fix(gcp): add default project for org level checks (#5132)

Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>

prowler/providers/gcp/gcp_provider.py

@@ -46,7 +46,7 @@ class GcpProvider(Provider):
         self._impersonated_service_account = arguments.impersonate_service_account
         list_project_ids = arguments.list_project_id
 
-        self._session = self.setup_session(
+        self._session, self._default_project_id = self.setup_session(
             credentials_file, self._impersonated_service_account
         )
 
@@ -128,6 +128,10 @@ class GcpProvider(Provider):
     def projects(self):
         return self._projects
 
+    @property
+    def default_project_id(self):
+        return self._default_project_id
+
     @property
     def impersonated_service_account(self):
         return self._impersonated_service_account
@@ -198,14 +202,14 @@ class GcpProvider(Provider):
             # "partition": "identity.partition",
         }
 
-    def setup_session(self, credentials_file: str, service_account: str) -> Credentials:
+    def setup_session(self, credentials_file: str, service_account: str) -> tuple:
         """
         Setup the GCP session with the provided credentials file or service account to impersonate
         Args:
             credentials_file: str
             service_account: str
         Returns:
-            Credentials object
+            Credentials object and default project ID
         """
         try:
             scopes = ["https://www.googleapis.com/auth/cloud-platform"]
@@ -215,7 +219,7 @@ class GcpProvider(Provider):
                 self.__set_gcp_creds_env_var__(credentials_file)
 
             # Get default credentials
-            credentials, _ = default(scopes=scopes)
+            credentials, default_project_id = default(scopes=scopes)
 
             # Refresh the credentials to ensure they are valid
             credentials.refresh(Request())
@@ -231,7 +235,7 @@ class GcpProvider(Provider):
                 )
                 logger.info(f"Impersonated credentials: {credentials}")
 
-            return credentials
+            return credentials, default_project_id
         except Exception as error:
             logger.critical(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"

prowler/providers/gcp/lib/service/service.py

@@ -30,6 +30,7 @@ class GCPService:
         )
         # Only project ids that have their API enabled will be scanned
         self.project_ids = self.__is_api_active__(provider.project_ids)
+        self.default_project_id = provider.default_project_id
         self.audit_config = provider.audit_config
         self.fixer_config = provider.fixer_config
 

prowler/providers/gcp/services/iam/iam_organization_essential_contacts_configured/iam_organization_essential_contacts_configured.py

@@ -9,7 +9,7 @@ class iam_organization_essential_contacts_configured(Check):
         findings = []
         for org in essentialcontacts_client.organizations:
             report = Check_Report_GCP(self.metadata())
-            report.project_id = org.id
+            report.project_id = essentialcontacts_client.default_project_id
             report.resource_id = org.id
             report.resource_name = org.name
             report.location = essentialcontacts_client.region

tests/providers/gcp/gcp_fixtures.py

@@ -12,13 +12,14 @@ GCP_US_CENTER1_LOCATION = "us-central1"
 
 
 def set_mocked_gcp_provider(
-    project_ids: list[str] = [], profile: str = ""
+    project_ids: list[str] = [GCP_PROJECT_ID], profile: str = ""
 ) -> GcpProvider:
     provider = MagicMock()
     provider.type = "gcp"
     provider.session = MagicMock()
     provider.session._service_account_email = "test@test.com"
     provider.project_ids = project_ids
+    provider.default_project_id = GCP_PROJECT_ID
     provider.identity = GCPIdentityInfo(
         profile=profile,
     )

tests/providers/gcp/gcp_provider_test.py

@@ -35,7 +35,7 @@ class TestGCPProvider:
         }
         with patch(
             "prowler.providers.gcp.gcp_provider.GcpProvider.setup_session",
-            return_value=None,
+            return_value=(None, "test-project"),
         ), patch(
             "prowler.providers.gcp.gcp_provider.GcpProvider.get_projects",
             return_value=projects,
@@ -47,6 +47,7 @@ class TestGCPProvider:
             assert gcp_provider.session is None
             assert gcp_provider.project_ids == ["test-project"]
             assert gcp_provider.projects == projects
+            assert gcp_provider.default_project_id == "test-project"
             assert gcp_provider.identity == GCPIdentityInfo(profile="default")
             assert gcp_provider.audit_config == {"shodan_api_key": None}
 
@@ -81,7 +82,7 @@ class TestGCPProvider:
         }
         with patch(
             "prowler.providers.gcp.gcp_provider.GcpProvider.setup_session",
-            return_value=None,
+            return_value=(None, None),
         ), patch(
             "prowler.providers.gcp.gcp_provider.GcpProvider.get_projects",
             return_value=projects,
@@ -154,7 +155,7 @@ class TestGCPProvider:
         }
         with patch(
             "prowler.providers.gcp.gcp_provider.GcpProvider.setup_session",
-            return_value=None,
+            return_value=(None, None),
         ), patch(
             "prowler.providers.gcp.gcp_provider.GcpProvider.get_projects",
             return_value=projects,

tests/providers/gcp/services/iam/iam_organization_essential_contacts_configured/iam_organization_essential_contacts_configured_test.py

@@ -40,6 +40,7 @@ class Test_iam_organization_essential_contacts_configured:
             essentialcontacts_client.organizations = [
                 Organization(id="test_id", name="test", contacts=True)
             ]
+            essentialcontacts_client.default_project_id = "test_id"
             from prowler.providers.gcp.services.iam.iam_organization_essential_contacts_configured.iam_organization_essential_contacts_configured import (
                 iam_organization_essential_contacts_configured,
             )
@@ -73,6 +74,7 @@ class Test_iam_organization_essential_contacts_configured:
             essentialcontacts_client.organizations = [
                 Organization(id="test_id", name="test", contacts=False)
             ]
+            essentialcontacts_client.default_project_id = "test_id"
 
             from prowler.providers.gcp.services.iam.iam_organization_essential_contacts_configured.iam_organization_essential_contacts_configured import (
                 iam_organization_essential_contacts_configured,