From 63bb337996f1911bfca0e2795c497a42b9386140 Mon Sep 17 00:00:00 2001 From: Sergio Garcia <38561120+sergargar@users.noreply.github.com> Date: Thu, 6 Jun 2024 10:57:36 -0400 Subject: [PATCH] chore(backport): update v3 with latest changes (#4198) Co-authored-by: Pepe Fagoaga --- .../providers/aws/aws_regions_by_service.json | 3 ++ .../elasticache/elasticache_service.py | 2 +- .../aws/services/glue/glue_service.py | 13 +++++ .../providers/aws/services/rds/rds_service.py | 18 ++++--- .../providers/aws/services/s3/s3_service.py | 13 +++++ ...ticache_cluster_uses_public_subnet_test.py | 48 +++++++++++++++++++ 6 files changed, 89 insertions(+), 8 deletions(-) diff --git a/prowler/providers/aws/aws_regions_by_service.json b/prowler/providers/aws/aws_regions_by_service.json index c4e402e7dd..8b638a2105 100644 --- a/prowler/providers/aws/aws_regions_by_service.json +++ b/prowler/providers/aws/aws_regions_by_service.json @@ -4958,6 +4958,7 @@ "ap-southeast-3", "ap-southeast-4", "ca-central-1", + "ca-west-1", "eu-central-1", "eu-central-2", "eu-north-1", @@ -10700,9 +10701,11 @@ "eu-north-1", "eu-west-1", "eu-west-2", + "eu-west-3", "sa-east-1", "us-east-1", "us-east-2", + "us-west-1", "us-west-2" ], "aws-cn": [], diff --git a/prowler/providers/aws/services/elasticache/elasticache_service.py b/prowler/providers/aws/services/elasticache/elasticache_service.py index 44f7a7551d..cc100994b3 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_service.py +++ b/prowler/providers/aws/services/elasticache/elasticache_service.py @@ -101,5 +101,5 @@ class Cluster(BaseModel): arn: str region: str cache_subnet_group_id: Optional[str] - subnets: Optional[list] + subnets: list = [] tags: Optional[list] diff --git a/prowler/providers/aws/services/glue/glue_service.py b/prowler/providers/aws/services/glue/glue_service.py index 3ce647ac60..b5964ce31e 100644 --- a/prowler/providers/aws/services/glue/glue_service.py +++ b/prowler/providers/aws/services/glue/glue_service.py @@ -1,5 +1,6 @@ from typing import Optional +from botocore.exceptions import ClientError from pydantic import BaseModel from prowler.lib.logger import logger @@ -72,6 +73,18 @@ class Glue(AWSService): region=regional_client.region, ) ) + except ClientError as error: + # Check if the operation is not supported in the region + if error.response["Error"]["Message"].startswith( + "Operation is not supported" + ): + logger.warning( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + else: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) except Exception as error: logger.error( f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" diff --git a/prowler/providers/aws/services/rds/rds_service.py b/prowler/providers/aws/services/rds/rds_service.py index e755688930..b1e724801b 100644 --- a/prowler/providers/aws/services/rds/rds_service.py +++ b/prowler/providers/aws/services/rds/rds_service.py @@ -232,15 +232,19 @@ class RDS(AWSService): DBClusterParameterGroupName=cluster.parameter_group ): for parameter in page["Parameters"]: - if parameter["ParameterName"] == "rds.force_ssl": - cluster.force_ssl = parameter["ParameterValue"] if ( - parameter["ParameterName"] - == "require_secure_transport" + "ParameterValue" in parameter + and "ParameterName" in parameter ): - cluster.require_secure_transport = parameter[ - "ParameterValue" - ] + if parameter["ParameterName"] == "rds.force_ssl": + cluster.force_ssl = parameter["ParameterValue"] + if ( + parameter["ParameterName"] + == "require_secure_transport" + ): + cluster.require_secure_transport = parameter[ + "ParameterValue" + ] except ClientError as error: if ( error.response["Error"]["Code"] diff --git a/prowler/providers/aws/services/s3/s3_service.py b/prowler/providers/aws/services/s3/s3_service.py index a2d75c0564..4e47fa3090 100644 --- a/prowler/providers/aws/services/s3/s3_service.py +++ b/prowler/providers/aws/services/s3/s3_service.py @@ -84,10 +84,23 @@ class S3(AWSService): logger.warning( f"{bucket['Name']} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + else: + logger.error( + f"{bucket['Name']} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) except Exception as error: logger.error( f"{bucket['Name']} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + except ClientError as error: + if error.response["Error"]["Code"] == "NotSignedUp": + logger.warning( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + else: + logger.error( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) except Exception as error: logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" diff --git a/tests/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet_test.py b/tests/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet_test.py index 5f3ae884ac..21fd98dbdd 100644 --- a/tests/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet_test.py +++ b/tests/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet_test.py @@ -58,6 +58,54 @@ class Test_elasticache_cluster_uses_public_subnet: result = check.execute() assert len(result) == 0 + def test_elasticache_no_subnets(self): + # Mock ElastiCache Service + elasticache_service = MagicMock + elasticache_service.clusters = {} + + elasticache_service.clusters[ELASTICACHE_CLUSTER_ARN] = Cluster( + arn=ELASTICACHE_CLUSTER_ARN, + name=ELASTICACHE_CLUSTER_NAME, + id=ELASTICACHE_CLUSTER_NAME, + region=AWS_REGION_US_EAST_1, + cache_subnet_group_id=SUBNET_GROUP_NAME, + tags=ELASTICACHE_CLUSTER_TAGS, + ) + + # Mock VPC Service + vpc_client = MagicMock + vpc_client.vpc_subnets = {} + + with mock.patch( + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + new=set_mocked_aws_audit_info([AWS_REGION_US_EAST_1]), + ), mock.patch( + "prowler.providers.aws.services.elasticache.elasticache_service.ElastiCache", + new=elasticache_service, + ), mock.patch( + "prowler.providers.aws.services.vpc.vpc_service.VPC", + new=vpc_client, + ), mock.patch( + "prowler.providers.aws.services.vpc.vpc_client.vpc_client", + new=vpc_client, + ): + from prowler.providers.aws.services.elasticache.elasticache_cluster_uses_public_subnet.elasticache_cluster_uses_public_subnet import ( + elasticache_cluster_uses_public_subnet, + ) + + check = elasticache_cluster_uses_public_subnet() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Cluster {ELASTICACHE_CLUSTER_NAME} is not using public subnets." + ) + assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].resource_id == ELASTICACHE_CLUSTER_NAME + assert result[0].resource_arn == ELASTICACHE_CLUSTER_ARN + assert result[0].resource_tags == ELASTICACHE_CLUSTER_TAGS + def test_elasticache_clusters_using_private_subnets(self): # Mock ElastiCache Service elasticache_service = MagicMock