ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-29 23:04:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(tests): assert metadata and resource id/name

Browse Source
This commit is contained in:
Pepe Fagoaga committed 2025-05-06 09:12:17 +02:00
1 parent 29cc199c9d
commit 6a519067fb
3 files changed
+92 -71
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

prowler/providers/aws/lib/resource/resource.py
+1
View File
@@ -43,6 +43,7 @@ class AWSResource(Resource):
return values
@validator("region")
# TODO: validate regions
def region_must_be_valid(cls, v):
if not v:
raise ValueError("region cannot be empty")
prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py
+1 -1
View File
@@ -32,7 +32,7 @@ class accessanalyzer_enabled(Check):
and not analyzer.region == accessanalyzer_client.region
):
report.muted = True
print(report)
findings.append(report)
return findings
tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py
+90 -70
View File
@@ -3,13 +3,14 @@ from unittest import mock
from prowler.providers.aws.services.accessanalyzer.accessanalyzer_service import (
Analyzer,
)
from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, AWS_REGION_EU_WEST_2
AWS_REGION_1 = "eu-west-1"
AWS_REGION_2 = "eu-west-2"
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
ACCESS_ANALYZER_NAME = "test-analyzer"
ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_2}:{AWS_ACCOUNT_NUMBER}:analyzer/{ACCESS_ANALYZER_NAME}"
ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_EU_WEST_2}:{AWS_ACCOUNT_NUMBER}:analyzer/{ACCESS_ANALYZER_NAME}"
UNKNOWN_ACCESS_ANALYZER_NAME = "unknown"
UNKNOWN_ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:analyzer/{UNKNOWN_ACCESS_ANALYZER_NAME}"
class Test_accessanalyzer_enabled:
@@ -33,31 +34,22 @@ class Test_accessanalyzer_enabled:
def test_one_analyzer_not_available(self):
# Include analyzers to check
accessanalyzer_client = mock.MagicMock
accessanalyzer_client.region = AWS_REGION_1
accessanalyzer_client.region = AWS_REGION_EU_WEST_1
accessanalyzer_client.audited_partition = "aws"
accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER
accessanalyzer_client.get_unknown_arn = (
lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:unknown"
)
accessanalyzer_client.analyzers = [
Analyzer(
arn=AWS_ACCOUNT_ARN,
name=AWS_ACCOUNT_NUMBER,
arn=UNKNOWN_ACCESS_ANALYZER_ARN,
name=UNKNOWN_ACCESS_ANALYZER_NAME,
status="NOT_AVAILABLE",
tags=[],
type="",
region=AWS_REGION_1,
)
]
with (
mock.patch(
"prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer",
accessanalyzer_client,
),
mock.patch(
"prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn",
return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:unknown",
),
with mock.patch(
"prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer",
accessanalyzer_client,
):
from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import (
accessanalyzer_enabled,
@@ -73,34 +65,38 @@ class Test_accessanalyzer_enabled:
== f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled."
)
# Review this values too
assert result[0].resource_id == "123456789012"
# Review the following line, maybe it should be:
# "arn:aws:access-analyzer::123456789012:root"
# "arn:aws:access-analyzer::123456789012:account"
assert result[0].resource_arn == "arn:aws:iam::123456789012:root"
assert result[0].region == AWS_REGION_1
assert result[0].resource_id == UNKNOWN_ACCESS_ANALYZER_NAME
assert result[0].resource_arn == UNKNOWN_ACCESS_ANALYZER_ARN
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
assert result[0].resource_service == "access-analyzer"
# assert result[0].resource == ""
assert result[0].resource == {
"service": "access-analyzer",
"arn": UNKNOWN_ACCESS_ANALYZER_ARN,
"id": UNKNOWN_ACCESS_ANALYZER_NAME,
"name": UNKNOWN_ACCESS_ANALYZER_NAME,
"tags": [],
"region": "eu-west-1",
"status": "NOT_AVAILABLE",
"findings": [],
"type": "",
}
def test_one_analyzer_not_available_muted(self):
# Include analyzers to check
accessanalyzer_client = mock.MagicMock
accessanalyzer_client.region = AWS_REGION_2
accessanalyzer_client.region = AWS_REGION_EU_WEST_2
accessanalyzer_client.audit_config = {"mute_non_default_regions": True}
accessanalyzer_client.audited_partition = "aws"
accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER
accessanalyzer_client.get_unknown_arn = (
lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:unknown"
)
accessanalyzer_client.analyzers = [
Analyzer(
arn=AWS_ACCOUNT_ARN,
name=AWS_ACCOUNT_NUMBER,
arn=UNKNOWN_ACCESS_ANALYZER_ARN,
name=UNKNOWN_ACCESS_ANALYZER_NAME,
status="NOT_AVAILABLE",
tags=[],
type="",
region=AWS_REGION_1,
)
]
with (
@@ -108,10 +104,6 @@ class Test_accessanalyzer_enabled:
"prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer",
accessanalyzer_client,
),
mock.patch(
"prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn",
return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:unknown",
),
):
from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import (
accessanalyzer_enabled,
@@ -127,29 +119,36 @@ class Test_accessanalyzer_enabled:
result[0].status_extended
== f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled."
)
assert result[0].resource_id == "123456789012"
assert result[0].resource_arn == "arn:aws:iam::123456789012:root"
assert result[0].region == AWS_REGION_1
assert result[0].resource_id == UNKNOWN_ACCESS_ANALYZER_NAME
assert result[0].resource_arn == UNKNOWN_ACCESS_ANALYZER_ARN
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
assert result[0].resource_service == "access-analyzer"
# assert result[0].resource == ""
assert result[0].resource == {
"service": "access-analyzer",
"arn": UNKNOWN_ACCESS_ANALYZER_ARN,
"id": UNKNOWN_ACCESS_ANALYZER_NAME,
"name": UNKNOWN_ACCESS_ANALYZER_NAME,
"tags": [],
"region": "eu-west-1",
"status": "NOT_AVAILABLE",
"findings": [],
"type": "",
}
def test_two_analyzers(self):
accessanalyzer_client = mock.MagicMock
accessanalyzer_client.region = AWS_REGION_1
accessanalyzer_client.region = AWS_REGION_EU_WEST_1
accessanalyzer_client.audited_partition = "aws"
accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER
accessanalyzer_client.get_unknown_arn = (
lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:analyzer/unknown"
)
accessanalyzer_client.analyzers = [
Analyzer(
arn=f"arn:aws:accessanalyzer:{AWS_REGION_1}:{AWS_ACCOUNT_NUMBER}:analyzer/unknown",
name="analyzer/unknown",
arn=UNKNOWN_ACCESS_ANALYZER_ARN,
name=UNKNOWN_ACCESS_ANALYZER_NAME,
status="NOT_AVAILABLE",
tags=[],
type="",
region=AWS_REGION_1,
),
Analyzer(
arn=ACCESS_ANALYZER_ARN,
@@ -157,20 +156,14 @@ class Test_accessanalyzer_enabled:
status="ACTIVE",
tags=[],
type="",
region=AWS_REGION_2,
region=AWS_REGION_EU_WEST_2,
),
]
# Patch AccessAnalyzer Client
with (
mock.patch(
"prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer",
new=accessanalyzer_client,
),
mock.patch(
"prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn",
return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:analyzer/unknown",
),
with mock.patch(
"prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer",
new=accessanalyzer_client,
):
# Test Check
from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import (
@@ -187,13 +180,21 @@ class Test_accessanalyzer_enabled:
result[0].status_extended
== f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled."
)
assert result[0].resource_id == "analyzer/unknown"
assert (
result[0].resource_arn
== "arn:aws:accessanalyzer:eu-west-1:123456789012:analyzer/unknown"
)
assert result[0].resource_id == UNKNOWN_ACCESS_ANALYZER_NAME
assert result[0].resource_arn == UNKNOWN_ACCESS_ANALYZER_ARN
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION_1
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource == {
"service": "access-analyzer",
"arn": UNKNOWN_ACCESS_ANALYZER_ARN,
"id": UNKNOWN_ACCESS_ANALYZER_NAME,
"name": UNKNOWN_ACCESS_ANALYZER_NAME,
"tags": [],
"region": AWS_REGION_EU_WEST_1,
"status": "NOT_AVAILABLE",
"findings": [],
"type": "",
}
assert result[1].status == "PASS"
assert (
@@ -203,9 +204,19 @@ class Test_accessanalyzer_enabled:
assert result[1].resource_id == ACCESS_ANALYZER_NAME
assert result[1].resource_arn == ACCESS_ANALYZER_ARN
assert result[1].resource_tags == []
assert result[1].region == AWS_REGION_2
assert result[0].resource_service == "access-analyzer"
# assert result[0].resource == ""
assert result[1].region == AWS_REGION_EU_WEST_2
assert result[1].resource_service == "access-analyzer"
assert result[1].resource == {
"service": "access-analyzer",
"arn": ACCESS_ANALYZER_ARN,
"id": ACCESS_ANALYZER_NAME,
"name": ACCESS_ANALYZER_NAME,
"tags": [],
"region": AWS_REGION_EU_WEST_2,
"status": "ACTIVE",
"findings": [],
"type": "",
}
def test_one_active_analyzer(self):
accessanalyzer_client = mock.MagicMock
@@ -216,7 +227,6 @@ class Test_accessanalyzer_enabled:
status="ACTIVE",
tags=[],
type="",
region=AWS_REGION_2,
)
]
@@ -242,6 +252,16 @@ class Test_accessanalyzer_enabled:
assert result[0].resource_id == ACCESS_ANALYZER_NAME
assert result[0].resource_arn == ACCESS_ANALYZER_ARN
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION_2
assert result[0].region == AWS_REGION_EU_WEST_2
assert result[0].resource_service == "access-analyzer"
# assert result[0].resource == ""
assert result[0].resource == {
"service": "access-analyzer",
"arn": ACCESS_ANALYZER_ARN,
"id": ACCESS_ANALYZER_NAME,
"name": ACCESS_ANALYZER_NAME,
"tags": [],
"region": AWS_REGION_EU_WEST_2,
"status": "ACTIVE",
"findings": [],
"type": "",
}