From 6a519067fb019f43a1eced86733949d5498f54ea Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Tue, 6 May 2025 09:12:17 +0200 Subject: [PATCH] fix(tests): assert metadata and resource id/name --- .../providers/aws/lib/resource/resource.py | 1 + .../accessanalyzer_enabled.py | 2 +- .../accessanalyzer_enabled_test.py | 160 ++++++++++-------- 3 files changed, 92 insertions(+), 71 deletions(-) diff --git a/prowler/providers/aws/lib/resource/resource.py b/prowler/providers/aws/lib/resource/resource.py index 004f0ff516..408729a660 100644 --- a/prowler/providers/aws/lib/resource/resource.py +++ b/prowler/providers/aws/lib/resource/resource.py @@ -43,6 +43,7 @@ class AWSResource(Resource): return values @validator("region") + # TODO: validate regions def region_must_be_valid(cls, v): if not v: raise ValueError("region cannot be empty") diff --git a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py index 5e3311be9d..b98e0f019a 100644 --- a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py +++ b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py @@ -32,7 +32,7 @@ class accessanalyzer_enabled(Check): and not analyzer.region == accessanalyzer_client.region ): report.muted = True - + print(report) findings.append(report) return findings diff --git a/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py b/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py index f9059a39d6..c69ec269fc 100644 --- a/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py +++ b/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py @@ -3,13 +3,14 @@ from unittest import mock from prowler.providers.aws.services.accessanalyzer.accessanalyzer_service import ( Analyzer, ) +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, AWS_REGION_EU_WEST_2 -AWS_REGION_1 = "eu-west-1" -AWS_REGION_2 = "eu-west-2" AWS_ACCOUNT_NUMBER = "123456789012" AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" ACCESS_ANALYZER_NAME = "test-analyzer" -ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_2}:{AWS_ACCOUNT_NUMBER}:analyzer/{ACCESS_ANALYZER_NAME}" +ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_EU_WEST_2}:{AWS_ACCOUNT_NUMBER}:analyzer/{ACCESS_ANALYZER_NAME}" +UNKNOWN_ACCESS_ANALYZER_NAME = "unknown" +UNKNOWN_ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:analyzer/{UNKNOWN_ACCESS_ANALYZER_NAME}" class Test_accessanalyzer_enabled: @@ -33,31 +34,22 @@ class Test_accessanalyzer_enabled: def test_one_analyzer_not_available(self): # Include analyzers to check accessanalyzer_client = mock.MagicMock - accessanalyzer_client.region = AWS_REGION_1 + accessanalyzer_client.region = AWS_REGION_EU_WEST_1 accessanalyzer_client.audited_partition = "aws" accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER - accessanalyzer_client.get_unknown_arn = ( - lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:unknown" - ) + accessanalyzer_client.analyzers = [ Analyzer( - arn=AWS_ACCOUNT_ARN, - name=AWS_ACCOUNT_NUMBER, + arn=UNKNOWN_ACCESS_ANALYZER_ARN, + name=UNKNOWN_ACCESS_ANALYZER_NAME, status="NOT_AVAILABLE", tags=[], type="", - region=AWS_REGION_1, ) ] - with ( - mock.patch( - "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer", - accessanalyzer_client, - ), - mock.patch( - "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn", - return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:unknown", - ), + with mock.patch( + "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer", + accessanalyzer_client, ): from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import ( accessanalyzer_enabled, @@ -73,34 +65,38 @@ class Test_accessanalyzer_enabled: == f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled." ) # Review this values too - assert result[0].resource_id == "123456789012" - # Review the following line, maybe it should be: - # "arn:aws:access-analyzer::123456789012:root" - # "arn:aws:access-analyzer::123456789012:account" - assert result[0].resource_arn == "arn:aws:iam::123456789012:root" - assert result[0].region == AWS_REGION_1 + assert result[0].resource_id == UNKNOWN_ACCESS_ANALYZER_NAME + assert result[0].resource_arn == UNKNOWN_ACCESS_ANALYZER_ARN + assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_tags == [] assert result[0].resource_service == "access-analyzer" - # assert result[0].resource == "" + assert result[0].resource == { + "service": "access-analyzer", + "arn": UNKNOWN_ACCESS_ANALYZER_ARN, + "id": UNKNOWN_ACCESS_ANALYZER_NAME, + "name": UNKNOWN_ACCESS_ANALYZER_NAME, + "tags": [], + "region": "eu-west-1", + "status": "NOT_AVAILABLE", + "findings": [], + "type": "", + } def test_one_analyzer_not_available_muted(self): # Include analyzers to check accessanalyzer_client = mock.MagicMock - accessanalyzer_client.region = AWS_REGION_2 + accessanalyzer_client.region = AWS_REGION_EU_WEST_2 accessanalyzer_client.audit_config = {"mute_non_default_regions": True} accessanalyzer_client.audited_partition = "aws" accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER - accessanalyzer_client.get_unknown_arn = ( - lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:unknown" - ) + accessanalyzer_client.analyzers = [ Analyzer( - arn=AWS_ACCOUNT_ARN, - name=AWS_ACCOUNT_NUMBER, + arn=UNKNOWN_ACCESS_ANALYZER_ARN, + name=UNKNOWN_ACCESS_ANALYZER_NAME, status="NOT_AVAILABLE", tags=[], type="", - region=AWS_REGION_1, ) ] with ( @@ -108,10 +104,6 @@ class Test_accessanalyzer_enabled: "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer", accessanalyzer_client, ), - mock.patch( - "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn", - return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:unknown", - ), ): from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import ( accessanalyzer_enabled, @@ -127,29 +119,36 @@ class Test_accessanalyzer_enabled: result[0].status_extended == f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled." ) - assert result[0].resource_id == "123456789012" - assert result[0].resource_arn == "arn:aws:iam::123456789012:root" - assert result[0].region == AWS_REGION_1 + assert result[0].resource_id == UNKNOWN_ACCESS_ANALYZER_NAME + assert result[0].resource_arn == UNKNOWN_ACCESS_ANALYZER_ARN + assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_tags == [] assert result[0].resource_service == "access-analyzer" - # assert result[0].resource == "" + assert result[0].resource == { + "service": "access-analyzer", + "arn": UNKNOWN_ACCESS_ANALYZER_ARN, + "id": UNKNOWN_ACCESS_ANALYZER_NAME, + "name": UNKNOWN_ACCESS_ANALYZER_NAME, + "tags": [], + "region": "eu-west-1", + "status": "NOT_AVAILABLE", + "findings": [], + "type": "", + } def test_two_analyzers(self): accessanalyzer_client = mock.MagicMock - accessanalyzer_client.region = AWS_REGION_1 + accessanalyzer_client.region = AWS_REGION_EU_WEST_1 accessanalyzer_client.audited_partition = "aws" accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER - accessanalyzer_client.get_unknown_arn = ( - lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:analyzer/unknown" - ) + accessanalyzer_client.analyzers = [ Analyzer( - arn=f"arn:aws:accessanalyzer:{AWS_REGION_1}:{AWS_ACCOUNT_NUMBER}:analyzer/unknown", - name="analyzer/unknown", + arn=UNKNOWN_ACCESS_ANALYZER_ARN, + name=UNKNOWN_ACCESS_ANALYZER_NAME, status="NOT_AVAILABLE", tags=[], type="", - region=AWS_REGION_1, ), Analyzer( arn=ACCESS_ANALYZER_ARN, @@ -157,20 +156,14 @@ class Test_accessanalyzer_enabled: status="ACTIVE", tags=[], type="", - region=AWS_REGION_2, + region=AWS_REGION_EU_WEST_2, ), ] # Patch AccessAnalyzer Client - with ( - mock.patch( - "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer", - new=accessanalyzer_client, - ), - mock.patch( - "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn", - return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:analyzer/unknown", - ), + with mock.patch( + "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer", + new=accessanalyzer_client, ): # Test Check from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import ( @@ -187,13 +180,21 @@ class Test_accessanalyzer_enabled: result[0].status_extended == f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled." ) - assert result[0].resource_id == "analyzer/unknown" - assert ( - result[0].resource_arn - == "arn:aws:accessanalyzer:eu-west-1:123456789012:analyzer/unknown" - ) + assert result[0].resource_id == UNKNOWN_ACCESS_ANALYZER_NAME + assert result[0].resource_arn == UNKNOWN_ACCESS_ANALYZER_ARN assert result[0].resource_tags == [] - assert result[0].region == AWS_REGION_1 + assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].resource == { + "service": "access-analyzer", + "arn": UNKNOWN_ACCESS_ANALYZER_ARN, + "id": UNKNOWN_ACCESS_ANALYZER_NAME, + "name": UNKNOWN_ACCESS_ANALYZER_NAME, + "tags": [], + "region": AWS_REGION_EU_WEST_1, + "status": "NOT_AVAILABLE", + "findings": [], + "type": "", + } assert result[1].status == "PASS" assert ( @@ -203,9 +204,19 @@ class Test_accessanalyzer_enabled: assert result[1].resource_id == ACCESS_ANALYZER_NAME assert result[1].resource_arn == ACCESS_ANALYZER_ARN assert result[1].resource_tags == [] - assert result[1].region == AWS_REGION_2 - assert result[0].resource_service == "access-analyzer" - # assert result[0].resource == "" + assert result[1].region == AWS_REGION_EU_WEST_2 + assert result[1].resource_service == "access-analyzer" + assert result[1].resource == { + "service": "access-analyzer", + "arn": ACCESS_ANALYZER_ARN, + "id": ACCESS_ANALYZER_NAME, + "name": ACCESS_ANALYZER_NAME, + "tags": [], + "region": AWS_REGION_EU_WEST_2, + "status": "ACTIVE", + "findings": [], + "type": "", + } def test_one_active_analyzer(self): accessanalyzer_client = mock.MagicMock @@ -216,7 +227,6 @@ class Test_accessanalyzer_enabled: status="ACTIVE", tags=[], type="", - region=AWS_REGION_2, ) ] @@ -242,6 +252,16 @@ class Test_accessanalyzer_enabled: assert result[0].resource_id == ACCESS_ANALYZER_NAME assert result[0].resource_arn == ACCESS_ANALYZER_ARN assert result[0].resource_tags == [] - assert result[0].region == AWS_REGION_2 + assert result[0].region == AWS_REGION_EU_WEST_2 assert result[0].resource_service == "access-analyzer" - # assert result[0].resource == "" + assert result[0].resource == { + "service": "access-analyzer", + "arn": ACCESS_ANALYZER_ARN, + "id": ACCESS_ANALYZER_NAME, + "name": ACCESS_ANALYZER_NAME, + "tags": [], + "region": AWS_REGION_EU_WEST_2, + "status": "ACTIVE", + "findings": [], + "type": "", + }