diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 6fa0d3a0d1..5526041c88 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Cloudflare account-scoped API tokens failing connection test in the App with `CloudflareUserTokenRequiredError` [(#10723)](https://github.com/prowler-cloud/prowler/pull/10723) - Google Workspace Calendar checks false FAIL on unconfigured settings with secure Google defaults [(#10726)](https://github.com/prowler-cloud/prowler/pull/10726) - `prowler image --registry` failing with `ImageNoImagesProvidedError` due to registry arguments not being forwarded to `ImageProvider` in `init_global_provider` [(#10470)](https://github.com/prowler-cloud/prowler/pull/10470) +- Google Workspace Drive checks false FAIL on unconfigured settings with secure Google defaults [(#10727)](https://github.com/prowler-cloud/prowler/pull/10727) --- diff --git a/prowler/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users.py b/prowler/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users.py index 973a672f82..15f6187949 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users.py +++ b/prowler/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users.py @@ -33,21 +33,20 @@ class drive_external_sharing_warn_users(Check): f"External sharing warnings for Drive and Docs are enabled " f"in domain {drive_client.provider.identity.domain}." ) + elif warning_enabled is None: + report.status = "PASS" + report.status_extended = ( + f"External sharing warnings for Drive and Docs use Google's " + f"secure default configuration (enabled) " + f"in domain {drive_client.provider.identity.domain}." + ) else: report.status = "FAIL" - if warning_enabled is None: - report.status_extended = ( - f"External sharing warnings for Drive and Docs are not " - f"explicitly configured in domain " - f"{drive_client.provider.identity.domain}. " - f"Users should be warned when sharing files outside the organization." - ) - else: - report.status_extended = ( - f"External sharing warnings for Drive and Docs are disabled " - f"in domain {drive_client.provider.identity.domain}. " - f"Users should be warned when sharing files outside the organization." - ) + report.status_extended = ( + f"External sharing warnings for Drive and Docs are disabled " + f"in domain {drive_client.provider.identity.domain}. " + f"Users should be warned when sharing files outside the organization." + ) findings.append(report) diff --git a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed.py b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed.py index c36611326f..f976891147 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed.py +++ b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed.py @@ -35,22 +35,21 @@ class drive_shared_drive_creation_allowed(Check): f"Users in domain {drive_client.provider.identity.domain} " f"are allowed to create new shared drives." ) + elif allow_creation is None: + report.status = "PASS" + report.status_extended = ( + f"Shared drive creation uses Google's secure default " + f"configuration (allowed) " + f"in domain {drive_client.provider.identity.domain}." + ) else: report.status = "FAIL" - if allow_creation is None: - report.status_extended = ( - f"Shared drive creation is not explicitly configured in " - f"domain {drive_client.provider.identity.domain}. " - f"Users should be allowed to create new shared drives to avoid " - f"data loss when accounts are deleted." - ) - else: - report.status_extended = ( - f"Users in domain {drive_client.provider.identity.domain} " - f"are prevented from creating new shared drives. " - f"Users should be allowed to create new shared drives to avoid " - f"data loss when accounts are deleted." - ) + report.status_extended = ( + f"Users in domain {drive_client.provider.identity.domain} " + f"are prevented from creating new shared drives. " + f"Users should be allowed to create new shared drives to avoid " + f"data loss when accounts are deleted." + ) findings.append(report) diff --git a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy.py b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy.py index b112cd70b5..45edd64884 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy.py +++ b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy.py @@ -35,21 +35,21 @@ class drive_shared_drive_disable_download_print_copy(Check): f"{drive_client.provider.identity.domain} is restricted to " f"{allowed}." ) + elif allowed is None: + report.status = "PASS" + report.status_extended = ( + f"Download, print, and copy restrictions for shared drives use " + f"Google's secure default configuration (disabled for viewers " + f"and commenters) " + f"in domain {drive_client.provider.identity.domain}." + ) else: report.status = "FAIL" - if allowed is None: - report.status_extended = ( - f"Download, print, and copy restrictions for shared drive " - f"viewers and commenters are not explicitly configured in " - f"domain {drive_client.provider.identity.domain}. " - f"These actions should be restricted to editors or managers only." - ) - else: - report.status_extended = ( - f"Download, print, and copy in shared drives in domain " - f"{drive_client.provider.identity.domain} is set to {allowed}. " - f"These actions should be restricted to editors or managers only." - ) + report.status_extended = ( + f"Download, print, and copy in shared drives in domain " + f"{drive_client.provider.identity.domain} is set to {allowed}. " + f"These actions should be restricted to editors or managers only." + ) findings.append(report) diff --git a/prowler/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains.py b/prowler/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains.py index e5f243ae36..f8d8f4b586 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains.py +++ b/prowler/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains.py @@ -36,21 +36,20 @@ class drive_warn_sharing_with_allowlisted_domains(Check): f"Users are warned when sharing files with allowlisted " f"domains in domain {drive_client.provider.identity.domain}." ) + elif warn_enabled is None: + report.status = "PASS" + report.status_extended = ( + f"Warning when sharing with allowlisted domains uses Google's " + f"secure default configuration (enabled) " + f"in domain {drive_client.provider.identity.domain}." + ) else: report.status = "FAIL" - if warn_enabled is None: - report.status_extended = ( - f"Warning when sharing with allowlisted domains is not " - f"explicitly configured in domain " - f"{drive_client.provider.identity.domain}. " - f"Users should be warned when sharing files with users in allowlisted domains." - ) - else: - report.status_extended = ( - f"Warning when sharing with allowlisted domains is disabled " - f"in domain {drive_client.provider.identity.domain}. " - f"Users should be warned when sharing files with users in allowlisted domains." - ) + report.status_extended = ( + f"Warning when sharing with allowlisted domains is disabled " + f"in domain {drive_client.provider.identity.domain}. " + f"Users should be warned when sharing files with users in allowlisted domains." + ) findings.append(report) diff --git a/tests/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users_test.py b/tests/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users_test.py index c9c7317f2b..2ad66b3d2f 100644 --- a/tests/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users_test.py +++ b/tests/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users_test.py @@ -67,8 +67,8 @@ class TestDriveExternalSharingWarnUsers: assert findings[0].status == "FAIL" assert "disabled" in findings[0].status_extended - def test_fail_no_policy_set(self): - """Test FAIL when no explicit policy is set (None) but fetch succeeded""" + def test_pass_using_default(self): + """Test PASS when no explicit policy is set (None) — Google default is secure""" mock_provider = set_mocked_googleworkspace_provider() with ( @@ -92,8 +92,8 @@ class TestDriveExternalSharingWarnUsers: findings = check.execute() assert len(findings) == 1 - assert findings[0].status == "FAIL" - assert "not explicitly configured" in findings[0].status_extended + assert findings[0].status == "PASS" + assert "secure default" in findings[0].status_extended def test_no_findings_when_fetch_failed(self): """Test no findings returned when the API fetch failed""" diff --git a/tests/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed_test.py b/tests/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed_test.py index f221e1ec75..016e643f2d 100644 --- a/tests/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed_test.py +++ b/tests/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed_test.py @@ -69,8 +69,8 @@ class TestDriveSharedDriveCreationAllowed: assert findings[0].status == "FAIL" assert "prevented" in findings[0].status_extended - def test_fail_no_policy_set(self): - """Test FAIL when no explicit policy is set (None) but fetch succeeded""" + def test_pass_using_default(self): + """Test PASS when no explicit policy is set (None) — Google default is secure""" mock_provider = set_mocked_googleworkspace_provider() with ( @@ -94,8 +94,8 @@ class TestDriveSharedDriveCreationAllowed: findings = check.execute() assert len(findings) == 1 - assert findings[0].status == "FAIL" - assert "not explicitly configured" in findings[0].status_extended + assert findings[0].status == "PASS" + assert "secure default" in findings[0].status_extended def test_no_findings_when_fetch_failed(self): """Test no findings returned when the API fetch failed""" diff --git a/tests/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy_test.py b/tests/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy_test.py index 35ee7b1651..05edcb57a2 100644 --- a/tests/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy_test.py +++ b/tests/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy_test.py @@ -101,8 +101,8 @@ class TestDriveSharedDriveDisableDownloadPrintCopy: assert findings[0].status == "FAIL" assert "ALL" in findings[0].status_extended - def test_fail_no_policy_set(self): - """Test FAIL when no explicit policy is set (None) but fetch succeeded""" + def test_pass_using_default(self): + """Test PASS when no explicit policy is set (None) — Google default is secure""" mock_provider = set_mocked_googleworkspace_provider() with ( @@ -128,8 +128,8 @@ class TestDriveSharedDriveDisableDownloadPrintCopy: findings = check.execute() assert len(findings) == 1 - assert findings[0].status == "FAIL" - assert "not explicitly configured" in findings[0].status_extended + assert findings[0].status == "PASS" + assert "secure default" in findings[0].status_extended def test_no_findings_when_fetch_failed(self): """Test no findings returned when the API fetch failed""" diff --git a/tests/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains_test.py b/tests/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains_test.py index a494bbe2eb..1731b81fcc 100644 --- a/tests/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains_test.py +++ b/tests/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains_test.py @@ -71,8 +71,8 @@ class TestDriveWarnSharingWithAllowlistedDomains: assert findings[0].status == "FAIL" assert "disabled" in findings[0].status_extended - def test_fail_no_policy_set(self): - """Test FAIL when no explicit policy is set (None) but fetch succeeded""" + def test_pass_using_default(self): + """Test PASS when no explicit policy is set (None) — Google default is secure""" mock_provider = set_mocked_googleworkspace_provider() with ( @@ -98,8 +98,8 @@ class TestDriveWarnSharingWithAllowlistedDomains: findings = check.execute() assert len(findings) == 1 - assert findings[0].status == "FAIL" - assert "not explicitly configured" in findings[0].status_extended + assert findings[0].status == "PASS" + assert "secure default" in findings[0].status_extended def test_no_findings_when_fetch_failed(self): """Test no findings returned when the API fetch failed"""