From 677fa531cfd315b59ffc1adc42ae3c73c995e621 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Mon, 26 Aug 2024 11:00:42 +0200 Subject: [PATCH] fix(aws): enchance check cloudformation_stack_outputs_find_secrets (#4862) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Pedro Martín --- ...oudformation_stack_outputs_find_secrets.py | 21 ++++++++++++++----- ...mation_stack_outputs_find_secrets_test.py} | 2 +- 2 files changed, 17 insertions(+), 6 deletions(-) rename tests/providers/aws/services/cloudformation/{cloudformation_outputs_find_secrets/cloudformation_outputs_find_secrets_test.py => cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets_test.py} (99%) diff --git a/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.py b/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.py index 5dbdfcc836..92abab4c57 100644 --- a/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.py +++ b/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.py @@ -29,7 +29,12 @@ class cloudformation_stack_outputs_find_secrets(Check): # Store the CloudFormation Stack Outputs into a file for output in stack.outputs: - temp_output_file.write(f"{output}".encode()) + temp_output_file.write( + bytes( + f"{output}\n", + encoding="raw_unicode_escape", + ) + ) temp_output_file.close() # Init detect_secrets @@ -38,11 +43,17 @@ class cloudformation_stack_outputs_find_secrets(Check): with default_settings(): secrets.scan_file(temp_output_file.name) - if secrets.json(): - report.status = "FAIL" - report.status_extended = ( - f"Potential secret found in Stack {stack.name} Outputs." + detect_secrets_output = secrets.json() + # If secrets are found, update the report status + if detect_secrets_output: + secrets_string = ", ".join( + [ + f"{secret['type']} in Output {int(secret['line_number'])}" + for secret in detect_secrets_output[temp_output_file.name] + ] ) + report.status = "FAIL" + report.status_extended = f"Potential secret found in Stack {stack.name} Outputs -> {secrets_string}." os.remove(temp_output_file.name) else: diff --git a/tests/providers/aws/services/cloudformation/cloudformation_outputs_find_secrets/cloudformation_outputs_find_secrets_test.py b/tests/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets_test.py similarity index 99% rename from tests/providers/aws/services/cloudformation/cloudformation_outputs_find_secrets/cloudformation_outputs_find_secrets_test.py rename to tests/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets_test.py index d2bb52f6f7..1d56720404 100644 --- a/tests/providers/aws/services/cloudformation/cloudformation_outputs_find_secrets/cloudformation_outputs_find_secrets_test.py +++ b/tests/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets_test.py @@ -51,7 +51,7 @@ class Test_cloudformation_stack_outputs_find_secrets: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"Potential secret found in Stack {stack_name} Outputs." + == f"Potential secret found in Stack {stack_name} Outputs -> Secret Keyword in Output 1." ) assert result[0].resource_id == "Test-Stack" assert (