findingArn"], self.audit_resources - ) - ): - inspector.findings.append( - InspectorFinding( - arn=finding["findingArn"], - region=regional_client.region, - severity=finding.get("severity"), - status=finding.get("status"), - title=finding.get("title"), - ) - ) + regional_client = self.regional_clients[inspector.region] + active_findings = regional_client.list_findings( + filterCriteria={ + "awsAccountId": [ + {"comparison": "EQUALS", "value": self.audited_account}, + ], + "findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}], + }, + maxResults=1, # Retrieve only 1 finding to check for existence + ) + inspector.active_findings = len(active_findings.get("findings")) > 0 - except Exception as error: - logger.error( - f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" - ) - continue except Exception as error: logger.error( - f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}" + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) -class InspectorFinding(BaseModel): - arn: str - region: str - severity: str - status: str - title: str - - class Inspector(BaseModel): id: str arn: str region: str status: str - findings: list[InspectorFinding] = [] + active_findings: bool = False diff --git a/tests/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist_test.py b/tests/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist_test.py index 93cfa02f54..093f29d7a2 100644 --- a/tests/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist_test.py +++ b/tests/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist_test.py @@ -1,9 +1,6 @@ from unittest import mock -from prowler.providers.aws.services.inspector2.inspector2_service import ( - Inspector, - InspectorFinding, -) +from prowler.providers.aws.services.inspector2.inspector2_service import Inspector from tests.providers.aws.utils import ( AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1, @@ -32,7 +29,7 @@ class Test_inspector2_active_findings_exist: arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2", status="ENABLED", region=AWS_REGION_EU_WEST_1, - findings=[], + active_findings=False, ) ] aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) @@ -58,7 +55,7 @@ class Test_inspector2_active_findings_exist: assert result[0].status == "PASS" assert ( result[0].status_extended - == "Inspector2 is enabled with no findings." + == "Inspector2 is enabled with no active findings." ) assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert ( @@ -83,15 +80,7 @@ class Test_inspector2_active_findings_exist: arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2", region=AWS_REGION_EU_WEST_1, status="ENABLED", - findings=[ - InspectorFinding( - arn=FINDING_ARN, - region=AWS_REGION_EU_WEST_1, - severity="MEDIUM", - status="NOT_ACTIVE", - title="CVE-2022-40897 - setuptools", - ) - ], + active_findings=False, ) ] aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) @@ -142,15 +131,7 @@ class Test_inspector2_active_findings_exist: arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2", region=AWS_REGION_EU_WEST_1, status="ENABLED", - findings=[ - InspectorFinding( - arn=FINDING_ARN, - region=AWS_REGION_EU_WEST_1, - severity="MEDIUM", - status="ACTIVE", - title="CVE-2022-40897 - setuptools", - ) - ], + active_findings=True, ) ] aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) @@ -175,74 +156,7 @@ class Test_inspector2_active_findings_exist: assert len(result) == 1 assert result[0].status == "FAIL" assert ( - result[0].status_extended - == "There are 1 active Inspector2 findings." - ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert ( - result[0].resource_arn - == f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2" - ) - assert result[0].region == AWS_REGION_EU_WEST_1 - - def test_enabled_with_active_and_closed_findings(self): - # Mock the inspector2 client - inspector2_client = mock.MagicMock - - inspector2_client.provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) - inspector2_client.audited_account = AWS_ACCOUNT_NUMBER - inspector2_client.audited_account_arn = ( - f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" - ) - inspector2_client.region = AWS_REGION_EU_WEST_1 - inspector2_client.inspectors = [ - Inspector( - id=AWS_ACCOUNT_NUMBER, - arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2", - region=AWS_REGION_EU_WEST_1, - status="ENABLED", - findings=[ - InspectorFinding( - arn=FINDING_ARN, - region=AWS_REGION_EU_WEST_1, - severity="MEDIUM", - status="ACTIVE", - title="CVE-2022-40897 - setuptools", - ), - InspectorFinding( - arn=FINDING_ARN, - region=AWS_REGION_EU_WEST_1, - severity="MEDIUM", - status="CLOSED", - title="CVE-2022-27404 - freetype", - ), - ], - ) - ] - aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) - - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=aws_provider, - ): - with mock.patch( - "prowler.providers.aws.services.inspector2.inspector2_active_findings_exist.inspector2_active_findings_exist.inspector2_client", - new=inspector2_client, - ): - - # Test Check - from prowler.providers.aws.services.inspector2.inspector2_active_findings_exist.inspector2_active_findings_exist import ( - inspector2_active_findings_exist, - ) - - check = inspector2_active_findings_exist() - result = check.execute() - - assert len(result) == 1 - assert result[0].status == "FAIL" - assert ( - result[0].status_extended - == "There are 1 active Inspector2 findings." + result[0].status_extended == "There are active Inspector2 findings." ) assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert ( @@ -278,7 +192,7 @@ class Test_inspector2_active_findings_exist: arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2", status="DISABLED", region=AWS_REGION_EU_WEST_1, - findings=[], + active_findings=False, ) ] aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) diff --git a/tests/providers/aws/services/inspector2/inspector2_service_test.py b/tests/providers/aws/services/inspector2/inspector2_service_test.py index b8690b4ed1..9088f6d6f8 100644 --- a/tests/providers/aws/services/inspector2/inspector2_service_test.py +++ b/tests/providers/aws/services/inspector2/inspector2_service_test.py @@ -105,14 +105,7 @@ class Test_Inspector2_Service: assert inspector2.inspectors[0].region == AWS_REGION_EU_WEST_1 assert inspector2.inspectors[0].status == "ENABLED" - def test__list_findings__(self): + def test__list_active_findings__(self): aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) inspector2 = Inspector2(aws_provider) - assert len(inspector2.inspectors[0].findings) == 1 - assert inspector2.inspectors[0].findings[0].arn == FINDING_ARN - assert inspector2.inspectors[0].findings[0].region == AWS_REGION_EU_WEST_1 - assert inspector2.inspectors[0].findings[0].severity == "MEDIUM" - assert inspector2.inspectors[0].findings[0].status == "ACTIVE" - assert ( - inspector2.inspectors[0].findings[0].title == "CVE-2022-40897 - setuptools" - ) + assert inspector2.inspectors[0].active_findings